Issues with basic VPN setup and split tunneling

I have created an SSL VPN to a CISCO ASA 8.6 running ASDM 6.6.
Im able to connect to the VPN and reach all the devices with the LAN but Im not able to browse the web. When I enable the split tunnel Im able to browse the web but then Im not able to reach any internal device.
Here is part of the show run:
object network RedInterna
subnet 150.211.101.0 255.255.255.0
description Red Interna
object network NETWORK_OBJ_10.4.1.0_28
subnet 10.4.1.0 255.255.255.240
access-list inside_access_in extended permit ip object RedInterna any
access-list VPN_INTERNET standard permit 150.211.101.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
ip local pool VPN_POOL 10.4.1.1-10.4.1.14 mask 255.255.255.240
failover
failover lan unit secondary
failover lan interface fail-1 GigabitEthernet0/2
failover key *****
failover interface ip fail-1 10.3.1.21 255.255.255.252 standby 10.3.1.22
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-66114.bin
asdm history enable
arp timeout 14400
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.4.1.0_28 NETWORK_OBJ_10.4.1.0_28 no-proxy-arp route-lookup
nat (inside,outside) after-auto source dynamic any interface
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 187.217.68.145 1
route inside 10.0.0.0 255.0.0.0 10.1.1.78 1
route inside 150.211.0.0 255.255.0.0 10.1.1.78 1
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-3.1.00495-k9.pkg 1
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_VPN_ internal
group-policy GroupPolicy_VPN_ attributes
wins-server none
dns-server value 8.8.8.8
vpn-tunnel-protocol ssl-client
default-domain value dominio.com.mx
tunnel-group VPN_ type remote-access
tunnel-group VPN_ general-attributes
address-pool VPN_POOL
default-group-policy GroupPolicy_VPN_
tunnel-group VPN_ webvpn-attributes
group-alias VPN_ enable
I´m not sure if Im missing some small details or setup. Any help will be highly appreciated.
Thanks!!!

Hi,
When you are using Full Tunnel VPN (which is the default setting) you will have a couple of things that you need to configure on the ASA.
First, the ASA by default won't allow traffic to enter through an interface and then leave through that same interface. This is what essentially happens when the traffic from the VPN Client comes to the ASA and then heads out to the Internet. In your case the traffic comes through the "outside" and leaves through the "outside" interface.
You will need this command
same-security-traffic permit intra-interface
You can check if its enabled at the moment with the command
show run same-security-traffic
Second, the VPN users will need to have NAT configuration just like any LAN users behind the actual ASA. So you will essentially have to configure Dynamic PAT for traffic from "outside" to "outside"
You can accomplish that with the following configuration
object network VPN-PAT
subnet 10.4.1.0 255.255.255.240
nat (outside,outside) dynamic interface
I would imagine that this should do it for you to be able to connect to the Internet and to the LAN network when the VPN is active.
Hope this helps
Let me know how it goes.
- Jouni

Similar Messages

SonicWall Global VPN Client and Split tunneling

Hello All,
I searched Google and the forums here and can't find someone with the same problem.
Lets start at the beginning-Just started this job a couple months ago and people brought to my attention immediately an issue while they were on the VPN they could not get to the internet. I know about the different security risks but we have multiple field reps that need internet access while using our CRM program. So I setup Split Tunneling on the Sonicwall. Tested and works fine on my home PC using a WRT54GS Ver 2.1 and the SonicWall Global VPN Client.
So I was sure everything was fine until I just sent out 2 laptops to 2 different sales reps and they are both having the same issue. They can get into the internal network but can't access the internet. They are both on WRT54G (different Vers.). I tested the VPN client on both laptops with tethering on my cell phone and the split tunneling works. I have tried updating firmware thinking that was the issue. I also tried to put their home network on a different subnet. All with no joy. I was wondering if anyone ever ran into something like this or have any clues what to try next.
-Thank You in advance for your time.
Message Edited by Chris_F on 01-11-2010 07:41 AM
Chris F.
CCENT, CCNA, CCNA Sec

