Hairpin VPN

Similar Questions

• Between Cisco ASA VPN tunnels with VLAN + hairpin.

  I have two Cisco ASA (5520 and 5505) both with version 9.1 (7) with Over VPN and Security Plus licenses. I try to understand all the internet a traffic tunnel strategy VLAN especially on the 5520 above the 5505 for further routing to the internet (such as a hair/u-turn hairpin). A few warnings:

  1. The 5505 has a dynamically assigned internet address.
  2. The 5505 has sometimes no device turned on behind her, bringing interfaces down to the inside (which can cause problems from site to site).
  3. The 5520 cannot be a client of ezvpn due to its current role as a server of webvpn (anyconnect).

  Let me know if I need to post my current config. Basically, I'm starting from scratch after several attempts.

  Thank you!

  1. The 5505 has a dynamically assigned internet address.

  You can use the following doc to set up the VPN and then this document to configure Hairping/U tuning

  2. the 5505 has sometimes no device turned on behind her, bringing interfaces down to the inside (which can cause problems from site to site).

  Make sure that the interface is connected to a switch so that it remains all the TIME.

  3. 5520 the may not be a ezvpn customer due to she has current as one role anyconnect webvpn ()) server.

  You can use dynamic VPN with normal static rather EZVPN tunnel.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• VPN hairpin on the OUTSIDE interface

  Hairping VPN on the OUTSIDE interface

  What I currently have is SSL Anyconnect VPN connections to the ASA that works very well.

  I want all networks through the ASA-tunnel.

  All web connections will be donated to the ASA and hennard back to the interface from the OUTSIDE to get web access.

  I have a static route on the ASA for setting up VPN

  Route outside 0.0.0.0 0.0.0.0 PUBLIC_IP>

  NAT exemption is in place for the creation of VPN

  NAT (INSIDE, OUTSIDE) static source any destination of all public static VPN_POOL_OG VPN_POOL_OG

  What I need is the configuration to create the VPN PIN for internet traffic.

  Any help is greatly appeciated.

  

  Hi Thomas,

  You need the following:

  1)

  permit same-security-traffic intra-interface

  2)

  Pool = 192.168.3.0/24 VPN

  object obj-vpnpool network

  subnet 192.168.3.0 255.255.255.0

  dynamic NAT interface (outdoors, outdoor)

  !

  Please let me know

  The rate of any position that you be useful.

• VPN clients hairpining through a tunnel from site to site

  I have a 8.2 (5) ASA 5510 in Site1 and a 8.2 (1) ASA 5505 Site2 they are configured with a tunnel from site to site.

  Each site has VPN clients that connect and I would like to allow customers to access on both sides across the site-to-site tunnel servers.

  I enabled same-security-traffic permit intra-interface I also added the remote networks to access list who made the split tunneling.

  I think I'm doing something wrong with nat, but I don't know, any help would be greatly appreciated.

  Site1 Clients1 (172.17.2.0/24) (10.0.254.0/24)

  ASA Version 8.2 (5)

  !

  hostname site1

  names of

  DNS-guard

  !

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP address site1 255.255.255.240

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  IP 172.17.2.1 255.255.255.0

  !

  interface Ethernet0/2

  Shutdown

  nameif DMZ

  security-level 0

  IP 10.10.10.1 255.255.255.0

  !

  interface Ethernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  nameif management

  security-level 0

  IP 192.168.1.1 255.255.255.0

  management only

  !

  passive FTP mode

  permit same-security-traffic intra-interface

  VPN - UK wide ip 172.17.2.0 access list allow 255.255.255.0 172.18.2.0 255.255.255.0

  access extensive list ip 172.17.2.0 inside_nat0_outbound allow 255.255.255.0 192.168.123.0 255.255.255.0

  access extensive list ip 172.17.2.0 inside_nat0_outbound allow 255.255.255.0 172.18.2.0 255.255.255.0

  access extensive list ip 172.17.2.0 inside_nat0_outbound allow 255.255.255.0 10.0.254.0 255.255.255.0

