ASA 5520 ipsec vpn dns and internet access not working

[warriorforGod]

I have set up a remote access ipsec vpn on an asa 5520.  I can connect, and ping internal ip addresses, however I cannot ping back out to the internet, and dns resolution does not work.  Any suggestions on where to start troubleshooting?

[mvsheik123]

Hello,

Sanitized config will be helpful in resolving this. Also, make sure if you are using corporate Internet for browsing as well (ie not allowing split tunnel) make sure the ACLs are correct.

hth

MS

[warriorforGod]

a

[c_wombles]

Hi Steve,

What you're attempting to do here is called Hairpinning or a 'U turn' with the traffic.

The following cisco document describes what you're attempting to do.

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_params.html#wp1042114

In short you'll need to add the following to your configuration

// Permit hairpinning

same-security-traffic permit intra-interface

// Nat VPN traffic to outside interface

object network vpn

nat (outside,outside) interface

// Add the following so traffic from one vpn client to another is not natted.

nat (outside,outside) source static vpn vpn destination static vpn vpn