Cisco Firepower FTD 6.5.0 with AnyConnect RA VPN

[doukkalli]

Hi,

I setup a RA VPN using Cisco Firepower 2130 FTD 6.5.0 and AnyConnect client without split tunnels.

I setup a NAT Rule and an access control policy to allow traffics.

 When I connect to VPN Gateway I can access to internal LAN (RFC 1918) but I cannot access to Internet from my PC without using our internal proxy.

What is the best practice ot use in IPv4 Split Tunneling the option: Allow all traffic over tunnel ?

Is there any specific NAT rule to configure ?

Thanks for your help.

[Rob Ingram]

Hi,

You would need a specific NAT rule for the RAVPN traffic sourced from outside interface destined to the outside interface if you wish to route internet traffic through the RAVPN. E.g:-

object network RAVPN_USERS
 subnet 192.168.10.0 255.255.255.0
 nat (outside,outside) dynamic interface

More customers seem to be configuring split-tunnelling recently in order to save bandwidth at the main site. If your client computers are running endpoint protection such as AMP4E and/or Umbrella Roaming Client then this should provide you with the extra level of security, if you decide to split tunnel.

HTH

[doukkalli]

Thanks a lot now it working for me.