On 14/05/2010 23:54, Michael K. Smith - Adhost wrote: > I don't think you can get traffic from VPN clients to route through the > tunnel back out to the Internet. On the ASA you can use the > 'same-security-traffic permit intra-interface' command. On the older > devices, all you can do is make sure that the end user can't surf the > Internet while connected to the VPN.
One way around this is to use public ip addresses for vpn clients. Alternatively, if you're using a more modern router, you can policy route all your incoming vpn traffic through to a loopback interface; this will force all VPN traffic to be processed as if generated from within your network, so that usual outgoing rules apply (e.g. NAT, etc). I don't know if you can do this trick on an ASA. Both these approaches work quite well in practice. Nick _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
