[c-nsp] VPN (hopefully quick) question... split vs nosplit tunnel

[Ryan West]

ASA is easy with same- security intra-interface and nat (outside) 1  
for example.

Sent from handheld.

On May 14, 2010, at 7:33 PM, "Nick Hilliard" <nick at inex.ie> wrote:

> On 14/05/2010 23:54, Michael K. Smith - Adhost wrote:
>> I don't think you can get traffic from VPN clients to route through  
>> the
>> tunnel back out to the Internet.  On the ASA you can use the
>> 'same-security-traffic permit intra-interface' command.  On the older
>> devices, all you can do is make sure that the end user can't surf the
>> Internet while connected to the VPN.
>
> One way around this is to use public ip addresses for vpn clients.
>
> Alternatively, if you're using a more modern router, you can policy  
> route
> all your incoming vpn traffic through to a loopback interface; this  
> will
> force all VPN traffic to be processed as if generated from within your
> network, so that usual outgoing rules apply (e.g. NAT, etc). I don't  
> know
> if you can do this trick on an ASA.
>
> Both these approaches work quite well in practice.
>
> Nick
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/