ASA Anyconnect with PBR

[Regis Alberto Reis]

Hello,

We have a customer which has upgraded its ASA to version 9.5.1 and now would like to use PBR for users connected by Anyconnect.
Today, ASA is configured with a ACL Filter which only local networks are permitted on Tunnel.
We tried to use the PBR in order to set all traffic through Tunnel and next-hop another device on LAN side.

Anyconnect Network: 172.18.18.0/24
Lan Network: 172.18.16.0/24
Default gateway to be used for anyconnect clients: 172.18.16.202

It was created a standard ACL for match traffic as 172.18.18.0, a route-map which next-hop is 172.18.16.202 and applied to outside interface.

Gateway 172.18.16.202 knows that net 172.18.18.0/24 is on ASA (static route)

Is my understanding right? I have configured as mentioned above, but didn't work.

Regards,

Regis

[rvarelac · Accepted solution]

Hi Regis , 

If you want to send all the Anyconnect traffic to an specific host on the LAN site (next-hop) you can use the "route tunneled"  feature instead of the PBR.

Check more information below:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112182-ssl-tdg-config-example-00.html

Hope it helps

-Randy-

[Florin Barhala]

Interesting workaround, nice!

[Regis Alberto Reis]

Tks Randy.

It worked as expected.

[Florin Barhala]

Hello gentlemen,

I have an Active-Standby 5515 cluster used by several SSL tunnel-groups. All is fine until I need to add several small ASAs using EasyVPN.

I would like to send traffic from Easy Connect ONLY use inside default route, but NOT affect/catch any other RemoteVPN access traffic which uses outside default route and NAT.

So can I do this with a custom tunnel-group or group-policy option or should I employ PBR?

Thanks in advance!