Of course, you do as you are told. But I hope you keep written record of what you have been told and have it signed of whoever told you to set it up. It's essential that you stay on the safe side in these matters.
I have read of too many cases where the system/security admin did not do so and in the end was held responsible for security incidents simply because he was told to do something to jeopardize security of the network. Remember, that usually the person who tells you do to so has no idea about the full security implication of a decision.
Thus, I highly recommend to require your road staff to connect with no split tunneling. Refuse to do otherwise unless you have it in writing and you won't be held reliable in any way if something happens because of it.
Just think what happens if the whole customer database gets stolen because of one of the remote sales reps... There is a reason why you apply this web site blocking on your firewalls and there is absolutely no reason that would justify why your remote sale reps don't go through the very same firewall while accessing company-sensitive data in your CRM.
So put that straight with whoever told you to do otherwise and if you they still want to continue anyway get it in writing. Once you ask for the statement in writing many decision-makers come to their senses and let you do your job at the best you can and for what you were hired... And if not, well, at least you got rid of the responsibility in that aspect.

SSL VPN Full and Split Tunnel Config Question

I am Beta testing SSLVPN on an IOS router. The question I have is this:
Is it possiable to have slit and full tunnel configs. It seems that once you create your context and default profile that is all you have either split or full. The books say you can use Radius and assign different profiles but, I would like to give the users a choice (like in the VPN3000 .pcf) of either split or full depending on where they are working from.

The below is an example using the ASA - but the principle remains the same:-
http://www.cisco.com/en/US/customer/products/ps6120/products_configuration_example09186a0080975e83.shtml
HTH>

RA VPN on ASA and Split Tunneling

Hello Forum,
I'm having an issue with RA VPN and split tunneling. Our company doesn't allow split tunneling.
I have the following....
ASA 5520 - ASA Version - 8.0(3)
Group Policies defined for different groups. My test group, I thought I disabled split tunneling but they are still able to surf the net.
For Split Tunneling Policy...
Inherit is unchecked
I have "Tunnel Network List Below"
Testing_splitTunnelAcl is my acl. I have a bunch of host IPs in the list. I don't have any or 0.0.0.0 in the list.
But they can still surf the net.
I would like to block access to net. No hairpinning or internet u-turns.
How do I do this?
Any help greatly appreciated.
Regards,

What does your Testing_spliTunnelAcl have?
To disable split tunneling, your Testing_spliTunnelAcl should only have this...
access-list Testing_splitTunnelAcl standard permit any
...which means all traffic will be encrypted and will be sent to ASA no matter what. If you add any IP Address, only those traffic destined to the IP Address in the list will be encrypted and send to ASA, everything else will go to internet from the client.
It may be confusing but try and see what happens.

Mavericks VPN dropouts with native VPN client and Cisco IPSec

Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
I am connecting via a WIFI router to a remote VPN server
The conenction is good for a while but eventually it drops out.
I had Zero issues in mountain lion and only have issues since the update to 10.9
I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
My thoughts are:
1 -issue with mavericks ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
2- Issue with cisco router compaitibility or timing with Cisco IPSEC
3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
Any thousuggestions?

Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
I am connecting via a WIFI router to a remote VPN server
The conenction is good for a while but eventually it drops out.
I had Zero issues in mountain lion and only have issues since the update to 10.9
I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
My thoughts are:
1 -issue with mavericks ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
2- Issue with cisco router compaitibility or timing with Cisco IPSEC
3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
Any thousuggestions?

Is there an issue with Safari in Iphones and Ipads where it does not recognize option disabled="disabled" tag properly?

Greetings everybody,
I have run into a peculiar problem with the Safari browser on mobile platforms (IPad, IPod, IPhone) which I hope I can find a solution for in this community.
I just launched a new website where I sell products with certain variations, for example please view this link: http://www.finerribbon.com/aegean-single-face-satin-ribbon.html
On this particular product, the product variants are supposed to work in such a way where:
If you select the value "1/8" from the "Choose Ribbon Width" field
THEN
The only options active and available to choose from in the "Choose Roll Size" field should be: 500 Yds, 20 Yds & Sample Swatch
Now, if we browse to the above link in Safari using a desktop or a laptop, there are no problems at all, but if we browse to the above link using an IPhone or an Ipad, then we have a problem where all the options are available regardless of the values chosen, basically the above functonality does not work.
I was told that there an issue with Safari in Iphones and Ipads where it does not recognize option disabled="disabled" tag properly, is this true? Can anyone advise me if there is a solution to this problem? I would sincerely apperciate it.
Thank you very much for your time and help!

