unable to configure both AnyConnect & IPSEC site-to-site VPN

[d.grellinger]

I have established a IPSEC site-to-site VPN connection

When I configure AnyConnect (and get it working), I lose the site-to-site tunnel, and vice-versa.

I believe my NAT syatements are incorrect.

Here is the NAT config when AnyConnect is working properly ...

global (Outside) 101 interface
nat (Inside) 0 access-list sslnonat
nat (Inside) 101 0.0.0.0 0.0.0.0

access-list sslnonat extended permit ip 192.168.65.0 255.255.255.0 192.168.66.0 255.255.255.0

Here is the NAT config when the IPSEC site-to-site tunnel is working properly ...

global (Outside) 101 interface
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 101 0.0.0.0 0.0.0.0

access-list Inside_nat0_outbound extended permit ip 192.168.65.0 255.255.255.0 object-group ServerGroup

How to I get the AnyConnect and the IPSEC Site-to-site to both be working properly? I don't need to reach on from the other.

Inside network 192.168.65.0/24

AnyCOnnect address pool 192.168.66.0/24

Any help would be much appreciated.

[Federico Coto Fajardo · Accepted solution]

Hi,

Try this:

global (Outside) 101 interface
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 101 0.0.0.0 0.0.0.0

access-list Inside_nat0_outbound extended permit ip 192.168.65.0 255.255.255.0 object-group ServerGroup
access-list Inside_nat0_outbound extended permit ip 192.168.65.0 255.255.255.0 192.168.66.0 255.255.255.0

The problem is that when you apply the IPsec NAT configuration, you remove the entry for the AnyConnect pool.
Try the above and let's see if it works.

Federico.

[d.grellinger]

Yes, that was it. Both VPNs are now working concerrently. Than

k you so much for your quick and helpful response.

[Federico Coto Fajardo]

Glad I could help :-)

Federico.