AnyConnect VPN No Split-tunneling

[roliveira11]

Hello Everyone! I'm attempting to configure SSLVPN without split tunneling.

VPN network - 10.10.22.0/24 (10.10.22.5-250) is the pool. I'd like to tunnel ALL traffic, private or public, through the tunnel, allow users to access 10.10.20.0/24(Corp LAN) but also allow users to browse the internet, but through the tunnel.

I can authenticate using a local account, but I cant hit the internet or the internal private IP I'm testing with. Am I missing something glaring?!?! I feel like it's NAT
!
!
!
ASA Version 9.6(2)23
!
hostname ASA-BOS
domain-name pausinc.com
enable password 6MXow/3NzHWVSpT3 encrypted
names
ip local pool PADI_VPN 10.10.22.5-10.10.22.250 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.10.20.1 255.255.255.0
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
boot system disk0:/asa962-23-lfbff-k8.SPA
ftp mode passive
dns server-group DefaultDNS
domain-name pausinc.com
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_10.10.22.0_24
subnet 10.10.22.0 255.255.255.0
access-list outside_access_in extended permit ip object NETWORK_OBJ_10.10.22.0_24 10.10.20.0 255.255.255.0
access-list PADI_VPNACL remark Inside LAN
access-list PADI_VPNACL standard permit 10.10.20.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-791.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.10.22.0_24 NETWORK_OBJ_10.10.22.0_24 no-proxy-arp route-lookup
nat (outside,outside) source static NETWORK_OBJ_10.10.22.0_24 NETWORK_OBJ_10.10.22.0_24 destination static NETWORK_OBJ_10.10.22.0_24 NETWORK_OBJ_10.10.22.0_24 no-proxy-arp
!
object network obj_any
nat (any,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 10.10.20.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_TrustPoint0

crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
crl configure
crypto ca trustpool policy

telnet timeout 5
ssh stricthostkeycheck
ssh 10.10.20.0 255.255.255.0 inside
ssh timeout 10
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 10

dhcpd option 3 ip 10.10.20.1
!
dhcpd address 10.10.20.50-10.10.20.250 inside
dhcpd dns 208.67.222.222 208.67.220.220 interface inside
dhcpd lease 9999 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0
ssl trust-point ASDM_TrustPoint0 outside
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside vpnlb-ip
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.7.04056-webdeploy-k9.pkg 1
anyconnect enable
tunnel-group-list enable
cache
disable
error-recovery disable
group-policy GroupPolicy_PADI_VPN internal
group-policy GroupPolicy_PADI_VPN attributes
wins-server none
dns-server value 208.67.222.222 208.67.220.220
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value pausinc.com
dynamic-access-policy-record DfltAccessPolicy
username focus password 3viENWVWvCq76s/b encrypted privilege 15
tunnel-group PADI_VPN type remote-access
tunnel-group PADI_VPN general-attributes
address-pool PADI_VPN
default-group-policy GroupPolicy_PADI_VPN
tunnel-group PADI_VPN webvpn-attributes
group-alias PADI_VPN enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
:end

Thanks in advance!!!

[roliveira11]

Been playing with NAT.. still no luck... any suggestions??!! Updated config file below:

hostname ASA-BOS
enable password 6MXow/3NzHWVSpT3 encrypted
names
ip local pool PADI_VPN 10.10.22.5-10.10.22.250 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0

!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.10.20.1 255.255.255.0
!
!
boot system disk0:/asa962-23-lfbff-k8.SPA
ftp mode passive
dns server-group DefaultDNS
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_10.10.22.0_24
subnet 10.10.22.0 255.255.255.0
object network InsideLAN
subnet 10.10.20.0 255.255.255.0
access-list outside_access_in extended permit ip object NETWORK_OBJ_10.10.22.0_24 10.10.20.0 255.255.255.0
access-list PADI_VPNACL remark Inside LAN
access-list PADI_VPNACL standard permit 10.10.20.0 255.255.255.0
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.10.22.0 255.255.255.0
access-list nonat extended permit ip 10.10.22.0 255.255.255.0 10.10.20.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-791.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.10.22.0_24 NETWORK_OBJ_10.10.22.0_24 no-proxy-arp route-lookup
nat (outside,outside) source static NETWORK_OBJ_10.10.22.0_24 NETWORK_OBJ_10.10.22.0_24 destination static NETWORK_OBJ_10.10.22.0_24 NETWORK_OBJ_10.10.22.0_24 no-proxy-arp
!
object network obj_any
nat (any,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
route inside 0.0.0.0 0.0.0.0 10.10.20.53 tunneled
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 10.10.20.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_TrustPoint0
enrollment terminal
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
quit
telnet timeout 5
ssh stricthostkeycheck
ssh 10.10.20.0 255.255.255.0 inside
ssh timeout 10
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 10

dhcpd option 3 ip 10.10.20.1
!
dhcpd address 10.10.20.50-10.10.20.250 inside
dhcpd dns 208.67.222.222 208.67.220.220 interface inside
dhcpd lease 9999 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0
ssl trust-point ASDM_TrustPoint0 outside
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside vpnlb-ip
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.7.04056-webdeploy-k9.pkg 1
anyconnect enable
tunnel-group-list enable
cache
disable
error-recovery disable
group-policy GroupPolicy_PADI_VPN internal
group-policy GroupPolicy_PADI_VPN attributes
wins-server none
dns-server value 208.67.222.222 208.67.220.220
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value pausinc.com
dynamic-access-policy-record DfltAccessPolicy
username focus password 3viENWVWvCq76s/b encrypted privilege 15
tunnel-group PADI_VPN type remote-access
tunnel-group PADI_VPN general-attributes
address-pool PADI_VPN
default-group-policy GroupPolicy_PADI_VPN
tunnel-group PADI_VPN webvpn-attributes
group-alias PADI_VPN enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:1c11abd9a4beceb7bcbc4b007a2fb070
: end