Same trick works on PIX >= 7.x.
-- Adrian Chung (adrian at enfusion-group dot com) http://www.enfusion-group.com/~adrian/ GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17 ----- Original Message ----- From: [email protected] <[email protected]> To: Nick Hilliard <[email protected]> Cc: [email protected] <[email protected]> Sent: Fri May 14 19:41:32 2010 Subject: Re: [c-nsp] VPN (hopefully quick) question... split vs nosplit tunnel ASA is easy with same- security intra-interface and nat (outside) 1 for example. Sent from handheld. On May 14, 2010, at 7:33 PM, "Nick Hilliard" <[email protected]> wrote: > On 14/05/2010 23:54, Michael K. Smith - Adhost wrote: >> I don't think you can get traffic from VPN clients to route through >> the >> tunnel back out to the Internet. On the ASA you can use the >> 'same-security-traffic permit intra-interface' command. On the older >> devices, all you can do is make sure that the end user can't surf the >> Internet while connected to the VPN. > > One way around this is to use public ip addresses for vpn clients. > > Alternatively, if you're using a more modern router, you can policy > route > all your incoming vpn traffic through to a loopback interface; this > will > force all VPN traffic to be processed as if generated from within your > network, so that usual outgoing rules apply (e.g. NAT, etc). I don't > know > if you can do this trick on an ASA. > > Both these approaches work quite well in practice. > > Nick > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
