ssl vpn problem

[alexbak79]

Hi there!

i cannot access local resources when i successfully connect via ssl webvpn  to remote network. That is because i have the same local network address as the  remote local network has. For example:

             Local                                                     Remote

192.168.1.0 255.255.255.0 ----internet---- 192.168.1.0 255.255.255.0

i tried to exclude local lan and it didn't work. in fact it made it worse as i couldn't access nothing locally and remotely. Is there something we can't do without changing network address?

The problem i'm experiencing is on a c887 ios router.

[Jeff Van Houten]

No, the anyconnect client works by installing a virtual interface on the remote pc. The VPN address pool should be defined as something other than 192.168.x.y. If you do so and set routing on your main network to point to the Asa for the address pool, you should be fine.

Sent from Cisco Technical Support iPad App

[alexbak79]

Hi jeff

First of all the problem i have is both on PC (webvpn client) and iphone (anyconnect client). Problem is mainly with protected subnets.

Here's the partial configuration i created with help of CCP:

aaa new-model

aaa authentication login default local

aaa authorization exec default local

aaa authorization network default local

!

!

ip local pool VCL 192.168.10.1

!

!

!

interface Virtual-Template2

exit

default interface Virtual-Template2

!

!

!

webvpn gateway WVG

ip interface Dialer0 port 443

ssl trustpoint TP-self-signed-4073506489

inservice

!

webvpn install svc flash:/webvpn/sslclient-win-1.1.4.176.pkg sequence 1

!

webvpn context VSL

secondary-color white

title-color #FF9900

text-color black

ssl authenticate verify all

!

!

policy group POL

   functions svc-enabled

   svc address-pool VCL

   svc split include 192.168.1.0 255.255.255.240

   svc split include 192.168.2.0 255.255.255.240

virtual-template 2

default-group-policy POL

aaa authentication list default

gateway WVG

inservice

!

end

=====================

As you can see (and something i forgot to mention) ip local pool assigns different network address to clients. The problem is when my pc or iphone access a guest network that has network address same as defined on protected subnets of remote network, i cannot access local resourses on guest network. Guest local network has 192.168.1.0 for example. I connect successfully to ssl vpn.. i can access remote network that has 192.168.1.0 protected subnet but i can't access other hosts (printers,pcs) on local guest network. If i remove 192.168.1.0 from protected subnets i can access local resourses on guest network but not the remote network

Thanx in advance for your help