Anyconnect access to L2L tunnel on separate interface

[GJRBaker]

Hi

I have a Lan to Lan tunnel on one interface connected to a hosted environment, and all my VPN users come in via a different interface. Both interfaces external facing, both security 0.

My problem is this: Users on my LAN can access the hosted environment fine through the Lan to Lan tunnel however my Anyconnect VPN users can't. I've seen other topics mention VPN hairpinning and my config is setup to allow this however I don't believe this is my issue as both interfaces are separate.

I think it may be something to do with routing or VPN flow as if i use the packet tracer tool and pick one of my Anyconnect IP addresses that isn't in use it suggests that the packet is allowed, however if i pick an Anyconnect IP address in use (my own for example) then it claims the packet is dropped.

[Rob Ingram]

Hi,
What security level are both those interfaces?
Do you have NAT exempt rules for traffic between the RAVPN and the Remote sites?
If you could provide your configuration, that might help us determine where the issue lies.

HTH

[GJRBaker]

Hi

Thanks for responding - both interfaces security 0.

The nat is more complex as for the Lan to Lan tunnel we're having to do static Nat for server resources on our side due to overlapping network address space within the hosted environment.

For users on our side (including VPN client users) we have a PAT rule setup to a single IP address within the agreed Nat subnet. This works fine for users on the LAN but not for Anyconnect VPN users

[Rob Ingram]

Is that PAT rule being hit? Check the counters
Could there be another rule above it that is unintentially being matched?
I assume that PAT address is defined in the ACL for interesting traffic for the L2L VPN?

[GJRBaker]

Hi

The PAT rule works for other networks (LAN based) but not the Cisco Anyconnect trafffic so i'm sure it's something to do with that. I've tried moving it to the top of the list but no joy.

The PAT addresses are included in the ACL for the L2L VPN.

If you do a packet tracer it shows the packet getting through as long as the IP Address isn't allocated to an Anyconnect user. If the IP address is in use it fails. I wondered if it was something to do with the automatic route advertisement for Anyconnect IP addresses but not sure how this works.

[GJRBaker · Accepted solution]

Finally sorted this one.

It turned out to be a missing PAT statement for traffic originating from the OUTSIDE interface, I.E. Anyconnect users.

For some reason i had it in my head that they would originate from the INSIDE once they connect to the VPN. It was the Packet tracer that suddenly made the lightbulb go on for me.