problem with cisco asa 5505 vpn configuration

Question

I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but:

1. when i have "use default gateway on remote network" on NIC enabled i have access to all resources in network but i don't have internet access (can't open websites etc).

2. when i have "use default gateway on remote network" on NIC disabled i dont have access to resources in network but i have internet access.

In my config file there is a little mess i tried to use ASDM and tried to configure Cisco Anyconnect but those lines in config aren't important and don't work. My VPN subnet is 192.168.20.0 and I need only l2tp for windows. If someone wants to help here is my config:

justpaste.it/i2os

Answer 1

You need to set up split-tunneling on ASA. That will allow you being able to access the Internet whilst using the tunnel. By default you shouldn't ever use "Default Gateway on Remote Network", so untick it.

Answer 2

Looking over the config you provided, it appears that your split tunnel ACL is only allowing connection to the 192.168.20.x adresses:

access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.224

Your ACL should have an entry for every network to which your remote access is allowed to connect. For example, should you wish to have your RA users connect to your "inside" network, you would configure the following:

access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

Correcting your split tunnel ACL and disabling "use default gateway on remote network" on the NIC should correct your issue.