  Notice of inside_nat0_outbound access-list us Client Server UK

  access extensive list ip 10.0.254.0 inside_nat0_outbound allow 255.255.255.0 172.18.2.0 255.255.255.0

  access extensive list ip 192.168.123.0 inside_nat0_outbound allow 255.255.255.0 10.0.254.0 255.255.255.0

  access extensive list ip 172.18.2.0 inside_nat0_outbound allow 255.255.255.0 10.0.254.0 255.255.255.0

  Standard access list Split_Tunnel_List allow 172.17.2.0 255.255.255.0

  Standard access list Split_Tunnel_List allow 172.18.2.0 255.255.255.0

  Split_Tunnel_List list standard access allowed 192.168.123.0 255.255.255.0

  Split_Tunnel_List of access note list UK VPN Client pool

  Standard access list Split_Tunnel_List allow 172.255.2.0 255.255.255.0

  outside-2 extended access list permit tcp any any eq smtp

  outside-2 extended access list permit tcp any any eq 82

  outside-2 extended access list permit tcp any any eq 81

  outside-2 extended access list permit tcp everything any https eq

  outside-2 extended access list permit tcp any any eq imap4

  outside-2 extended access list permit tcp any any eq ldaps

  outside-2 extended access list permit tcp any any eq pop3

  outside-2 extended access list permit tcp any any eq www

  outside-2 extended access list permit tcp any any eq 5963

  outside-2 extended access list permit tcp any any eq ftp

  outside-2 allowed extended access list tcp any any eq ftp - data

  outside-2 extended access list permit tcp any any eq 3389

  list of access outside-2 extended tcp refuse any any newspaper

  2-outside access list extended deny ip any any newspaper

  outside-2 extended access list deny udp any any newspaper

  allow VPN CLIENTS to access extended list ip 172.17.2.0 255.255.255.0 10.0.254.0 255.255.255.0

  allow VPN CLIENTS to access extended list ip 172.18.2.0 255.255.255.0 10.0.254.0 255.255.255.0

  allow VPN CLIENTS to access extended list 192.168.123.0 ip 255.255.255.0 10.0.254.0 255.255.255.0

  Standard access list VPNClient_splittunnel allow 172.17.2.0 255.255.255.0

  Standard access list VPNClient_splittunnel allow 172.18.2.0 255.255.255.0

  VPNClient_splittunnel list standard access allowed 192.168.123.0 255.255.255.0

  VPNClient_splittunnel of access note list UK VPN Client pool

  Standard access list VPNClient_splittunnel allow 172.255.2.0 255.255.255.0

  VPN-Northwoods extended ip 172.17.2.0 access list allow 255.255.255.0 192.168.123.0 255.255.255.0

  Note to outside_nat0_outbound to access list AD 01/05/13

  access extensive list ip 10.0.254.0 outside_nat0_outbound allow 255.255.255.0 172.18.2.0 255.255.255.0

  pager lines 24

  Enable logging

  debug logging in buffered memory

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  MTU 1500 DMZ

  management of MTU 1500

  mask 10.0.254.25 - 10.0.254.45 255.255.255.0 IP local pool VPNUserPool

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  NAT-control

  Global 1 interface (outside)

  NAT (outside) 0-list of access outside_nat0_outbound

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 172.17.2.0 255.255.255.0

  public static tcp (indoor, outdoor) interface smtp 172.17.2.200 smtp netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface 82 172.17.2.253 82 netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface 81 192.168.123.253 81 netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface https 172.17.2.10 https netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface 172.17.2.10 imap4 imap4 netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface ldaps 172.17.2.10 ldaps netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface 172.17.2.10 pop3 pop3 netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface www 172.17.2.19 www netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface 5963 172.17.2.108 5963 netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface ftp 172.17.2.7 ftp netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface ftp - data 172.17.2.7 ftp - data netmask 255.255.255.255

  static (inside, outside) tcp 3389 172.17.2.29 interface 3389 netmask 255.255.255.255

  Access-group 2-outside-inside in external interface

  Route outside 0.0.0.0 0.0.0.0 74.213.51.129 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  RADIUS protocol AAA-server DCSI_Auth

  AAA-server host 172.17.2.29 DCSI_Auth (inside)

  key *.

