ASA VPN Hairpinning

[Mokhalil82]

Hi

We have our guest wifi whos layer 3 SVI is on our ASA so that we can ensure it is not allowed to any inside networks. Now some long term guests need access to certain internal servers and already have anyconnect access from the outside. So now as they are working on our premesis, they will be connected to the guest WIFI and try anyconnect to access the internal servers.

What do we need to do to as the Anyconnect VPN terminates on the ouside infterface, so Anconnect traffic for these guests will hit the firewall on the Guest WIFI Interface, then go out of the outside interface and return back on the same interface for VPN. 

We have already "same-security-traffic permit intra-interface" enabled

Thanks

[Kias]

Hi,

Good Morning

Woud it be possible to create  a different SSID for long term guest and have a separate IP pool for those group. We can control the resources with ACL either at Mobility Express, WLC, Wifi or ASA.

Hair pining will work from outside->outside, and not required for outside->inside.

Regards,

Kias

[Marvin Rhoads]

Why not just enable SSL VPN on the Guest Wi-fi interface (in addiiton to the current outside interface)? I have done that for some customers and it works perfectly.

[Mokhalil82]

Yes that seems to work apart from one thing. On the Guest WIFI I can access the internet, once I connect to anyconnect VPN now that I enabled it on the Guest interface, then I am unable to get internet connectivity. 

But if I connect to anyconnect from my inside network, I can get internet connectivity.

Any Ideas?

[Kias]

Is split tunneling enabled on the WIFI pool?

[Marvin Rhoads]

If there's no split tunneling then external users had required something like a "nat (outside,outside) dynamic interface" rule.

For yor guest wireless users a similar rule will be required. Something along the lines of "nat (guest,outside)..."