I am setting up Anyconnect (3.1.14018) )Premium SSL licenses for users with Win10, Win7 with code 9.1.7.16 on 5510s and 5520s
I know I will be asked to allow split-tunneling for some users as always. I can do this but I don't trust a lot of them to manage their PCs properly. So I was thinking of tunneling everything to the corporate network and then have our main Checkpoint firewall control these users access to the Internet just like all our internal users.
Here is the issue....all my VPN ASAs (remote VPN users and branch to branch) use OSPF to learn all the internal subnets but have their own default gateways to the Internet which has a higher priority than that supplied by the corporate network. In the past I have used a single small subnet to connect to the ASA with IP pools internally provided by the ASA which then route over this subnet. This posses an issue if I want these IP pools to use the core internal router to route them to the Internet since they would naturally hit the routing table in the VPN ASA and it would try to push then back out its own outside interface to reach the Internet.
So what are some the solutions to this issue? I can use any method of providing IPs to the VPN clients and do not have to use IP pools provided by the ASA. So far the only real solution I can think of is to place the inside ASA on a trunk interface and then use this same trunk to provide a vlan for the VPN users with the core as their default router. The ASA is directly attached to our core 6509s.
Any other solutions available ....like one that does not involve using a trunked interface? We have proxy services on the Checkpoint firewall but I don't know if I really what to go that route even though it would probably simplify everything.
