1

I want to route all internet traffic of people who connect to my ASA, through ASA, so anyone who connects, their internet IP will be my router IP. This is my running config:

: Saved
:
ASA Version 8.2(5) 
!
hostname XXXXXXXXXXX
domain-name XXXXXX.com
names
name 192.168.1.0 AsusWireless
name 172.16.1.1 VPNGateway description VPNGateway
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address VPNGateway 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address xx.xx.xx.xx 255.255.255.248 
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 domain-name XXXXXX.com
object-group protocol DM_INLINE_PROTOCOL_1
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_2
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_3
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group network DM_INLINE_NETWORK_2
 network-object 172.16.1.0 255.255.255.0
 network-object 172.16.16.0 255.255.255.0
 network-object AsusWireless 255.255.255.0
object-group network DM_INLINE_NETWORK_1
 network-object 172.16.1.0 255.255.255.0
 network-object 172.16.16.0 255.255.255.0
 network-object AsusWireless 255.255.255.0
object-group network DM_INLINE_NETWORK_3
 network-object 172.16.1.0 255.255.255.0
 network-object 172.16.16.0 255.255.255.0
 network-object AsusWireless 255.255.255.0
object-group network DM_INLINE_NETWORK_4
 network-object 172.16.1.0 255.255.255.0
 network-object 172.16.16.0 255.255.255.0
 network-object AsusWireless 255.255.255.0
object-group protocol DM_INLINE_PROTOCOL_4
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_5
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_6
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_7
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_8
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group network DM_INLINE_NETWORK_5
 network-object 172.16.1.0 255.255.255.0
 network-object 172.16.16.0 255.255.255.0
 network-object AsusWireless 255.255.255.0
object-group network DM_INLINE_NETWORK_6
 network-object 172.16.1.0 255.255.255.0
 network-object 172.16.16.0 255.255.255.0
 network-object AsusWireless 255.255.255.0
 network-object xx.xx.xx.xx 255.255.255.248
object-group protocol DM_INLINE_PROTOCOL_10
 protocol-object ip
 protocol-object udp
 protocol-object tcp
 protocol-object igrp
object-group protocol DM_INLINE_PROTOCOL_9
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_11
 protocol-object ip
 protocol-object udp
 protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_12
 protocol-object ip
 protocol-object udp
 protocol-object tcp
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 object-group DM_INLINE_NETWORK_1 any 
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_8 xx.xx.xx.xx 255.255.255.248 any 
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_4 any object-group DM_INLINE_NETWORK_3 
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_5 any xx.xx.xx.xx 255.255.255.248 
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_10 xx.xx.xx.xx 255.255.255.248 object-group DM_INLINE_NETWORK_6 
access-list inside_access_in extended permit ip any any 
access-list TUNNEL_LIST standard permit 172.16.1.0 255.255.255.0 
access-list TUNNEL_LIST standard permit 172.16.16.0 255.255.255.0 
access-list inside_in extended permit ip 172.16.16.0 255.255.255.0 any 
access-list inside_out extended permit icmp any any log 
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_3 object-group DM_INLINE_NETWORK_4 any 
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_7 any xx.xx.xx.xx 255.255.255.248 
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any object-group DM_INLINE_NETWORK_2 
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_6 xx.xx.xx.xx 255.255.255.248 any 
access-list outside_access_in extended permit ip any any 
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_11 172.16.16.0 255.255.255.0 172.16.1.0 255.255.255.0 
access-list inside_access_out extended permit object-group DM_INLINE_PROTOCOL_9 object-group DM_INLINE_NETWORK_5 any 
access-list inside_access_out extended permit ip any any 
access-list NO_NAT extended permit ip 172.16.1.0 255.255.255.0 172.16.16.0 255.255.255.0 
access-list NO_NAT extended permit ip any 172.16.16.16 255.255.255.248 
access-list outside_access_out extended permit ip any any 
access-list outside_access_out extended permit object-group DM_INLINE_PROTOCOL_12 172.16.16.0 255.255.255.0 172.16.1.0 255.255.255.0 
access-list outside_access_out extended permit ip 172.16.16.0 255.255.255.0 any 
access-list MyTunnel standard permit 172.16.1.0 255.255.255.0 
access-list MyTunnel standard permit host xx.xx.xx.xx 
access-list MyTunnel standard permit host VPNGateway 
access-list MyTunnel standard permit 172.16.16.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 172.16.16.0 255.255.255.0 interface inside 
access-list outside_in extended permit icmp any host xx.xx.xx.xx 
access-list outside_in extended permit tcp host 24.44.185.66 host xx.xx.xx.xx eq ssh 
access-list outside_in extended permit tcp host 67.81.133.13 host xx.xx.xx.xx eq ssh 
access-list outside_in extended permit tcp 192.149.224.0 255.255.255.0 host xx.xx.xx.xx eq ssh 
access-list outside_in extended permit ip 172.16.16.0 255.255.255.0 any log 
access-list inside_nat_outbound extended permit ip 172.16.16.0 255.255.255.0 any 
pager lines 24
logging console debugging
mtu inside 1500
mtu outside 1500
ip local pool VPN_CLIENTS 172.16.16.16-172.16.16.23 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NO_NAT
nat (inside) 0 access-list inside_nat0_outbound outside
nat (inside) 1 access-list inside_nat_outbound
nat (inside) 1 172.16.1.0 255.255.255.0
nat (inside) 1 172.16.16.0 255.255.255.0
nat (inside) 1 AsusWireless 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
nat (outside) 0 172.16.16.0 255.255.255.0
nat (outside) 0 0.0.0.0 0.0.0.0
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group outside_in in interface outside
access-group outside_access_out out interface outside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 3
route inside 0.0.0.0 0.0.0.0 VPNGateway tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 description "AnyConnectACL"
 network-acl inside_in
 network-acl inside_out
aaa authentication ssh console LOCAL 
aaa authentication telnet console LOCAL 
http server enable
http 172.16.1.0 255.255.255.0 inside
http AsusWireless 255.255.255.255 inside
http 172.16.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 40
 authentication crack
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 50
 authentication rsa-sig
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 60
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 70
 authentication crack
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 80
 authentication rsa-sig
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 90
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 100
 authentication crack
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 110
 authentication rsa-sig
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 120
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 170
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
vpn-addr-assign local reuse-delay 5
telnet 172.16.1.0 255.255.255.0 inside
telnet 172.16.16.0 255.255.255.0 inside
telnet timeout 5
ssh scopy enable
ssh 172.16.1.0 255.255.255.0 inside
ssh AsusWireless 255.255.255.255 inside
ssh 172.16.16.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
management-access inside
dhcp-client update dns server both
dhcpd address 172.16.1.5-172.16.1.36 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 svc image disk0:/anyconnect-win-3.1.05187-k9.pkg 1
 svc image disk0:/anyconnect-linux-64-3.1.05187-k9.pkg 2
 svc image disk0:/anyconnect-linux-3.1.05187-k9.pkg 3
 svc image disk0:/anyconnect-macosx-i386-3.1.05187-k9.pkg 4
 svc enable
 tunnel-group-list enable
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
 dns-server value 172.16.1.2
 vpn-tunnel-protocol l2tp-ipsec 
 default-domain value XXXXXX.com
group-policy TELECOMMUTERS internal
group-policy TELECOMMUTERS attributes
 dns-server value 8.8.8.8 8.8.4.4
 vpn-tunnel-protocol svc 
 default-domain value XXXXXX.com
 address-pools value VPN_CLIENTS
 webvpn
  svc ask enable default svc timeout 10
group-policy DfltGrpPolicy attributes
 dns-server value 172.16.1.2
 vpn-tunnel-protocol webvpn
 split-tunnel-network-list value TUNNEL_LIST
 split-tunnel-all-dns enable
 webvpn
  svc rekey method ssl
  svc compression deflate
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
 wins-server none
 dns-server value 172.16.1.2 8.8.4.4
 vpn-filter value inside_in
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
 group-lock value AnyConnectProfile
 split-tunnel-policy tunnelall
 split-tunnel-network-list value MyTunnel
 default-domain value XXXXXX.com
tunnel-group DefaultRAGroup general-attributes
 address-pool VPN_CLIENTS
 default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *****
tunnel-group AnyConnectProfile type remote-access
tunnel-group AnyConnectProfile general-attributes
 address-pool VPN_CLIENTS
 authorization-server-group LOCAL
 default-group-policy GroupPolicy1
tunnel-group AnyConnectProfile webvpn-attributes
 group-alias AnyConnectProfile enable
tunnel-group AnyConnectProfile ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group TELECOMMUTERS type remote-access
tunnel-group TELECOMMUTERS general-attributes
 address-pool VPN_CLIENTS
 default-group-policy TELECOMMUTERS
tunnel-group TELECOMMUTERS webvpn-attributes
 group-alias TELECOMMUTERS enable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:161562eb1de604fe1da262fe933267a3
: end
asdm location AsusWireless 255.255.255.0 inside
asdm location VPNGateway 255.255.255.255 inside
no asdm history enable

I prefer doing things in ASDM as I'm familiar with it, but if you tell me SSH commands, I'll figure out and I'll do it. what I'm doing wrong. Full-tunnel is enabled, I have access to local LAN computers (which is necessary and I need it), but I also want everyones internet IP to be my gateway IP. Please advice

This is not duplicate, I don't want to let users use their internet IP and split tunneling. I want full tunnel and their Internet IP should be my router IP.

Improve this question
5
  • possible duplicate of Cisco ASA 5505 VPN all traffic through VPN
    – Ricky
    Apr 2, 2015 at 20:44
  • @RickyBeam, That's EXACT opposite of what I want. Answer says "split tunnel" by allowing users use their own internet IP and also access local LAN. I want internet and local LAN access all go through VPN, so...
    – Jimmy C
    Apr 2, 2015 at 20:46
  • 1
    This is still the 3rd time you've asked the same question. Deleting one of them because it got an answer you didn't like doesn't change anything.
    – Ricky
    Apr 2, 2015 at 20:50
  • @RickyBeam, I didn't get an answer. I had other problems such as local internet access issues, but none of them was for full-tunnel internet access through VPN tunnel. A lot of users are looking for same thing, internet forums and cisco forums are full of same question without a single proper answer
    – Jimmy C
    Apr 2, 2015 at 20:52
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 14:45

2 Answers 2

Reset to default
2

Your configuration does not allow hair pinning. Which means, the traffic is not allowed to leave the ASA over the same interface which has been used to access it.

Please have a look at the command "same-security-traffic intra-interface" and be sure to include the pool for the VPN clients in the NAT rules. I think it's allready included, but maybe I'm missing something.

Details can be found here: PIX/ASA and VPN Client for Public Internet VPN on a Stick Configuration Example

Improve this answer
4
  • Thank you for the answer, same-security-traffic rule is in place and VPN users are part of NAT, they are getting even same IP, but still no luck. I'm going to give up on Cisco
    – Jimmy C
    May 5, 2015 at 17:26
  • What do you mean with "they are getting even same IP"?
    – Fabian K.
    May 6, 2015 at 20:36
  • Local LAN IP: 172.16.1.X, VPN people: 172.16.16.X
    – Jimmy C
    May 13, 2015 at 15:37
  • @JimmyC I think Fabian gave pointed you in the right direction. Your client pool of IP addresses do not have to be on the same subnet as your ASA's LAN interface in order for all clients traffic to be directed out of the company ISP link.
    – Ronnie Royston
    Jun 2, 2015 at 21:10
0

I'll provide a simple example that should help you along:

! start
!
!
! FIRST LETS CREATE OBJECT GROUPS THAT REFERENCE
! AN INTERNAL NETWORK AND THEN THE VPN NET
!
object-group network GRP_INTERNAL_NET
 network-object 10.0.0.0 255.0.0.0
!
object-group network GRP_VPN_REMOTE_ACCESS_NET
 network-object 10.10.0.0 255.255.255.0
! 
!
!
! NOW LETS CREATE THE ACLS TO PERMIT ACCESS
! TO THE INTERNAL NET AND THEN ALLOW INTERNET ACCESS
access-list VPN_REMOTE_ACCESS_PERMISSIONS extended permit ip object-group GRP_VPN_REMOTE_ACCESS_NET object-group GRP_INTERNAL_NET
access-list VPN_REMOTE_ACCESS_PERMISSIONS extended permit ip object-group GRP_VPN_REMOTE_ACCESS_NET any 
!
!
!
! CREATE A LOCAL DHCP POOL FOR VPN IP ASSIGNMENT
!
ip local pool VPN_IP_POOL 10.10.0.1-10.10.0.250 mask 255.255.255.0
!
!
!
! CREATE THE POLICY TO TUNNEL EVERYTHING
!
group-policy TUNNEL_EVERYTHING internal
group-policy TUNNEL_EVERYTHING attributes
 vpn-filter value VPN_REMOTE_ACCESS_PERMISSIONS
 vpn-tunnel-protocol svc 
 split-tunnel-policy tunnelall
 webvpn
  svc ask enable default svc
!
!
!
! CREATE THE TUNNEL GROUP AND DON'T FORGET TO ADD
! YOUR AUTHENTICATION MECHANISM AND THEN ASSIGN THE 
! TUNNEL-EVERYTHING POLICY
!
tunnel-group TUNNEL_EVERYTHING type remote-access
tunnel-group TUNNEL_EVERYTHING general-attributes
 address-pool VPN_IP_POOL
 authentication-server-group ZZQQ_ADD_YOUR_AUTHENTICATION_MECHANISM
 default-group-policy TUNNEL_EVERYTHING
!
!
!
! DEFINE A URL FOR THE ANYCONNECT CLIENT TO REFERENCE
! THIS TUNNEL EVERYTHING POLICY
!
tunnel-group TUNNEL_EVERYTHING webvpn-attributes
 group-url https://ZZQQ_YOUR_DOMAIN.COM/all enable
!
!
! end
Improve this answer
2
  • There is no additional rule in your post that I don't have it in my original config. Even thought I did it as you explained by adding the TUNNEL_EVERYTHING and stuff, but I lost other stuff and connection to local lab wasn't working and so finally I returned my original config from backup. Can you tell me what I miss in my config so I can do it?
    – Jimmy C
    Apr 6, 2015 at 19:55
  • The tunnel all option will also tunnel traffic that might be the destined to the local lan. With tunnelall, I'm not sure you can send everything through the VPN, except local LAN traffic. You may have to use a split tunnel that specifies 0.0.0.0/0 (any) in the destination address, but excludes the local LAN network above it. So you are "split tunneling" everything except the local LAN.
    – Eddie
    Jun 3, 2015 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.