01-20-2023 04:19 AM - edited 01-24-2023 07:39 AM
Good Morning,
Equipment: Firepower FTD1120 - V. 7.2.0-82
I have a local network in 192.168.1.0/24 and a site-to-site between a network 10.100.29.0/24 and 10.100.30.0/24.
I set up an Anyconnect VPN with a split tunneling of the network 192.168.1.0/24 so I access it well, by adding the 10.100.30.0/24 in split tunneling I do not access the equipment in 10.100.30.1 or 10.100.30.2 etc...
However, I have set up an ACL allowing access from Outside to the desired networks.
Thank you in advance for your feedback,
I am available to give you more information if necessary.
01-20-2023 04:30 AM
I am sure when you add IP in to split tunnel it will not via tuunel ? what is the need of split tunnel for 10.100.30.0/24
they already part of your network in site to site VPN, if you connecting one of the site, you can use that network to go 10.100.30.0/24 (by allowing in ACL)
hope i am understanding your requirement correctly.
01-20-2023 06:21 AM
When I connect to VPN I have an IP in 192.168.1.X.
This same network is NAT to 10.100.29.0/24. And there is an on-site site site between 10.100.29.0/24 (internal) and 10.100.30.0/24 (external)
When I am at the company I access the equipment 10.100.30.1 for example, but not in VPN.
01-20-2023 04:49 AM
you need hairpin, please check the above link
01-24-2023 01:02 AM
Hey,
Thanks for the link.
That’s the par "ASA Hairpinning and TCP state bypass"t, just typing the same-security-traffic permit intra-interface command should allow despite that I have a split tunelling on the 192.168.1.0/24 to access the site’s network between 10.100.29.0/24 and 10.100.30.0/24?
This is for ASA, Does it work for a Firepower?
01-24-2023 01:04 AM - edited 01-24-2023 01:04 AM
01-24-2023 01:53 AM - edited 01-24-2023 07:01 AM
I added the following rule, but in VPN I still don’t have access to 10.100.30.0/24.
object network VPN_DHCP
nat (outside,outside) static interface
If i had "Allow All Traffic Over Tunnel", How do I get internet ?
Edit :
Ok the Hairpin permit to have internet Access in full Tunnel, but i don't have access to my network 10.100.30.0/24 ...
Or maybe the rule must be like this :
object network VPN_DHCP
nat (outside,outside) static 10.100.30.0/24
01-24-2023 01:04 AM
To access all the data about Mypascoconnect Login , communicate with one another. Pasco Parent Portal creates a cloud platform that benefits schools, teachers, students, and administrators may all join up for this portal.
Click here for more information: Pasco Parent Portal
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide