1

I am testing implementation of AnyConnect where AnyConnect client, after establishing IPSec VPN tunnel, must exit to Internet via L3 device that is located on the same network as RA VPN clients, behind inside interface of ASA.

There is no split tunneling, tunnelall is defined.

After connection, VPN client gets appropriate default gateway, from pool of IP addresses, gets the address that ends with 1. That is the address of my L3 device.

After connection, VPN client can ping every host behing ASA inside interface, including default gateway.

Also, I can ping VPN client from hosts on inside network.

But, I can not exit the Internet. What could be the problem?

When I tried to connect, in logs I see message ... Flow is a loopback...something like that.

On what I should pay attention?

Improve this question
1

Flow is a loopback log message indicates that the traffic is entering and exiting on the same ASA interface. And by default, ASA does not allow this traffic.

To fix this issue, you need two things:

  • Explicitly permit this traffic on ASA with the command same-security-traffic permit intra-interface
  • And a dynamic NAT rule for Anyconnect Clients (let us say they are in VPN_Pool object-group) to access the Internet. For example: nat (outside,outside) after-auto source dynamic VPN_Pool interface (I assume that your internet-facing interface is outside).

I hope it is helpful and you can solve it.

Improve this answer
3
  • Thanks for the answer. But can you help me understand, how is traffic entering and exiting on the same ASA interface? Traffic from AnyConnect clients is entering on outside interface, and because AnyConnect clients have defined default gateway that is located in inside ASA network zone, the traffic is exiting from inside interface, to the L3 device. On the way back traffic will enter again in inside interface. What is the catch?
    – John
    Jan 6 '18 at 19:25
  • It is like AnyConnect client default gateway is not in use, and default route on ASA is used...and that route is sending all traffic toward outside interface...
    – John
    Jan 6 '18 at 19:29
  • @John In either case, that traffic will enter and then exit on the same ASA interface (here are two interfaces: inside and outside as such: outside ==> inside ==(back to)==> inside ==> outside). Try again and check the Flow is a loopback log messages, you would see the interface name.
    – Hung Tran
    Jan 6 '18 at 23:33
0

Ok, I forgot to configure default route for my tunneled traffic.

route <if_name> 0.0.0.0 0.0.0.0 <gateway> [<metric>] [tunneled]

I assumed that it was enough that remote vpn client got a proper default gateway and that he could ping it. I left out the fact that routing table of ASA must be consulted where to send the packet. And ASA only had default route toward outside interface. In my earlier implementatios that was enough because Internet traffic from my vpn clients was tunneled and nated on outside interface of ASA. My mistake.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.