Cisco ASA 5500 with 9.x Hairpinning (U-turn) with AnyConnect issue

[davidoates]

This may have been answered, but I have not been able to find anything searching the forums.  I would like to setup the following scenario, but have not been able to figure this out. We have a shared wireless network of some corporate laptops and non-corporate laptops, so I do not have a way of separating which is which and I do not want to allow the untrusted computers access to the corporate LAN by using the "same-security-traffic" configuration. I would like to be able to allow the corporate users to use their AnyConnect VPN client to connect to the outside of the firewall. Is this possible? I haven't had any luck as of yet. Any help is greatly appreciated.

[Marvin Rhoads · Accepted solution]

No you can't do it that way.

You could make the inside connection of the ASA a trunk with separate subinterfaces for the untrusted and trusted networks. That's pretty easy and straightforward and does not require any VPN usage.

The more modern approach (if your internal network devices support it) would be to use Trustsec Security Group Tags (SGTs).

[davidoates]

Thanks for info Marvin, I'll look into those options.