AnyConnect Works, But No Internet Acees!

[euwars1010]

Hi there,

i do have a ASA 5540, i have used anyconnect wizard to configure one.

i can connect to it with anyconnect client, BUT there is not any internet connection for the users,

if we say the ip of ASA is 192.168.0.120 and the ip pool for the users is 10.0.0.1 to 10.0.0.200  how can i say to route the connections to the asa ip to have internet access? should i use the nat?

Thanks

[Jouni Forss]

Hi,

It would help to see the ASA configuration. We would also need to know the software version.

But if I would have to guess then you are probably missing only a few configurations.

One addition is the command

same-security-traffic permit intra-interface

Presuming you have configured the VPN client connection as Full Tunnel (meaning while the VPN is active all traffic goes to VPN) then you will need to above command to make it possible for the connections coming from the VPN through the "outside" interface to leave to the Internet through the same interface "outside" (if that is the name of your WAN interface on the ASA)

You will also require a NAT between "outside" and "outside" that defines the VPN Pool as the source and do Dynamic PAT for that subnet to the "outside" interface of the ASA.

The above are usually the 2 things you need to do to get Internet working while the VPN is active.

Alternatively, you can configure the VPN Client as Split Tunnel only which will mean that traffic to your LAN(s) behind ASA will go through the VPN but all Internet bound traffic will use the users current Internet connection.

- Jouni

[euwars1010]

it is  ASA 8.42

and i did not get the part outside to outside!

        and please check your private messages!

[Ivaylo Georgiev]

You need to configure the connection as a split-tunnel vpn profile.

The VPN wizard gives you that option.

If you are not comfortable with the CLI, the the easiest way to do it would be to just re-create the VPN profile.

Make sure you exempt the networks that you want to be able to reach through the VPN.

[Jouni Forss]

Hi,

We would have to see some configurations to determine what configurations are needed to enable Internet connectivity while connected with VPN.

As I mentioned earlier, we can either configure Split Tunnel so that Internet traffic will flow freely during VPN Client connection.

Or we can configure NAT on the ASA itself when using Full Tunnel to enable Internet traffic to head out through ASA.

But as I said, would need to see the configurations to be able to help if you are not able to configure this yourself.

- Jouni