ASA · ANYCONNECT

ASA-style: AnyConnect remote access with split tunnelling

alice works from home on LAP1, behind the provider R1. She needs the office server SRV, which is only reachable inside. Publish AnyConnect on the outside interface: users log in, get an address from a pool, and only office traffic goes through the tunnel. Any host here can act as the client, with vpn connect.

Cisco ASA-style track · Cisco ASA-style, Cisco router · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

An address pool VPN-POOL (10.99.0.10 to 10.99.0.50) and a split tunnel list SPLIT: access-list SPLIT standard permit 192.168.1.0 255.255.255.0.
webvpn: enable outside, an anyconnect image, anyconnect enable, tunnel-group-list enable.
Group policy GP: vpn-tunnel-protocol ssl-client, split-tunnel-policy tunnelspecified with SPLIT. User alice (password Lab123) in GP.
Tunnel-group RA, type remote-access, with address-pool VPN-POOL and default-group-policy GP, and group-alias RA. A NAT exemption between INSIDE and the pool.
On LAP1: vpn connect 203.0.113.1 user alice password Lab123, then ping SRV. show vpn-sessiondb anyconnect on ASA1 lists alice and her address.

Start this lab

Before you start

The pool address is what SRV sees, so replies to it must not be translated: that is the NAT exemption. With split tunnelling only 192.168.1.0/24 goes through the tunnel; LAP1’s other traffic stays local. The AnyConnect image and the client itself are stood in for: no software is installed.

Concept

Remote access: AnyConnect and a clientless portal

A user logs in to the firewall from outside. With AnyConnect the firewall gives the user an address from a pool and a tunnel, and split tunnelling decides which traffic goes through it. With the clientless portal the user gets no address, only bookmarks that the firewall fetches. Each login lands in a tunnel-group, and a group policy says what that user may do.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.