Hello David99,
Adding to what William just recommended, using "tunnelall" the ASA will do the following: Remote users reach internet networks through the corporate network and do not have access to local networks. Instead with the split tunnel the user can access the local Internet with the IP address of your Local ISP, so by using tunnelall the traffic when going to another corporation that is Outside of your network will need to get back to the ASA Outside's interface(Interface where you connect) and with the U-turn (same-security permit intra-interface) the traffic will be sent out outside once again but reaching anything on internet but this time will be translated either to the outside interface of your ASA (PAT'd) or you use another IP address for it, you may find an example of U-turn in the following image:
So you configure this commands in order to get this working according to your configuration:
1. NAT (PAT translation from the AnyConnect pool to the Interface)
nat (outside) 1 10.5.2.0 255.255.255.0
2. U-turn command:
same-security permit intra-interface
3. Tunnelall option:
group-policy DefaultRAGroup_1 internal
group-policy DefaultRAGroup_1 attributes
split-tunnel-policy tunnelall
Please proceed to rate and mark as correct this post if it helped you, keep me posted!
David castro,
