06-27-2011 07:20 AM - edited 02-21-2020 05:25 PM
I have set up a remote access ipsec vpn on an asa 5520. I can connect, and ping internal ip addresses, however I cannot ping back out to the internet, and dns resolution does not work. Any suggestions on where to start troubleshooting?
06-27-2011 09:12 AM
Hello,
Sanitized config will be helpful in resolving this. Also, make sure if you are using corporate Internet for browsing as well (ie not allowing split tunnel) make sure the ACLs are correct.
hth
MS
06-27-2011 09:24 AM
a
06-27-2011 11:51 AM
Hi Steve,
What you're attempting to do here is called Hairpinning or a 'U turn' with the traffic.
The following cisco document describes what you're attempting to do.
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_params.html#wp1042114
In short you'll need to add the following to your configuration
// Permit hairpinning
same-security-traffic permit intra-interface
// Nat VPN traffic to outside interface
object network vpn
nat (outside,outside) interface
// Add the following so traffic from one vpn client to another is not natted.
nat (outside,outside) source static vpn vpn destination static vpn vpn
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide