4

I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but:

  1. when i have "use default gateway on remote network" on NIC enabled i have access to all resources in network but i don't have internet access (can't open websites etc).

  2. when i have "use default gateway on remote network" on NIC disabled i dont have access to resources in network but i have internet access.

In my config file there is a little mess i tried to use ASDM and tried to configure Cisco Anyconnect but those lines in config aren't important and don't work. My VPN subnet is 192.168.20.0 and I need only l2tp for windows. If someone wants to help here is my config:

justpaste.it/i2os

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 23:19
2

You need to set up split-tunneling on ASA. That will allow you being able to access the Internet whilst using the tunnel. By default you shouldn't ever use "Default Gateway on Remote Network", so untick it.

2

Looking over the config you provided, it appears that your split tunnel ACL is only allowing connection to the 192.168.20.x adresses:

access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.224

Your ACL should have an entry for every network to which your remote access is allowed to connect. For example, should you wish to have your RA users connect to your "inside" network, you would configure the following:

access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

Correcting your split tunnel ACL and disabling "use default gateway on remote network" on the NIC should correct your issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.