Hi...
I have run into a peculiar problem with the Safari browser on mobile platforms (IPad, IPod, IPhone) which I hope I can find a solution for in this community.
Now, if we browse to the above link in Safari using a desktop or a laptop, there are no problems at all, but if we browse to the above link using an IPhone or an Ipad, then we have a problem
At the top of this window you'll see the following:
Apple Support Communities > Mac OS & System Software > Safari > Discussions
This the Safari forum for the Mac OS X.
Better that you post your topic here > Developer Forums: Apple Support Communities
I do see on my iPad what you are rreferring to. But you shoudl get the feedback you need in the developer forum.

Lenovo G560 - Issue with won't boot and black screen after HDD upgrade

Lenovo G560 - Issue with won't boot and black screen after HDD upgrade.
What happen: My laptop was working fine, no blue screen issue, no funny business at all. I bought a new SSD Intel 120 GB and thought it would be a good idea to replace the HDD. I shutdown and disconnected the power adapter, waited a couple of minutes and removed the battery. I opened up the back case and replaced the HDD. And put all the screws back and put the battery back in.
Problem: The very first time I turned the power on, nothing happens besides a black screen. I pressed the dvd drive it works and opens up and closes. I waited for about 30 mins and still has blac screen. When I mean black screen, no bios menu, no logo, just a black screen with the fan sound on.
I have tried these:
1. Unplugged everything - battery, adapter, and pressed the power on button for about 60 seconds, nothing, the laptop turns on with the LED display on for both on and battery LED's. But nothing but black screen, no sound of windows loading just the fan and black screen.
2. I tried putting back my old 2.5" and nothing but black screen.
Thoughts and suggestions?
Solved!
Go to Solution.

Hi Autoexit173,
Welcome to Lenovo Community!
As per the query we understood that you are facing issue with system not booting in your Lenovo G560 laptop.
As you have mentioned that the system not booting, please try to remove the RAM and turn on the system and check if you can hear any beep sound. Also try to clean the RAM slots and check for the issue.
Click here for the steps to remove the RAM and refer page number 40.
Hope this helps. Do post back if issue persists!
Best regards,
Ashwin.S
Did someone help you today? Press the star on the left to thank them with a Kudo!
If you find a post helpful and it answers your question, please mark it as an "Accepted Solution"! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.
Follow @LenovoForums on Twitter!

TS1398 I have the ipad retina display version - I have a BIG issue with this when out and about that on about 50% of the time will it see my HTC mobile WiFi hotspot - rebooting either, or both devices doesn't cure the problem it drives me MAD!!!!

I have the ipad retina display version - I have a BIG issue with this when out and about, that only about 50% of the time will it see my HTC mobile WiFi hotspot - rebooting either, or both devices doesn't cure the problem it drives me MAD!!!!
The HTC hotspot works fine with everything else I connect to it.
Also - ipad will not connect to my HTC via bluetooth. Again, I can connect to everything else with my HTC other than my ipad.
I have to say this is my first venture into Apple products and I have always wanted to get away from my windows based laptop to get a MacBook, the problems I have had (flash player etc) & continue to have (as above) are putting me right off swapping over. I HATE technology that doesn't work and my ipad has been hard work!

I stated my ipad as being an ipad2, but I now think it is a 3??? It was new Jan this year and is the 64gb retina display version.
I really would like to get to the bottom on this problem wit mobile hotspots as it is sitting on my desk next to me now and I cannot get it to connect to my HTC mobile hotspot!!!! It might be taking a flying lesson soon at this rate!!! Grrrrrrr...........

