Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1102
Views
5
Helpful
4
Replies

Split tunnel for AnyConnect

KEN COUSINO JR.
Level 1
Level 1

‎07-24-2019 10:02 AM - edited ‎02-21-2020 09:42 PM

We currently have AnyConnect configured and it's working fine.  I need to add a new VPN connection for users and I need to force all traffic for this connection to go through the tunnel for security.  I need to make sure I don't break the existing setup.  

Any help would be appreciated.

 

Here is the portion of the config that matters for this.

 


ip local pool Cpool 10.60.254.3-10.60.254.252 mask 255.255.255.0
ip local pool Restrictpool 10.60.255.0-10.60.255.252 mask 255.255.255.0

object network obj-10.0.0.0
subnet 10.0.0.0 255.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0


object-group network Cnets
network-object 10.10.0.0 255.255.0.0
network-object 10.60.0.0 255.255.0.0

object-group network I_RestrictBlocks
network-object 10.90.30.0 255.255.255.0
network-object 10.90.31.0 255.255.255.0

object-group network I_RestrictAllows
network-object 10.10.0.0 255.255.0.0
network-object 10.60.0.0 255.255.0.0

access-list outside_access_in extended permit icmp any4 any4
access-list inside_access_out extended permit ip any4 any4

access-list nonat extended permit ip object-group Cnets object-group Cnets
access-list nonat extended permit ip 10.10.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip 10.60.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip 10.90.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip object-group Cnets 10.10.0.0 255.255.0.0
access-list nonat extended permit ip object-group Cnets 10.60.0.0 255.255.0.0
access-list nonat extended permit ip object-group Cnets 10.90.0.0 255.255.0.0

access-list SPLIT_ACL extended permit ip 10.10.0.0 255.255.0.0 object-group Cnets
access-list SPLIT_ACL extended permit ip 10.60.0.0 255.255.0.0 object-group Cnets
access-list SPLIT_ACL extended permit ip 10.90.0.0 255.255.0.0 object-group Cnets
access-list SPLIT_ACL extended permit ip object-group Cnets 10.10.0.0 255.255.0.0
access-list SPLIT_ACL extended permit ip object-group Cnets 10.60.0.0 255.255.0.0
access-list SPLIT_ACL extended permit ip object-group Cnets 10.90.0.0 255.255.0.0

access-list I_Restrict extended deny ip 10.60.255.0 255.255.255.0 object-group I_RestrictBlocks
access-list I_Restrict extended permit ip 10.60.255.0 255.255.255.0 object-group I_RestrictAllows
access-list CA_Trip_NOSplit extended permit ip 10.60.254.0 255.255.255.0 any

nat (inside,outside) source static Cnets Cnets destination static Cnets Cnets


group-policy CAtrip internal
group-policy CAtrip attributes
wins-server none
dns-server value 10.10.30.2 10.10.30.1
vpn-tunnel-protocol ikev2 ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CA_Trip_NOSplit
default-domain value research.com
group-policy DfltGrpPolicy attributes
dns-server value 10.10.30.2 10.10.30.1
vpn-idle-timeout 120
vpn-session-timeout 600
vpn-session-timeout alert-interval 30
vpn-filter value SPLIT_ACL
vpn-tunnel-protocol ssl-client ssl-clientless
ipsec-udp enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT_ACL
default-domain value research.com
split-dns value research.com
client-bypass-protocol enable
address-pools value Cpool

 

 

Labels:
0 Helpful
4 Replies 4

Francesco Molino
VIP Alumni
VIP Alumni

‎07-24-2019 09:43 PM - edited ‎07-24-2019 09:45 PM

Hi

What do you mean by all traffic? Do you include all internet traffic as well?

If that's the case, just configure your group policy with a full tunnel instead of specifying an acl for split tunneling.

The command would be: split-tunnel-policy tunnelall


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
0 Helpful

Marvin Rhoads
Hall of Fame
Hall of Fame
In response to Francesco Molino

‎07-25-2019 04:52 AM

@Francesco Molino we would also need to add a "nat (outside,outside)" rule if we go from split tunnel to no split tunnel so that addresses of the remote clients get NATted to a public IP address when they go out to the Internet.