  AAA-server protocol nt AD

  AAA-server AD (inside) host 172.16.1.211

  AAA-server AD (inside) host 172.17.2.29

  the ssh LOCAL console AAA authentication

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp - esp-sha-hmac trans_set

  Crypto ipsec transform-set VPN-Client-esp-3des esp-sha-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto dynamic-map DYN_MAP 20 the value reverse-road

  Crypto-map dynamic outside_dyn_map 20 game of transformation-VPN-Client

  address for correspondence outside_map 20 card crypto VPN - UK

  card crypto outside_map 20 peers set site2

  card crypto outside_map 20 transform-set trans_set

  address for correspondence outside_map 30 card crypto VPN-Northwoods

  card crypto outside_map 30 peers set othersite

  trans_set outside_map 30 transform-set card crypto

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  the Encryption

  sha hash

  Group 2

  lifetime 28800

  crypto ISAKMP policy 20

  preshared authentication

  the Encryption

  md5 hash

  Group 2

  lifetime 28800

  Telnet timeout 5

  SSH timeout 60

  Console timeout 0

  management of 192.168.1.2 - dhcpd address 192.168.1.254

  enable dhcpd management

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal Clients_vpn group strategy

  attributes of strategy of group Clients_vpn

  value of server DNS 10.0.1.30

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPNClient_splittunnel

  domain.local value by default-field

  the authentication of the user activation

  tunnel-group VPNclient type remote access

  tunnel-group VPNclient-global attributes

  address pool VPNUserPool

  authentication-server-group DCSI_Auth

  strategy - by default-group Clients_vpn

  tunnel-group VPNclient ipsec-attributes

  pre-shared key *.

  tunnel-group othersite type ipsec-l2l

  othersite group tunnel ipsec-attributes

  pre-shared key *.

  tunnel-group site2 type ipsec-l2l

  tunnel-group ipsec-attributes site2

  pre-shared key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  class-map imblock

  match any

  class-map p2p

  game port tcp eq www

  class-map P2P

  game port tcp eq www

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  type of policy-map inspect im bine

  parameters

  msn - im yahoo im Protocol game

  drop connection

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  inspect the pptp

  type of policy-card inspect http P2P_HTTP

  parameters

  matches the query uri regex _default_gator

  Journal of the drop connection

  football match request uri regex _default_x-kazaa-network

  Journal of the drop connection

  Policy-map IM_P2P

  class imblock

  inspect the im bine

  class P2P

  inspect the http P2P_HTTP

  !

  global service-policy global_policy

  IM_P2P service-policy inside interface

  context of prompt hostname

  no remote anonymous reporting call

  Cryptochecksum:7717a11f5f2dce11af0f35cee7b4c893

  : end

  Site2 Clients1 (172.18.2.0/24) (172.255.2.0/24)

  ASA Version 8.2 (1)

  !

  names of

  name 172.18.2.2 UKserver

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 172.18.2.1 255.255.255.0

  !

  interface Vlan2

  nameif GuestWiFi

  security-level 0

  IP 192.168.2.1 255.255.255.0

  !

  interface Vlan3

  nameif outside

  security-level 0

  IP address site2 255.255.255.252

  !

  interface Ethernet0/0

  switchport access vlan 3

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  switchport trunk allowed vlan 1-2

  switchport vlan trunk native 2

  switchport mode trunk

  Speed 100

  full duplex

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  passive FTP mode

  permit same-security-traffic intra-interface

  Access extensive list ip 172.18.2.0 USER_VPN allow 255.255.255.0 172.255.2.0 255.255.255.0

  Access extensive list ip 172.17.2.0 USER_VPN allow 255.255.255.0 172.255.2.0 255.255.255.0

