AnyConnect using Windows DHCP server, but can't access LAN PC's?

[abrrymnvette]

I've got my AnyConnect setup to get an IP from our Windows DHCP server just fine. It grabs the IP, mask, and DNS just fine. But I can't ping any of the lan devices or do any DNS lookups. I need it to work this way since we have a ton of site-to-site's with remote offices and getting them all to adjust their firewalls to allow another subnet is a nightmare.

I have split-tunneling enabled. I'm sure it's a nonat command that I'm missing, but not sure what.

Before connecting to VPN:

Home user-------------------> ASA 5510 --------------> Office Lan

192.168.1.0/24                                                  10.10.1.1/24

After they connect to AnyConnect

Home user-------------------> ASA 5510 --------------> Office Lan

192.168.1.0/24                                                  10.10.1.1/24

10.10.1.45/24    

[Harish Balakrishnan]

Hello

is your VPN pool a part of your lan network ?

regards

Harish.

[Bill Rellergert]

Yes. The office lan is 10.10.1.0/24

[Javier Portuguez]

Hi Andy,

We do not recommend to have the  VPN pool in the same LAN network, but it should work though.

Do you have a NAT exempt to allow the VPN traffic from outside to inside and avoid the NAT translation from inside to outside?

Can you ping the inside interface of the ASA (make sure you have the "management-access" command in place)?

Thanks.

Portu.

Please rate any helpful posts.

[abrrymnvette]

I can ping the inside interface of the firewall and get responses. I can PM you the config if you'd like. I don't want to post it on an open forum.

[Harish Balakrishnan]

Hello Andy,

can you post the config

Harish

[abrrymnvette]

Actually, I can't post the config. I can probably post a portion of it.

[Javier Portuguez]

Hi,

I can see you opened a TAC case for this same problem.

Do you want to keep working on this one?

Thanks.

[abrrymnvette]

I'll leave it open for now until it gets resolved with the TAC case. Once it gets fixed, I'll post the resolution in case others need it if they have the problem in the future.

[Javier Portuguez]

Sounds good.

Its a shame I did not see it before, otherwise I would take ownership

Keep us posted.

Portu.

[abrrymnvette]

All I was missing was the command to not nat the traffic. Just needed to add

access-list nonat extended permit ip 10.10.1.0 255.255.255.0 10.10.1.0 255.255.255.0

[Javier Portuguez]

Great!

Please close this post.

Thanks for sharing your findings.

Have a nice day.