ASA NAT for Remote VPN to Internet (Specific)

[rob1456657]

I'm hoping I can explain this clearly enough. I have a remote site with a site-to-site tunnel. From the Home Office and the remote site, we are allowing a split tunnel, but we need to tunnel a specific external site via the home office.

The IP Scope for this particular external entity is already defined in the Tunnel groups, so we know that traffic from the remote site headed for xyz.com is going through the tunnel. At the head office, we can see that clients from the remote site are attempting to access the site, but our NAT rule is not working correctly.

Has anyone configured such access and made it work?

The NAT rule on the head office side should be something like this:

nat (outside,outside) source dynamic REMOTE-SITE interface destination static EXTERNAL-SITE

However, this is not working. When I watch the logs on the head office ASA, I see the remote client going through, but the connection times out.

I know I am missing something simple. I hope someone can help. Thanks in advance!

[Rob Ingram]

@rob1456657 assuming the traffic is tunnelled and the NAT rule is working correctly, you would also need to configure the command same-security-traffic permit intra-interface to allow the traffic to be routed back out the same interface it came in on (outside).

[rob1456657]

@Rob Ingram - same-security settings are configured. That's what's throwing us off. We expected it to work, but instead access to the site times out.

[MHM Cisco World]

nat (outside,outside) source dynamic REMOTE-SITE interface 

No need this' you access internet abd you config destiantion with specific subnet  so not need destiantion in NAT

Note:- this also need ACL from LAN to ANY' this not recommend at all' so from my opinion use VTI' this protect your data and in same time you can push defualt route to remote and make it use HQ as point to access internet.

MHM

[rob1456657]

It seems you are allowing VPN access to the remote site via the tunnel with that NAT statement. We only need a specific site to be tunneled while all other internet access goes out the remote site's internet connection. I'll try the above and see what happens.

[MHM Cisco World]

Yes try 

And if you can draw topolgy' let me make double check it

MHM

[rob1456657]

Please ignore the indicators and certain labels. I used Cisco Packet Tracer to create the topology. This is pretty basic. Thanks.

[Aref Alsouqi]

Could you please share the output of "show nat" and "sh run route" from the HO firewall for review?

[MHM Cisco World]

check this