AnyConnect VPN full tunnel with internet access

[Kaleem Sheikh]

I am trying to change my split tunnel (with internet access) into a full tunnel with internet hairpin so I can VPN into a remote ASA and go out to the internet through that ASA. 

The ASA I am using is a 5506-x.

I have entered the tunnelall and same-security-traffic permit intra-interface.

I think my NAT config is where the issue is.

I want my traffic to go from VPN client to remote ASA and out to Modem -- Then to Internet with internet access.

VPN client with anyconnect [outside int(xx.xxx.xxx.245)

|

[vlan int of sw(10.20.30.1) Switch [outside int of sw(200.1.1.1) ------------ [inside int of asa(200.1.1.2) ASA [outside int of asa(xx.xxx.xxx.244) --------- Modem (xx.xxx.xx.241) -------- Internet

[Josue Brenes]

Hi Kaleem,

Try with the following configuration:

ciscoasa(config)# object network obj-Anyconnect-Pool
ciscoasa(config-network-object)# subnet 192.168.10.0 255.255.255.0 (replace with real network from the anyconnect users)
ciscoasa(config-network-object)# nat (outside,outside) dynamic interface

Regards,
Josue Brenes.

[Kaleem Sheikh]

Hi Josue,

I have entered this NAT configuration, but I still don't have internet access. However, When I VPN from my outside VPN client, I am able to ssh into my ASA and use it.

[Josue Brenes]

Hi Kaleem,

What if you try with manual nat instead of object nat?

The config would be like this:

object network anyconnect_pool

 subnet X.X.X.X X.X.X.X

nat (outside,outside)  1 source dynamic anyconnect_pool interface

Note: You must have the same-security-traffic permit intra-interface command

Regards,
Josue Brenes.

[Kaleem Sheikh]

Hi Josue, 

I've tried both of these NAT configurations and they don't work for me. Is there something I have to enable for the anyconnect user itself to allow that user to get to the internet? I have the NAT down, same-security-traffic permit intra-interface, and on my group policy for my anyconnect user, I have gave it tunnelall permission.

[Josue Brenes]

Hi Kaleem,

There is nothing to enable from the anyconnect itself.

Can you share me the full config so I can take a look?

Regards,
Josue Brenes.

[Kaleem Sheikh]

There's a lot of extra stuff in there, but this is the whole config.

[Josue Brenes]

Kaleem,

What is the name of the tunnel-group you are using?

Regards,

Josue Brenes,

[Kaleem Sheikh]

cp1