How to override split tunneling per user

[emravnorgeno]

Hi,

I've an ASA 5505, running at ASA 8.2(2). I'm using ASDM 6.2(5).
ASA is set up with Split Tunneling and it works perfectly.
However, for a few users, I want all traffic, including Internet traffic, routed through the ASA.
The spesific users IP address at internet should then be the same as ASA Outside address, not the client local address.
The question is therefore:
How to simple override the split tunneling at user level?
Alternatively set up an "tunnel all" group policy for the specified users?
Any adequate solution at all?

Thanks in advance,

Erik              

[Marcin Latosiewicz]

Erik,

In IPsec VPN world - use seperate tunnel-groups.

In SSLVPN you can have DAP to apply different per user settings.

M.

[emravnorgeno]

Thanks for the feedback Marcin,

I'm in the IPsec world.

I do not have much knowledge about these settings (or FW/VPN/IP in general), but I have copied the current group policy  to a test policy and changed the "Split Tunneling": "Policy" -> "Tunnel all netwok" and "Network List" -> "None". I have assigned test user to the new VPN group policy.

Result: VPN connection still works, but test user can not get out on the internet.

Sorry for being helpless,

Erik

[Marcin Latosiewicz]

Erik,

Ha I know how that feels. Rather than giving you the solution.

Give google a try "ASA VPN hairpin" or "ASA VPN on a stick" will give you good results.

TL; DR

1) Allow U-turn of traffic (same-security.... intra)

2) Apply NAT rule (for traffic from outside, going to outside) do PAT to interface of outside :-)

M.

[emravnorgeno]

Thanks again,

DRALBDNUA...DidReadALotButDidNotUnderstandAll..

Still struggling. Did find, and ticked, "Enable traffic between two or more hosts connected to the same interface."
But Dynamic NAT rules are more complicated. What's the source for inside interface? Whats Global pool?
I've attach a screenshot of what I think I'm missing. VPN pool is 192.168.50.0 - 192.168.50.99
Your help is much appreciated

Thanks,

Erik

[Marcin Latosiewicz]

Erik,

In ASA's implmentation of NAT traffic is performed AFTER decapsulation or BEFORE encapulation.

In this case, your VPN clients are typically connected through your outside interface and also your internet is based on the same interface.

Thus you will need something like:

nat (outside) 100 192.168.50.0 255.255.255.0
global (outside) 100 interface

(this is not syntax checked)

M.

[Javier Portuguez]

Dear Erik,

At this point this is what I recommend:

1- Create the specific group-policies and define the specific parameters:

     group-policy all_traffic internal

     group-policy all_traffic attributes

          split-tunnel-policy tunnelall

     !

     group-policy some_traffic internal

     group-policy some_traffic attributes

          split-tunnel-policy tunnelspecified

2-    Assign the group-policy to each user:

     username full_access attributes

          vpn-group-policy all_traffic

     !

     username some_access attributes

          vpn-group-policy some_traffic

     !

* This is in case you are using the LOCAL DB, if you were to implement an external AAA server, then the server could send the Attribute 25 (RADIUS) or the memberOf attribute (LDAP) which specifies lets the FW know which group-policy assign to each specific session (user).

HTH.

Portu.

Please rate any helpful posts

[emravnorgeno]

Hi,

I completely agree in the two different group policy thinking.

I've created a new group policy, TunnelAll. It does not allow me to connect internet at all. It does not seem to allow the "U-turn" automaticly. Or in other words what I'm looking for: Allow some VPN user (those assigned to "TunnelAll) U-turn i ASA and connect internet with the ASA outside IP address.

I did try the tip from Marcin, with limited success:

Result of the command: "nat (outside) 100 192.168.50.0 255.255.255.0"

The command has been sent to the device

Result of the command: "global (outside) 100 interface"

global for this range already exists

Still stuck, I'm afraid

Thanks,

Erik

[Javier Portuguez]

Hi Erik,

Please add the "same-security-traffic permit intra-interface".

Let me know how it goes.

Portu.

Please rate any helpful posts

[emravnorgeno]

Hi,

Sorry, already done

Result of the command: "show running-config same-security-traffic"

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

Status:

Both group policies, SplitTunnel and TunnelAll works regarding VPN.

SplitTunnel internet works, not through ASA. Perfect/OK.

TunnelAll internet does not work. Target is that this group can access internet addressed with ASA external IP (acting as users connected to the lan inside).

I'm not an expert, so the resolution can be at any level

Thanks,

Erik

[SSCH1NDLER]

Hi Erik,

how is the ipconfig from your vpn clients which use the option "tunnelall"? it is possible, that they use a fault DNS IP?

what show the logging, do you see incomming traffic or deny messages?

[emravnorgeno]

Hi,

ipconfig vpn tunnelall:
192.168.50.1 255.255.255.0
GW 0.0.0.0 (strange??)

ipconfig vpn splittunnel:
192.168.50.1 255.255.255.0
GW (blank)

Cannot see any ASA error/deny when try to access internet (running tunnelall).
DNS is same for both groups. External DNS (isp). We've a simple infra structure.

Regarding GW 0.0.0.0 if strange:

Cannot find how to set GW assigned to group policy. If possible to set, what should i be? like inside default GW (typical 192.168.1.1) or outside address? (I don't know where in ASA the U-turn is performed)

Thanks again,

Erik