ASA 5505 site to site VPN

Question

Could the ASA 5505 do a site to site VPN and still have client connected through IPSec VPN ( any connect clients ) at the same time ? I am having issues with clients not able to access local network and loosing internet in their computers once they are connected to IPSec VPN. It might be a firewall issue that I don't have much experience in, but I mentioned the site to site because this issue occurred after we established a VPN site to site connection with our other location ( Using D-Link DSR-250 on the other site if that matters )

Thank you for the help

Answer 1

When doing a Site-to-Site VPN with split tunneling you must configure as follows:

1. Create a tunnel group on the ASA using the public peer address of your remote site, assign charictaristics to the tunnel group (i.c L2L), then assign a PSK PSKs must match on both sides of tunnel*

   Tunnel-group X.X.X.X type ipsec-l2l
   Tunnel-group X.X.X.X ipsec-attributes
   Ikev1 Pre-shared key THISISTHEKEY
   

2. Create a transform set

   crypto ipsec ikev1 tranform-set (what ever your crypto / hashing/ encryp)
   

3. Create an ACL identifing traffic to go through the Tunnel also prevents from being NAT'd by ASA

   access-list (Name) Permit ip 10.10.10.0 255.255.255.0 10.10.20.0 255.255.255.0
   

4. Then create a tunnel:

   crypto map (name) 1 match address (The ACL you just created)
   crypto map (Same name as above) 1 set peer (remote peer public IP)
   crypto map (Same name as above) 1 set ikev1 transform-set (what ever you created)
   

5. Apply to interface

   crypto map (name) interface outside
   

Then you can dynamically PAT the (any,outside)

Answer 2

Yes, you can do both at the same time. Check your licensing as you may need the security plus license for a certain number of concurrent connections but for one S2S VPN and a handful of client connections you should be OK.

One thing you want to look up is split tunneling. If you want your clients to use their local internet connection while connected to the VPN, split tunneling needs to be enabled. I can't remember the exact command off the top of my head but google cisco asa split tunnel.

Other than those things, what also causes issues is not NATing correctly like someone previously mentioned.

You can use the packet tracer command in the CLI or packet tracer menu item in ASDM to help determine if traffic is being allowed in or out, if it's going through the VPN and is getting NATed like you want (or don't want) it to.

Answer 3

As mentioned split tunneling is required, to tunnel all networks, but local net use the following;

create standard acl:

access-list Local-NET standard permit host 0.0.0.0
!
!

via your group-policy:

split-tunnel-policy excludespecified
split-tunnel-network-list value Local-NET