Remote Access VPN, how to specify on which interface clients will be placed on?

Question

Hi,
I have a general understanding problem with remote access VPN and Cisco ASA.
If I have an ASA with multiple interfaces and I want to make sure that a Remote Access VPN Client is placed onto a specific interface, how do I do this?
example:
ASA has 4 interfaces: outside, inside-clients, inside-workers, inside-lab.
I want to allow multiple Remote Access VPN configurations that put clients coming from "outside" to "inside-lab" and "inside-clients", with two different profiles and two different IP pools, as the IP addresses for each of the interfaces is different.
How do I do that?
If possible be as explanatory as possible for me to really grasp the concept.
Many thanks
Pat

Answer 1

Hi,
The ASA will view the hosts in its routing table behind the ASA interface which forms the VPN connection with the VPN Client. This is most of the time the interface called "outside".
By default the ASA allows all traffic coming from a VPN connection to bypass the interface ACL of the ASA. The thought process behind this is I guess the fact that the VPN devices/clients have already proven they have right to connect to the network to all traffic is allowed.
The configuration that controls this setting globally on the ASA is
sysopt connection permit-vpn
The above is the default setting of the command and it WONT show up in the CLI format configurations because its a default setting.
If you were to issue the following command
no sysopt connection permit-vpn
Then this would mean that the ASA would require an ACL statement on its VPN terminating interface (outside) to permit the traffic from the VPN Pool to the LAN networks.
Naturally you would have to take into consideration also that if you have existing VPNs and insert the above global command they would also need ACL statements on the "outside" interface ACL or the inbound traffic from the VPN will start to get blocked.
Other option (wihtout touching the above setting) would be to configure VPN Filter ACL that is a separate ACL that is only attached to a certain user or group of users.
I personally prefer the method of using the above global setting and using the "outside" interface ACL to control traffic.
Naturally it still leaves the question of how you are going to configure the Tunnel Groups, Group Policys and Usernames. To be honest, I have gotten a bit distracted from VPN client setups and have forgotten a lot of stuff since I dont work with them on a day to day basis. I mostly handle L2L VPN nowadays among normal firewall configurations.
If I had to suggest something simple at this point it would be this
Configure separate Tunnel Groups
Configure separate VPN Pools for the above Tunnel Groups
Configure separate Group Policys for the above Tunnel Groups
Configure the above mentioned Global setting to limit inbound traffic from VPN
Configure the "outside" interface ACL so that you only permit traffic from a certain VPN Tunnel Group users only to certain LAN networks
Configure the required NAT0 configurations for traffic between these networks
As Marcin said, there are multiple different ways to achieve the same thing as above.
And as I said I have gotten a bit rusty with the VPN Client side on the ASA so I am not sure if at the moment I can even consider all the possible options but surely the simple ones.
PS. The link that Marcin posted seems to point to a Group Policy setting that would let you lock the that VPN connection to use only a certain local Vlan (subinterface) on the ASA and therefore limit traffic from going to networks behind other interfacec
Hope this helps
- Jouni