After setting up Anyconnect using the wizard client cannot connect to Internet

[patmcandrew1]

Hello,

I have a small ASA-5520 w/8.4 setup. Outside goes to Internet, inside is 172.17.0.0/16 network, and management is 172.17.2.0/24. The VPN IP pool is 172.17.8.0/24.

After I setup webvpn with the wizard I was able to VPN in fine, ping other IP's of switches and routers (the ASA is running EIGRP and distributing it's static route to the internet to it's neighbors). I setup nat to allow Internet access from inside to outside, using outside's interface as the translated source.

After I VPN in, I get assigned a correct address from my VPN pool (172.17.8.21 for example). I can't ping or connect out to the internet however. The logs reveal nothing, I don't see any rejected packets. I can't reach the management network either. The management network is a switch that has all of the management ports of various switches, load balancers, etc on it, but I can't access it.

I'm wondering what type of NAT setup I have to do here, and how come I'm being denied access to the Internet and management interface, but nothing is showing up in the logs despite having debugging setup and opening the firewall up completely alowing all traffic.

The security level is 90 for inside, 0 for outside, and 100 management. The option to allow equal security level interfaces to pass traffic is selected. I had inside and management at 100 before and it didn't work wtih VPN.

Please help, I don't have my ASA config handy ATM but I will have it hand in a few hours.

Just wondering if anyone has any recommendations about how to use NAT so I can get the access I need.

Thanks in advance

[Marcin Latosiewicz · Accepted solution]

Patrick,

Don't have access to an ASA myself so commands below are not proofed.

But I guess if you're missing NAT config this would be the document describing it:

https://supportforums.cisco.com/docs/DOC-11640

For access to management, well show use some logs 🙂

show xlate det | i IP_ADD (for source IP and destination IP)

show logg | i IP_ADD (make sire logging is enabled to buffer on informational level and do it for source and destination)

Marcin

[patmcandrew1]

Thanks for your reply. I have figured it out. The new ASA 8.3/8.4 NAT really confused me, since I'm used to the old "PIX style" NAT.

nat (inside,outside) source static BOS-172-17-0-0 BOS-172-17-0-0 destination static remote_vpn_pool remote_vpn_pool

!

object network NAT_inside_to_outside

nat (inside,outside) dynamic interface

object network vpn_nat_172-17-8

nat (outside,outside) dynamic interface

object network vpn_nat_172-17-8 gives vpn users internet

and the first global nat command performs exemption to the localnet.

Starting to wrap my brain around this new NAT implementation!