Traffic from Clientless SSL to L2L Tunnel

[timothy_stoffers]

We currently have a pair of ASA set up running as our Client VPN (Clientless, SSL, and IPSec) and our L2L concentrator. We are running into an issue where Clientless users are trying to access servers that are on the other side of one of the L2L tunnels. Users who are using a client have no issues (believe this because they are getting a internal IP address), but Clientless users can’t connect. What would the source IP be for the Clientless user? When I looked in the logs it seems to be using the ASA’s outside interface, but that doesn't make much sense to me.

Thanks.

[Loren Kolnes · Accepted solution]

Hi Tim,

Since the ASA will proxy the clientless connection to the remote server it will route the packet sourcing from the appropriate interface. In this case the remote server is available via the outside interface. You would need to include the outside interface address in the crypto access-list used for the LAN to LAN VPN, this would need to be configured on both sides of the LAN to LAN tunnel.

Clientless ASA

access-list vpn permit ip interface outside remote-network

Remote L2L ASA

access-list vpn permit ip remote-network host outside-ip-address-clientless-asa

Let me know if you have any questions.

Thanks,

Loren

[timothy_stoffers]

Loren,

Ok, but would there be any issues with the other side of the tunnel getting confused with the having to send traffic through the tunnel to the same IP that it is peering with?  Thanks.

Tim

[Loren Kolnes]

Hi Tim,

There should be no problem as the encrypted traffic would be from the internal host/subnet to the public IP, the IPSec tunnel is built between the public ip addresses.

Thanks,

Loren

[timothy_stoffers]

It works.  Just had a small issue with NATing on the remote side, but other than that it works. Thanks.