cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
617
Views
0
Helpful
2
Replies
smhussain
Beginner

NAC Appliance with ASA (For remote VPN users)

I have a cisco 5520 firewall pair that is being used as a VPN gateway (for remote VPN users) and as Internet Edge firewall (to provide outbound internet connectivity).

We are enabling NAC for remote VPN users. I will be deploying it inband with layer 3 enabled.

The problem in this design is that how do we ensure that outbound internet traffic does not go through the CAS?

I have heard of couple of optioins:

- PBR ( to route only IP subnet of remote VPN users to go through CAS)

- Version 8.x feature of ASA ( Restrcit access to VLAN under group-policy).

I am planning to do it using ASA firewall where I can define a new subinterface on the ASA (with a new VLAN tag) and under group-policy for remote VPN users I select the option for "restrict access to the new VLAN".

My question is: does this still work (even if the firewall have a route for the internal network using the "inside" interface and NOT the new NAC interface). If this doesnt work, please let me know what are the other options for this type of deployment.

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
Faisal Sehbai
Rising star

Hello,

This should work. Please review the attached PDF for more clarity on this topic: https://supportforums.cisco.com/docs/DOC-9102

HTH,

Faisal

View solution in original post

2 REPLIES 2
Faisal Sehbai
Rising star

Hello,

This should work. Please review the attached PDF for more clarity on this topic: https://supportforums.cisco.com/docs/DOC-9102

HTH,

Faisal

View solution in original post

This is exactly what I was looking for.

Thank you for the response.

Regards,

Syed

Content for Community-Ad