Sync issues with iPhone 6 Plus and iTunes

I'm having issues with syncing my iPhone and iTunes.
I am running: Mavericks 10.9.3 | iTunes 11.4 | iOS 8.0.2
Every time I try to sync my iPhone 6 Plus with iTunes, the sync process gets stuck on step 5 of 5 (waiting for changes to be applied). The longest this has occurred for is 2hrs. After this time I have stopped the sync and ejected my iPhone.
I had another issue with my phone when playing music. When going to play music, I was given the error message saying that the song could not be found. I connected my iPhone to iTunes and went to the tab in summery page, 'on this iPhone'. I found the song and could see that next to the song was a small what looked like dotted grey circle. After Googling this, I found a video saying that if i was to remove all my music and then add it again, this should fix the problem with this song. I did this and this was when the issue occurred again.
I unticked the option to remove all music but the sync did not finish. So I cancelled the sync, ejected my iPhone and tried again. This time, the summery page of my iPhone said there was no music on my iPhone and the 'on this iPhone' tab, this all so said there was no music however, my music was still on my iPhone including the song that would not play. All played ok.
I have read lots in the Apple forums about lost of difference reason this may be happening. Things like bugs in iOS 8, app updates being transferred during the sync process, the latest iTunes version has bugs and even a dodgy USB cable could cause it. My iPod running iOS 5 syncs all ok but I get this problem as well on my iPad Air.
I all so had this issue with my old iPhone 4S. The problem occurred when running iOS 7 and 8 on the 4S. When I had it on the 4S, I did a restore of the 4S 4 times and thought I had found the issue down too a dodgy app. However, now that it has happened on my new iPhone and still not using that app, could this be an issue with my Mac/iTunes?
I am in contact with Apple Care, but this is such a long process.
So if anybody could please offer any advice on this or steps to try to maybe solve the issue, it would be really helpful. Or if anybody is experiencing the same problem, it would be good to know its not just my devices and Mac producing this sync problem.
I will update my post with any information provided by Apple Care as and when I get it.
Thanks for reading and thanks for your time.
Mark.

Hi,
Just wanted to updated my original post and give some more information on this issue that I'm having with my iOS devices running iOS 8.0.2 and iTunes 11.4.
Firstly I just want to updated my details about what version of Mavericks I'm running. I'm running 10.9.5 - I put the wrong version down in my original post.
So over the last week, I have had a few phone calls with Apple Care an am dealing with a senior technical advisor about this issue.
I have been given some instructions that I am currently working through to see if it solves the sync issue with iTunes and my iOS devices.
The Apple Care advisor has pointed out that a iTunes version issue with music that I have ripped to iTunes and the current iTunes version could be what is causing the problem. For example, every song that I have purchased from iTunes since having an account, I was told are all exactly the same the same when it comes down the to data/information about that track/album that iTunes stores with the music but when it comes to music that I have added to iTunes myself from a CD, this was added and encoded with the version of iTunes that was running at the time of adding the music. So going through all the music that I added to iTunes over the last 10 years, you can imaging that there was lots of mixed version of iTunes linked to lots of different music.
At the moment, I'm having to go through all my music and find any that I have added and create a new ACC version of that music and delete the old version. However, due to the amount of music that I have, this is going to take a long time. When I was on the phone to the Apple Care advisor, we did several albums as a test and they all synced over to my iPhone. This may just have been luck though at that time.
Now, I'm not saying that this will solve the problem that I have with the sync issue but I am going to try it and see how I get on. The only down side to this fix as far as I can see at the moment, is that when it's all done, I think I will have to fully restore all my iOS devices to get music on to them.
I will of course updated this topic when I have got through all my music and tried to sync my iOS devices.
Thank you all for your comments.

I have been having issues with not receiving texts and voicemails daily, for a few months now. If I turn the phone completely off, when I turn it back on the messages will flood in from hours before. I can't be continually turning off my phone in case som

I have been having issues with not receiving texts and voicemails daily, for a few months now. If I turn the phone completely off, when I turn it back on the messages will flood in from hours before. I can't be continually turning off my phone in case someone left me a message. How do I resolve this issue?

Wifi: my Cell phone will remember 10 wifi connections. So delete any you don't use often and your home wifi and try to enter home wifi again.
if it still won't connect to home wifi, call your internet provider for help. You may need a newer router or different settings Or upgraded service. Your phone seeks the best connection and will refuse lesser connections.
last resort. Backup the phone. Do a full reset, then restore as new with the backup.
if still not fixed, go back to apple and insist on repair or replacement.
HOWEVER. voicemail is not a wifi issue, it's a carrier function, which is why the SIM card is a suspect.

Issues with Bex query structures and Crystal Reports/Webi

Hi experts,
I'm having an issue with Bex Query structures and nulls. I've built a Crystal Report against a Bex query that uses a Bex Query structure. The structure looks like the following
Budget $
Budget %
Actual $
Actual %
Budget YTD
etc
if I drag the structure into the Crystal Report detail section with a key figure it displays like this
Budget $     <null>
Budget %     <null>
Actual $     300
Actual %     85
Budget YTD     250
the null values are displayed (and this is what is required). However if I filter using a Record selection or group on a profit centre then the nulls along with the associated structure component are not displayed.
Actual $     300
Actual %     85
Budget YTD     250
Webi is also behaving similarly. Can anyone explain why the above is happening and suggest a solution either on the Bex side of things or on the Crystal Reports side of things? I'm confused as to why nulls are displayed in the first example and not the second.
Business Objects Edge 3.1 SP2
SAP Int Kit SP2
OS: Linux
BW 701 Level 6
Crystal Reports 2008 V1
Thanks
Keith

Hi,
Crystal Reports and Web Intelligence will only show data which is in the cube. You could have an actual 0 or Null entry whithout grouping but by changing the selection / grouping in the report the data does not include such entry anymore.
ingo

HT1349 Has anyone had issues with the iphone 4s and facebook.