  Standard access list VPNClient_splittunnel allow 172.18.2.0 255.255.255.0

  Standard access list VPNClient_splittunnel allow 172.17.2.0 255.255.255.0

  Standard access list VPNClient_splittunnel allow 172.255.2.0 255.255.255.0

  Outside_2_Inside list extended access permit tcp any host otherhost eq smtp

  Outside_2_Inside list extended access permit tcp any host otherhost eq pop3

  Outside_2_Inside list extended access permit tcp any host otherhost eq imap4

  Outside_2_Inside list extended access permit tcp any host otherhost eq www

  Outside_2_Inside list extended access permit tcp any host otherhost eq https

  Outside_2_Inside list extended access permit tcp any host otherhost eq ldap

  Outside_2_Inside list extended access permit tcp any host otherhost eq ldaps

  Outside_2_Inside list extended access permit tcp any host otherhost eq nntp

  Outside_2_Inside list extended access permit tcp any host otherhost eq 135

  Outside_2_Inside list extended access permit tcp any host otherhost eq 102

  Outside_2_Inside list extended access permit tcp any host otherhost eq 390

  Outside_2_Inside list extended access permit tcp any host otherhost eq 3268

  Outside_2_Inside list extended access permit tcp any host otherhost eq 3269

  Outside_2_Inside list extended access permit tcp any host otherhost eq 993

  Outside_2_Inside list extended access permit tcp any host otherhost eq 995

  Outside_2_Inside list extended access permit tcp any host otherhost eq 563

  Outside_2_Inside list extended access permit tcp any host otherhost eq 465

  Outside_2_Inside list extended access permit tcp any host otherhost eq 691

  Outside_2_Inside list extended access permit tcp any host otherhost eq 6667

  Outside_2_Inside list extended access permit tcp any host otherhost eq 994

  Outside_2_Inside access list extended icmp permitted an echo

  Outside_2_Inside list extended access permit icmp any any echo response

  Outside_2_Inside list extended access permit tcp any host site2 eq smtp

  Outside_2_Inside list extended access permit tcp any host site2 eq pop3

  Outside_2_Inside list extended access permit tcp any host site2 eq imap4

  Outside_2_Inside list extended access permit tcp any host site2 eq www

  Outside_2_Inside list extended access permit tcp any host site2 eq https

  Outside_2_Inside list extended access permit tcp any host site2 eq ldap

  Outside_2_Inside list extended access permit tcp any host site2 eq ldaps

  Outside_2_Inside list extended access permit tcp any host site2 eq nntp

  Outside_2_Inside list extended access permit tcp any host site2 eq 135

  Outside_2_Inside list extended access permit tcp any host site2 eq 102

  Outside_2_Inside list extended access permit tcp any host site2 eq 390

  Outside_2_Inside list extended access permit tcp any host site2 eq 3268

  Outside_2_Inside list extended access permit tcp any host site2 eq 3269

  Outside_2_Inside list extended access permit tcp any host site2 eq 993

  Outside_2_Inside list extended access permit tcp any host site2 eq 995

  Outside_2_Inside list extended access permit tcp any host site2 eq 563

  Outside_2_Inside list extended access permit tcp any host site2 eq 465

  Outside_2_Inside list extended access permit tcp any host site2 eq 691

  Outside_2_Inside list extended access permit tcp any host site2 eq 6667

  Outside_2_Inside list extended access permit tcp any host site2 eq 994

  Outside_2_Inside list extended access permit tcp any SIP EQ host site2

  Outside_2_Inside list extended access permit tcp any range of 8000-8005 host site2

  Outside_2_Inside list extended access permit udp any range of 8000-8005 host site2

  Outside_2_Inside list extended access udp allowed any SIP EQ host site2

  Outside_2_Inside tcp extended access list deny any any newspaper

  Outside_2_Inside list extended access deny udp any any newspaper

  VPN - USA 172.255.2.0 ip extended access list allow 255.255.255.0 172.17.2.0 255.255.255.0

  access extensive list ip 172.18.2.0 inside_nat0_outbound allow 255.255.255.0 172.17.2.0 255.255.255.0

  access extensive list ip 172.18.2.0 inside_nat0_outbound allow 255.255.255.0 172.255.2.0 255.255.255.0

  access extensive list ip 172.255.2.0 inside_nat0_outbound allow 255.255.255.0 172.17.2.0 255.255.255.0

  Comment by Split_Tunnel_List-list of access networks to allow via VPN

  Standard access list Split_Tunnel_List allow 172.18.2.0 255.255.255.0

  Standard access list Split_Tunnel_List allow 172.17.2.0 255.255.255.0

  Standard access list Split_Tunnel_List allow 172.255.2.0 255.255.255.0

  Standard access list Split_Tunnel_List allow 10.0.254.0 255.255.255.0

  pager lines 20

  Enable logging

  monitor debug logging

  debug logging in buffered memory

  asdm of logging of information

  Debugging trace record

  Within 1500 MTU

  MTU 1500 GuestWiFi

  Outside 1500 MTU

  IP pool local ClientVPN 172.255.2.100 - 172.255.2.124

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 621.bin

  don't allow no asdm history

  ARP timeout 14400

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 172.18.2.0 255.255.255.0

  NAT (GuestWiFi) 2 192.168.2.0 255.255.255.0

  public static tcp (indoor, outdoor) interface smtp smtp UKserver netmask 255.255.255.255

  public static tcp (indoor, outdoor) UKserver netmask 255.255.255.255 pop3 pop3 interface

  public static tcp (indoor, outdoor) interface imap4 imap4 netmask 255.255.255.255 UKserver

  public static tcp (indoor, outdoor) interface www UKserver www netmask 255.255.255.255

  public static tcp (indoor, outdoor) https UKserver netmask 255.255.255.255 https interface

  public static tcp (indoor, outdoor) interface ldap UKserver ldap netmask 255.255.255.255

  public static tcp (indoor, outdoor) interface ldaps ldaps netmask 255.255.255.255 UKserver

  public static tcp (indoor, outdoor) interface nntp nntp netmask 255.255.255.255 UKserver

  public static 135 135 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 102 102 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 390 390 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 3268 3268 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 3269 3269 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static UKserver netmask 255.255.255.255 993 993 interface tcp (indoor, outdoor)

  public static UKserver 995 netmask 255.255.255.255 995 interface tcp (indoor, outdoor)

  public static 563 563 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 465 465 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 691 691 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 6667 UKserver 6667 netmask 255.255.255.255 interface tcp (indoor, outdoor)

  public static 994 994 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)

  Access-group Outside_2_Inside in interface outside

  Route outside 0.0.0.0 0.0.0.0 87.224.93.53 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  Ray of AAA-server vpn Protocol

  AAA-server vpn (inside) host UKserver

  key DCSI_vpn_Key07

  the ssh LOCAL console AAA authentication

  Enable http server

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp - esp-sha-hmac trans_set

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto-map dynamic outside_dyn_map 20 transform-set trans_set

  Crypto dynamic-map DYN_MAP 20 the value reverse-road

  address for correspondence outside_map 20 card crypto VPN - USA

  card crypto outside_map 20 peers set othersite2 site1

  card crypto outside_map 20 transform-set trans_set

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  the Encryption

  sha hash

  Group 2

  lifetime 28800

  crypto ISAKMP policy 20

  preshared authentication

  the Encryption

  md5 hash

  Group 2

  lifetime 28800

  Telnet timeout 5

  SSH timeout 25

  Console timeout 0

  dhcpd dns 8.8.8.8 UKserver

  !

  dhcpd address 172.18.2.100 - 172.18.2.149 inside

  dhcpd allow inside

  !

  dhcpd address 192.168.2.50 - 192.168.2.74 GuestWiFi

  enable GuestWiFi dhcpd

  !

  no basic threat threat detection

  no statistical access list - a threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal USER_VPN group policy

  USER_VPN group policy attributes

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list Split_Tunnel_List

  the authentication of the user activation

  tunnel-group othersite2 type ipsec-l2l

  othersite2 group of tunnel ipsec-attributes

  pre-shared-key *.

  type tunnel-group USER_VPN remote access

  attributes global-tunnel-group USER_VPN

  address pool ClientVPN

  Authentication-server group (external vpn)

  Group Policy - by default-USER_VPN

  IPSec-attributes tunnel-group USER_VPN

  pre-shared-key *.

  tunnel-group site1 type ipsec-l2l

  tunnel-group ipsec-attributes site1

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect the rsh

  inspect the rtsp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the tftp

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:d000c75c8864547dfabaf3652d81be71

  : end

  
  

  
  

  
  

  
  

  Hello

  The output seems to say that traffic is indeed transmitted to connect VPN L2L

  Can you PING from hosts on the network 172.18.2.0/24 to the hosts on the network 172.17.2.0/24?

