No Internet Access for Full Tunnel

[dianewalker]

We have an ASA 5550, ver. 8.0(5) and using IPSEC clients to Remote Access into the Main Office.  The Remote Access is working great with Split Tunnel.  We can access network resources and get on the internet with Split Tunnel.  However, we can only access the network resources, but no internet access for full tunnel.  Do you have any suggestions?

Thanks.

Diane

[Lei Tian]

Hi Diane,

Is that EZVPN? If the source is private IP, it will not access internet. It has to be somehow natted at the main office before get in internet.

HTH,

Lei Tian

[dianewalker]

Thanks for your prompt response, Lei.

It is not EZVPN.  I have natted statements:

global (Outside) 1 interface

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 1 0.0.0.0 0.0.0.0

access-list Inside_nat0_outbound extended permit ip any 10.100.24.0 255.255.248.0

Do you see anything wrong with the nat statements?  I am missing something.

Thanks.

Diane

[JORGE RODRIGUEZ · Accepted solution]

Diane,

You need to nat  your RA VPN pool network  using  your global interface nat ID 1.

For full tunnel  add two more statements

same-security-traffic permit intra-interface

nat (outside) 1  

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Regards

[dianewalker]

Hi Jorge,

Thanks very much for the info.  I still cannot access the internet after adding those two statements.  Do you have any other suggestions?

Thanks.

Diane

[JORGE RODRIGUEZ]

Can  you post  sanitized asa config .

[dianewalker]

Thanks Jorge for your prompt response.  Attached is the config file.  The SWS and Marketing groups can access the internal resources and internet.  However, the Techsupport group can only access the internal resources and no internet access.  The Techsupport group is setup as full tunnel.

Please let me know if you have any questions or need additional information.

Thanks very much for taking time to help me out.

Diane

[dianewalker]

Jorge,

Do you have any suggestions on how to debug why the full tunnel does not work?

Thanks.

Diane

[nomair_83 · Accepted solution]

Hi,

Can u plz tell me that why your techsupport group policy doesnt have dns configured?

Since u are using full tunnel that u wont be access your home internet once connected so you have to have dns configured under group policy to use company internet.

HTH

[dianewalker]

Thanks for taking time to respond.  I did not know that I need to put in the DNS for the group Techsupport.  Anyway, I put in the company DNS and still Techsupport cannot get to the internet.  Do you have any other suggestions?  Is there a way to debug why full tunnel can't get to the internet?

Thanks.

Diane

[nomair_83 · Accepted solution]

ok try adding the following(without removing dns)

sysopt connection permit-vpn

nat(outside) 1 (vpn pool)

then enable loggong on asa i.e. logging buffered debugging and loggin enable.

Then reconnect the client and try ping google.com or by google IP then tracert www.google.com and and paste the log output here.

by using show logging you should get any specific logs related to techsupport.

[nomair_83]

sorry I forgot one more command to configure which  is sysopt connection permit-vpn

[dianewalker]

Thanks for your prompt response.  What is the statement "sysopt connection permit-vpn"?  Do I remove it when I finish debugging?

Can you nat inside and outside?  I kept the DNS and added the NAT statement per your recommendation.  So, I have

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 1 0.0.0.0 0.0.0.0

nat (Outside) 1 192.168.10.0 255.255.255.0

Let me know if these are NOT correct.

Info:

My computer IP address 10.10.10.227

VPN pool 192.168.10.0 255.255.255.0

Subnet from the Management computer 172.16.163.0

Google IP address 66.102.7.147

I was not able to ping www.google.com or tracert to www.google.com. So, I did a tracert to Google's IP address 66.102.7.147.   Attached is the log file.

Thanks.

Diane

[Herbert Baerten · Accepted solution]

You have this in your config:

route Inside 0.0.0.0 0.0.0.0 172.16.3.102 tunneled

This is causing all traffic from the vpnclients to be routed to the internal gateway (which will probably send it back to the ASA, but then you're going to have asymmetric traffic etc. so this is never going to work).

Do you really need this? If not: remove it, otherwise replace it with something like

route Inside 172.16.0.0 255.240.0.0 172.16.3.102 tunneled

hth

Herbert

[dianewalker]

Thanks for your response, Herbert.  Can you explain to me what is asymmetrical traffic?  I am not sure if I needed that route statement "route Inside 0.0.0.0 0.0.0.0 172.16.3.102 tunneled".  By remove that route statement, it makes no difference.  I still could not get on the internet.  Do you have any other suggestions?

Thanks.

Diane