Has anyone had issues with the iphone 4s and facebook. I have downloaded the app and sometimes it will let me log in and then it will log me out and not let me back in. I have deleted and downloaded it several times and nothing is working. HELP!

@razmee: rather unhelpful.
@tata - we're having the same trouble, and the only solution we've found doesn't fix it.
1) uninstall
2) login on PC/MAC and change password
3) reboot iphone
4) install facebook app, reboot again
5) login from iphone.
No joy.
Safari works, but not for the apps.
Of course, it's Facebook that has to fix this.

My wife has issues with her AOL email and was told to contact Apple about a virus scan. Has anyone else had a similar issue?

My wife has issues with her AOL email and a tech rep told her to contact Apple for a virus scan. Has anyone else had a problem like this?

You forgot to describe the 'issues' but there are no viruses that affect Apple OS X.
You may find this User Tip on Viruses, Trojan Detection and Removal, as well as general Internet Security and Privacy, useful:
https://discussions.apple.com/docs/DOC-2435
The User Tip (which you are welcome to print out and retain for future reference) seeks to offer some guidance on the main security threats and how to avoid them
Bear in mind that from April to December 2011 there were only 58 attempted security threats to the Mac - a mere fraction compared to Windows malware:
http://www.f-secure.com/weblog/archives/00002300.html
(I have ClamXav set to scan incoming emails, but nothing else.)

Issues with Adobe PSE 12 and Premier Elements 12 plus DiskWarrior 4.4

Since upgrading to the final version of OS X 10.10 Yoesemite I have issues with Adobe PSE 12 and Premier Elements 12 plus DiskWarrior 4.4. I don't recall their being any issues while I went through the Beta testing process. The Adobe products (PSE and PE) give me a configuration message "error 16" and it tells me to uninstall and reinstall. I have done this a few times/ It seems to go through the whole install process until the startup where it crashes. I downloaded PSE 11 and at least it starts up but I haven't used it to do anything. Also DiskWarrior 4.4 does not load up from the hard drive anymore (error message) and when I boot it up from disk is doesn't give me the option of correcting permission when repairing files and folders.
At lease all of otheother software including Photoshop Lightroom 5.6 seem to be working.
Very sad

Barbara,
Yes, I accessed the "updates" menu from the Help pull-down menu. I also accessed the updates using the Mac Terminal application with results shown in my original post. Regardless of whether I used the Help menu or the Mac Terminal app, the AAM tool still responded with:
Update Failed
   Updates could not be applied
   The error log file may help you in identifying the problem. The, try updating again. If the problems persist, contact customer support for further assistance.
The error log file read as follows:
   Photoshop Camera Raw 8.5
   There was an error installing this update. Please quit and try again later. Error Code: U44M1I210
   Looking at the the output of the Mac Terminal app, it shows:
   ... hdiutil: attach failed - no mountable file systems
   Is this relevant?
Regarding your follow-up message pointing to:
Update 12.1 installation errors | Photoshop Elements, Premiere Elements,
the files referenced in this link are present, are correctly named, and they are in the correct locations, so it would appear that these issues are not related to the ACR 8.5 update problem
Thanks

Are there any known issues with Adobe Edge Animate and Yosemite? Experiencing performance issues since upgrading OS

Are there any known issues with Adobe Edge Animate and Yosemite? Experiencing performance issues since upgrading OS. Animation I was working on that had been performing in browser fine suddenly stopped working, and was not related to any action I had done at that point. Also was working in it today and program stopped responding to key board short cut commands.

I am having a whole slew of odd interface problems with a fresh 2014.1.1 on a fresh macbook pro with latest Yosemite. Program locks up, cursor selections don't show, things disappear. I have a mac mini also and the program runs fine on it. Is there possibly something related to the solid state hard drive in new macs?

Issues with basic VPN setup and split tunneling

Similar Messages

Maybe you are looking for