  Have you tried several different target hosts on the network you are trying to ping while might exclude us actual devices are not just meeting the specifications these PINGs?

  -Jouni

• Filter for the VPN VPN hairpin

  We have a business with a Cisco ASA 5580 (8.1) site, a remote office with a Cisco ASA 5510 (8.2) with a VPN L2L of company.

  A seller has a L2L VPN to ASA company with access to the desktop remotely through virtual private networks (crossed).

  Headquarters agreed to a request the supplier on port 23. Everything works with respect to the provider of access to resources at the remote office and the Head Office of the access to the application at the supplier. Our goal now is to restrict the seller on the 23 of the corporate network and port 9100 for remote desktop. About the ASA company I set up a VPN filter and applied to the vpn L2L seller, but when I apply the filter (see below) all traffic stops at the seller such as telnet. I'd appreciate any help.

  Headquarters: 10.0.0.0 255.0.0.0

  Remote Desktop: 172.20.1.0 255.255.255.0

  Provider network: 192.168.0.0 255.255.0.0

  list of access provider-filter allowed extended tcp 192.168.0.0 255.255.0.0 10.0.0.0 255.0.0.0 eq 23

  list of access provider-filter allowed extended tcp 192.168.0.0 255.255.0.0 172.20.1.0 255.255.255.0 eq 9100

  strategy of the seller-filter-policy group interns

  attributes of the seller-filter-policy-group policy

  VPN-filter of the seller-filter value

  tunnel-group xxx.xxx.xxx.xxx General attributes

  by default-group-supplier-filter-policy

  VPN filter ACl must be as follows:

  list of access provider-filter allowed extended tcp 192.168.0.0 255.255.0.0 eq 23 10.0.0.0 255.0.0.0

  list of access provider-filter allowed extended tcp 192.168.0.0 255.255.0.0 172.20.1.0 255.255.255.0 eq 9100

• Access remote VPN question - hairpin

  Hello, I did a search before posting this question but I have not found anything specific to my situation.

  We have our ASA5520 configured in our main office to allow remote access Cisco VPN client users to access our network.  We have a (network 192.168.1.0/24) remote desktop we have a configured on the same ASA5520 VPN IPSec tunnel that allows the use of internal users (in the main office) to access resources on the network remote (192.168.1.0) and vice versa.  The problem is that when users connect to the remote VPN access, they are not able to access the resources of the remote office network.  We created the nat0 ACL and labour, and split tunnel routing is implemented for users VPN remote network access (if I make a copy of the route on my laptop after connecting to the VPN, I see the road to 192.168.0.0/24 in my routing table).  Routing everything is in place to do this, since the IPSec VPN tunnel is up and working.  My suspicion is that the question has something to do with the consolidation of these VPN clients.

  What else needs to be configured to work?  Thank you.

  Hi Scott,.

  I have a client with a PIX 515E which allows connections to remote VPN and VPN LAN2LAN multiple connections.

  We had this problem too... so what I made in my pix was:

  TEST (config) # same-security-traffic intra-interface permits (its off by default)

  If you use ASDM go to:

  Configuration > Interfaces >

  at the bottom of this page, there is an option that says: 'enable traffic between two or more host computers connected to the same interface '.

  Check and it should work... I hope

  I await your comments...

  Kind regards.

  Joao Tendeiro

• Site to site VPN, I need all internet traffic to exit the site.

