WEBVPN (IOS) cannot access internet

[Herman Skubic]

Hello,

I am evaluating WEBVPN (SSL VPN) feature on CISCO 1921 router.

I can establish VPN connection with anyconnect and access local intranet, but I cannot access internet.

I cannot find out what happend with packets meant for internet.

Below I'm sending webvpn configuration:

GigabitEthernet0/0 is LAN interface

ip nat inside source static tcp 192.168.100.1 5443 94.140.xx.yy 5443 extendable

webvpn gateway WEBSSL-GATEWAY
 ip interface GigabitEthernet0/0 port 5443
 ssl trustpoint TP-self-signed-4050442324
 inservice
 !
webvpn context ASCAL-SSLVPN
 secondary-color #990000
 title-color black
 aaa authentication list SSL-VPN
 gateway WEBSSL-GATEWAY
 max-users 10
 !
 ssl authenticate verify all
 inservice
 !
 policy group SSLVPN_POLICY
   functions svc-enabled
   svc address-pool "vpn_pool" netmask 255.255.255.0
   svc rekey method new-tunnel
   mask-urls
 default-group-policy SSLVPN_POLICY
!

Thank you in advance.

Kind Reagrds,

Herman

[Abaji Rawool · Accepted solution]

Hi,

Make sure you have source nat list configured to allow VPN pool, if you want to use the internet from the router or you can use split tunnel to allow only Internal traffic over VPN

example:

router(config-webvpn-group)# svc split include 198.168.100.0 255.255.255.0

router(config-webvpn-group)# svc split include 192.168.200.0 255.255.255.0

Regards,

Abaji.
 

[Herman Skubic]

Hi Abaji,

Thank you for your answer.

But I want all VPN traffic to go trough router (including internet).

As I mentioned only LAN is accessible but not internet. 

Regarding VPN pool you mentioned I already use the same pool for L2TP/IPSEC vpn clients and internet for these clients works OK. Only SSL VPN has the problem accessing internet.

Do you maybe have any idea why?

Regards,

Herman

[Abaji Rawool]

Would you be able to send full config here?

Regards,

Abaji.