Monday, January 14, 2019

ASA NAT Question - Anyconnect full-tunnel to internal server via public IP?

As the title says, I need to access an internal server on the inside interface via it's public IP on the outside interface via full-tunnel Anyconnect. I already have Internet access and access to the server working via it's internal address, but I can't seem to figure out the rule and/or rule order needed to get this working properly. It also works just fine from the Internet side of the connection, just not via Anyconnect. I know I can run split-dns, but I'm really trying to avoid maintaining two DNS tables.

I'm hoping someone else has run into this. Thanks!

Relevant configs:

nat (inside,outside) source static any any destination static VPN_Access_Subnets VPN_Access_Subnets no-proxy-arp route-lookup nat (inside,outside) source static any any destination static obj-192.168.251.0 obj-192.168.251.0 no-proxy-arp route-lookup nat (outside,outside) source static VPN-192.168.251.0 VPN-192.168.251.0 destination static obj-192.168.30.0 obj-192.168.30.0 object network obj_any nat (inside,outside) dynamic interface dns object network VPN-192.168.251.0 nat (outside,outside) dynamic interface dns object network int-server nat (inside,outside) static x.x.x.28 

connection path (not working):

Anyconnect User (192.168.251.x) -> public_ip_of_server (x.x.x.28)-> server web page



No comments:

Post a Comment