  I have 2 sites connected via a pair of SRX5308

  A = 192.168.1.0/24

  IP WAN = 1.1.1.1

  B = 192.168.2.0/24

  IP WAN = 2.2.2.2

  Now what I need to do, is to have all traffic from B to go to the site one even traffic destined to the internet. That is, I need internet traffic out of our network with the IP 1.1.1.1, even if it is from the network B.

  On my I have set up a route 1.1.1.1 of the ISP, then a value by default 0/0 to 192.168.1.1 it ASA knows how to get to the peer VPN is a more specific route, but sends everything above the tunnel, at the remote end which then hairpin of ASA routes internet outside its own WAN port traffic.

  I can understand though not how to so the same thing on the pair of SRX5308 they either don't raise the tunnel or internet route to the local site address B.

  Anyone have any ideas?

  I need to do this because we are logging and monitoring of internet traffic to A site via tapping from upstream to various IDS solutions and will not (cannot) reproduce this to all our remote sites.

  Thank you

  Dave.

  After some more thought and testing I came up with a workable solution to my own problem. I'll share it here in case it can help others.

  (1) use the wizard at both ends to implement a normal VPN that connects the two segments of network 192.168.1.0 and 192.168.2.0

  (2) go to site VPN - VPN policy remote router192.168.2.1 and click Edit

  (a) disable Netbios

  (b) select "None" from the drop-down list the remote IP address.

  (c) to apply the change

  3) go to the VPN-> VPN policy on the head end site (192.168.1.1) and click Edit

  (a) disable Netbios

  (b) select "None" from the drop-down list the local IP address

  (c) to apply the change

  Now all the traffic wil go down the VPN tunnel and exit to the internet on the site of head end. Hope this helps others with the same question.

• Cisco ASA, connect an IP address on the OUTSIDE of the VPN remote access

  Hello

  I tried to find resources on the net but could not find a solution, then post it here. Maybe someone can help.

  So the problem is that I'm trying to access a server on the cloud for remote VPN access (cisco asa 5510).

  The server on the cloud (54.54.54.54) is only accessible from the outside interface (192.168.11.2) NY Firewall (cisco asa 5510)

  I added some ACE for this in the ACL of VPN tunnel to divide.

  NY-standard host allowed fw # access - list vpn_remote-customer 54.54.54.54

  And I see the road added to my cliet machine after the VPN connection, but still it cannot connect to this server.

  The network INTERIOR, I can connect to the server.

  

  Thanks in advance.

  Hello

  This is most likely a problem with NAT hair/U-turn hairpin.

  Will need to see the configurations or you would need to check yourself

  I don't know what your version of the Software ASA is to be like who determines what is the format of NAT configuration.

  So far, you have confirmed that the ASA VPN configuration provides the VPN Client with the route to the remote server. Then in circulation should be tunnel to the ASA.

  Then, you will need to check the output of this command

  See the race same-security-traffic

  You should see the command in the output below

  permit same-security-traffic intra-interface

  If you do not, you will need to add it. This effect of controls is to allow traffic to enter an interface and exit through the same interface. In your case this applies to Internet VPN Client traffic to the remote server as it between ' outside ' and spell through the 'outside'.

  Then, should ensure that dynamic PAT is configured for the VPN Clients.

  8.2 software (and below)

  You most likely have a dynamic configuration PAT like that on the firewall, if levels of above running software version

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0

  In this situation if we wanted to add dynamic PAT for a pool of VPN, we would add

  NAT (outside) 1

  This would allow users to use the same public IP address as LAN users, when accessing the remote VPN server

  Software 8.3 (and above)

  Because the NAT configuration format is completely different in the latest software, you could probably just add a new configuration of NAT completely without adding a

  network of the VPN-PAT object

  subnet

  dynamic NAT interface (outdoors, outdoor)

  Of course, its possible that there could be some configuration NAT already on the device which could cause problems for this configuration. If this does not work then that we would have to look at the actual configurations on the ASA.

