cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
380
Views
10
Helpful
4
Replies
Highlighted
Beginner

Cisco ASA SSL VPN users (Anyconnect) communication with each other

Dear All,

 

I had a query regarding Cisco ASA SSL VPN setup.

 

Requirement: i was wondering if i could enable SSL vpn users to communication with each other, by default it is not enabled.

 

Existing Setup: Cisco ASA 9.0+ version with SSL VPN setup.

 

Appreciate any pointers and suggestion to achieve the same.

 

Thanks

 

4 REPLIES 4
Highlighted
VIP Advisor

Hi,

You will need the command "same-security-traffic permit intra-interface" in order to route traffic in/out the same interface. You will also need a NAT Exemption rule, to ensure the traffic is not unintentially NATTED. Example:-

 

object network RAVPN
subnet 192.168.10.0 255.255.255.0

nat (OUTSIDE,OUTSIDE) source static RAVPN RAVPN destination static RAVPN RAVPN no-proxy-arp

Amend the object RAVPN to represent your VPN IP Pool.

 

HTH

Highlighted

I confirm I setup a customer similar to what @Rob Ingram recommended just last month and it worked fine.

However we don't recommend in universally since it may unnecessarily expose remote users to one another's vulnerabilities. We ended up allowing it only for IT admins while filtering it out for normal users.

Highlighted

Thanks for the suggestions.

 

I tried the following commands and still SSL VPN users are not able to ping each other.

 

Conf t

same-security-traffic permit intra-interface

nat (OUTSIDE,OUTSIDE) source static VPN-USER VPN-USER destination static VPN-USER VPN-USER no-proxy-arp

 

Any suggestions on troubleshooting or things i should be looking for.

Highlighted

Hi Kumar,

 

You can simply add the following command in global configuration:

 

same-security-traffic permit intra-interface

 

let me know if the answer was helpful

Content for Community-Ad