Francesco Molino
VIP Alumni
VIP Alumni
In response to Marvin Rhoads

‎07-25-2019 05:19 AM

@Marvin Rhoads  Yes sure it will be needed.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
0 Helpful

KEN COUSINO JR.
Level 1
Level 1
In response to Francesco Molino

‎07-25-2019 10:39 AM

I have done as you suggested and the VPN traffic going to my internal networks is working well, but the internet bound traffic is not working now.  Meaning when someone connects to the VPN they can't get to the internet.  I think I am missing something but I am not sure what.

Here is what the config looks like now.

 

I can have a constant ping on the remote machine pinging an internal IP and 8.8.8.8.  When it connects to the VPN the internal IP starts replying and the 8.8.8.8 stops replying.

 

Thanks for your help!

 


ip local pool CATrip 10.65.254.1-10.65.254.253 mask 255.255.255.0
ip local pool Restrictpool 10.60.255.0-10.60.255.252 mask 255.255.255.0

object network obj-10.0.0.0
subnet 10.0.0.0 255.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj-10.65.254.0-vpn
subnet 10.65.254.0 255.255.255.0

object-group network Cnets
network-object 10.10.0.0 255.255.0.0
network-object 10.60.0.0 255.255.0.0
network-object 10.65.0.0 255.255.0.0

object-group network I_RestrictBlocks
network-object 10.90.30.0 255.255.255.0
network-object 10.90.31.0 255.255.255.0

object-group network I_RestrictAllows
network-object 10.10.0.0 255.255.0.0
network-object 10.60.0.0 255.255.0.0

access-list outside_access_in extended permit icmp any4 any4
access-list inside_access_out extended permit ip any4 any4

access-list nonat extended permit ip object-group Cnets object-group Cnets
access-list nonat extended permit ip 10.10.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip 10.60.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip 10.65.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip 10.90.0.0 255.255.0.0 object-group Cnets
access-list nonat extended permit ip object-group Cnets 10.10.0.0 255.255.0.0
access-list nonat extended permit ip object-group Cnets 10.60.0.0 255.255.0.0
access-list nonat extended permit ip object-group Cnets 10.65.0.0 255.255.0.0
access-list nonat extended permit ip object-group Cnets 10.90.0.0 255.255.0.0

access-list SPLIT_ACL extended permit ip 10.10.0.0 255.255.0.0 object-group Cnets
access-list SPLIT_ACL extended permit ip 10.60.0.0 255.255.0.0 object-group Cnets
access-list SPLIT_ACL extended permit ip 10.65.0.0 255.255.0.0 object-group Cnets
access-list SPLIT_ACL extended permit ip 10.90.0.0 255.255.0.0 object-group Cnets

access-list SPLIT_ACL extended permit ip object-group Cnets 10.10.0.0 255.255.0.0
access-list SPLIT_ACL extended permit ip object-group Cnets 10.60.0.0 255.255.0.0
access-list SPLIT_ACL extended permit ip object-group Cnets 10.65.0.0 255.255.0.0
access-list SPLIT_ACL extended permit ip object-group Cnets 10.90.0.0 255.255.0.0

access-list I_Restrict extended deny ip 10.60.255.0 255.255.255.0 object-group I_RestrictBlocks
access-list I_Restrict extended permit ip 10.60.255.0 255.255.255.0 object-group I_RestrictAllows

nat (inside,outside) source static Cnets Cnets destination static Cnets Cnets
nat (outside,inside) source static obj-10.65.254.0-vpn obj-10.65.254.0-vpn
nat (outside,outside) source dynamic obj-10.65.254.0-vpn interface


group-policy CAtrip internal
group-policy CAtrip attributes
wins-server none
dns-server value 10.10.30.2 10.10.30.1
vpn-tunnel-protocol ikev2 ssl-client
address-pools value CATrip
split-tunnel-policy tunnelall
default-domain value research.com
group-policy DfltGrpPolicy attributes
dns-server value 10.10.30.2 10.10.30.1
vpn-idle-timeout 120
vpn-session-timeout 600
vpn-session-timeout alert-interval 30
vpn-filter value SPLIT_ACL
vpn-tunnel-protocol ssl-client ssl-clientless
ipsec-udp enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT_ACL
default-domain value research.com
split-dns value research.com
client-bypass-protocol enable
address-pools value Cpool

0 Helpful
Customers Also Viewed These Support Documents