Anyconnect question

[benolyndav]

Hi

If I am setting up anyconnect I'm assuming that I will need an interface on our Fireweall that is directly connected to the Lan, I am wanting to use a subnet where the GW is on our distribution switch but our firewall as multiple sub-interfaces but none of them are part of the inside lan networks .??

thanks

[Rob Ingram]

@benolyndav Not sure I fully understand. The ASA doesn't need an interface directly connected to the LAN, you can have a dedicated /29 or /30 network for the ASAs inside interface, just define routes for the inside networks. As far as the AnyConnect VPN pool IP addressing, you just need to ensure the internal LAN has a route via the ASA to communicate with the RAVPN users.

[benolyndav]

Hi Rob

ok thanks for that, we do actually have an interface that as routes to all the iside networks so I could use ip pools for the anycinnect clients and allow them to any using this interface so they would get access to coporate services, I would also need a route pointing to the firewall for the anyconnect ip pool, ? it gets s bit confusing when thinking about default gateway.??

Thanks

[Rob Ingram]

@benolyndav Well you would need a route on the core switch pointing to the ASA for the AnyConnect VPN IP pool if the default route on the core is not the RAVPN ASA, in which case you'd not need specific static routes - the default route would suffice. In some instances customers have a dedicated RAVPN concentrator and internet traffic goes out another firewall, in this instance specific routes for the VPN IP pool via the RAVPN concentrator would be required.

As far as the clients are concerned they will route all traffic from the ASA to the inside network, the clients rely on the ASA's routing table to route the traffic accordingly.

[benolyndav]

Hi Rob

Yes understood and would need a static route from Core to ASA AnyConnect IP pool as default route on core points across a private wan for coporate staff Internet access, so may have another problem here too as the ASA as a default route of its own pointing to its Outside network to provide Internet access for guest Networks.

Thanks

[Rob Ingram · Accepted solution]

Hi @benolyndav what is your other problem exactly? Do you not want the anyconnect users to use the ASA as the default route for internet traffic? Options could be split tunnel the traffic and only tunnel traffic via the VPN destined to the corporate network or you can route all anyconnect user traffic to the core using a "tunneled default route".

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112182-ssl-tdg-config-example-00.html

[MHM Cisco World]

follow