Remote VPN

[fmugambi]

Hello Team,

Once connected to LAN, i have subnet=172.16.X.10. once i connect to remote vpn i get a 172.16.y.150 to access resources in data centre.

Question is why once connected to vpn I can no longer reach resources in 172.16.x.0/24 yet split tunnelling is configured?

Am using cisco FTD for the VPN.

Kindly assist.

[MHM Cisco World]

Simple solution dont use same super net for both vpn pool and LAN

And also make sure of you have router and l3SW connect to ftd' make sure these device have route toward ftd for vpn pool.

This can happened if you use igp between ftd abd other device and igp summary the prefix 

MHM

[fmugambi]

if the vpn pool changes to 172.30.x.x , does this solve my problem?

[MHM Cisco World]

no you need to change to 192.x.x.x 
MHM

[Aref Alsouqi]

As long as the subnet 172.16.y.x is also a /24 subnet, then I don't believe you would need to change any IP as those are two separate subnets and they won't overlap with each other in any way.

[Aref Alsouqi · Accepted solution]

If split tunneling is configured and applied to the VPN connection profile you are using, and there is no VPN filter ACL applied then it should work. While you are connected to the VPN, please open up AnyConnect or Secure Client and then go to the cog icon at the bottom left, and then go to AnyConnect VPN tab on the left, and finally go to "Route Details" tab on the right. From there check the presented routes, you should see the protected and unprotected subnets in there. the 172.16.x.0/24 should show as unprotected. If you see 0.0.0.0/0 it means you are tunneling all traffic over the VPN. Also, you might find this link useful:

FMC AnyConnect SSL VPN | Blue Network Security (bluenetsec.com)

[MHM Cisco World]

so what was issue here ?
MHM

[fmugambi]

the overlapping of the subnets.

Had to make sure LAN subnet / supernet is not among the encrypted traffic routed on the tunnel.

[MHM Cisco World]

So in end you change supernet?

MHM

[fmugambi]

Yes