7

Experiment There is a lot of conflicting information about what actually happens on a Windows client when using split-dns. So much that I decided to gather some evidence and see where it points. I set up a simultaneous packet capture on both the VPN-connected Windows client and the ASA to which that client is connected. Here is a diagram of the test ...


4

Traceroute will show you the path your traffic is following. With split tunneling, a traceroute to an internet IP should not pass your VPN gateway. Another way to make sure traffic to the internet is not going through the tunnel is by visiting a website which shows your IP address (eg. whatismyip.com or ifconfig.me). If your IP address is from your local ...


4

You are confusing me with the "default gateway" thing. The source address is the address on the device from which you are pinging, not the gateway for that subnet. Suppose I have two addresses, 10.11.12.13 and 172.16.17.18 on my computer. I want to ping on the respective interfaces (logical or physical). I ping from the source (-S) with each of the ...


2

If you pay close attention to what the VPN software installs, you'll find a shim high up in the network stack that allows the software to intercept DNS lookups long before any routing has taken place. (In linux it can be done by inserting an additional NSS module. But I've not used the cisco or juniper linux clients in decades.)


1

You can define an ACL and apply the ACL under the group policy using the split tunnel value command. You can then apply the group policy to the tunnel group. It's explained in the documentation here: http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html#anc13 Below will tunnel traffic ...


1

With your comment to Ron Trunk, I am assuming that you are using two ASA firewalls and one (ASA1) is connected to Internet through outside interface and the other ASA2 is having Site to Site connectivity to ASA1 (both are in differnt location and not connected through direct L2 connectivity). You want the user's behind ASA2 inside interface to use the ...


1

You can add in the command line: route ADD xxxx MASK xxx GatewayXXXX In the place of GatewayXXXX, you put one gateway at time, next, delete the route and put the next one, accross the anothe link, changing the GatewayXXXX. I think in that form, you can compare te results


1

192.168.0.0/16 is directly connected at US & 172.16.0.0/16 is directly connected at UK. As per the running-config, the site to site tunnels are allowed to pass traffic between 192.168.0.0/16 & 172.16.0.0/16. Also traffic between same security level is permitted. Also you are having manual identity NAT configuration at both firewall. Web-vpn is ...


Only top voted, non community-wiki answers of a minimum length are eligible