  Hope this helps

  Let me know how it goes

  -Jouni

• Unable to reach the other subnet to VPN

  I need the vpn users to access the resources of the SITE-A. VPN access all the resources of the SITE B but unable to reach all servers in A SITE. ASA, I can ping servers A SITE without any problem. I tried to configure the tcp-bypass (http://packetflow.io/2014/03/asa-hairpinning-and-tcp-state-bypass.html) but still not able to reach A SITE. I also tried the crossed this site (https://nat0.net/cisco-asa-hairpinning/) and still no luck. Any idea is appreciated. I can provide SITE-B router config if necessary.

  MPLS.jpg

  

  DNS-guard
  mask pool POOL-VPN-IP 10.240.25.15 - IP 255.255.255.0 10.240.25.50
  !
  interface Ethernet0/0
  Speed 1000
  full duplex
  nameif OUTSIDE
  security-level 0
  IP 10.0.0.1
  !
  interface Ethernet0/1
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/1.10
  VLAN 10
  nameif inside
  security-level 100
  IP 172.18.83.250 255.255.255.0
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  boot system Disk0: / asa916 - k8.bin
  passive FTP mode
  clock timezone PST - 8
  clock summer-time recurring PDT
  DNS domain-lookup OUTSIDE
  domain-search DNS inside
  DNS server-group DefaultDNS
  Server name 172.18.83.10
  Server name 172.18.83.11
  Name-Server 4.2.2.2
  domain.com domain name
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  the object OBJ - ANY network
  subnet 0.0.0.0 0.0.0.0
  service object MSTSC
  service destination tcp 3389 eq
  network of the VPNPOOL object
  10.240.25.0 subnet 255.255.255.0
  object SITE-B network
  172.18.83.0 subnet 255.255.255.0
  object SITE-A network
  172.18.80.0 subnet 255.255.255.0
  object-group, INTERNAL-LAN network
  object-network 172.18.83.0 255.255.255.0
  standard access list permits 172.18.83.0 SPLIT-TUNNEL 255.255.255.0
  standard access list permits 172.18.80.0 SPLIT-TUNNEL 255.255.255.0
  OUTSIDE_access_in list extended access permitted ip object VPNPOOL SITE-a.
  Outside 1500 MTU
  MTU 1500 inside
  IP verify reverse path to the OUTSIDE interface
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 743.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (INSIDE, OUTSIDE) static source SITE SITE-B-B static destination VPNPOOL VPNPOOL non-proxy-arp-search to itinerary
  NAT (INSIDE, OUTSIDE) static source SITE-has-a-SITE static destination VPNPOOL VPNPOOL non-proxy-arp-search to itinerary
  !
  object SITE-B network
  dynamic NAT interface (all, OUTSIDE)
  Route outside 0.0.0.0 0.0.0.0 X.X.X.X 1
  Route to the INTERIOR of 172.18.80.0 255.255.255.0 172.18.83.1 1
  dynamic-access-policy-registration DfltAccessPolicy
  action to terminate
  dynamic-access-policy-record VPNTUNNEL
  AAA-server VPN-users ldap Protocol
  AAA-server VPN-users (INSIDE) X.X.X.X
  LDAP-base-dn DC = DOMAIN, DC = com
  LDAP-scope subtree
  LDAP-naming-attribute sAMAccountName
  LDAP-login-password *.
  LDAP-connection-dn CN = CISCO, OU = Service accounts, DC = DOMAIN, DC = com
  microsoft server type
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  LOCAL AAA authentication serial console
  the ssh LOCAL console AAA authentication
  Enable http server
  Server of http session-timeout 60

  
  redirect http 80 outside
  No snmp server location
  No snmp Server contact
  Telnet timeout 5
  Console timeout 0
  management-access INTERIOR
  No ipv6-vpn-addr-assign aaa
  no local ipv6-vpn-addr-assign
  a basic threat threat detection
  threat detection statistics
  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
  SSL server-version everything
  client SSL version all
  SSL-trust VPNCERT OUTSIDE point
  WebVPN
  allow outside
  AnyConnect essentials
  AnyConnect image disk0:/anyconnect-win-3.1.09013-k9.pkg 1
  AnyConnect image disk0:/anyconnect-macosx-i386-3.1.09013-k9.pkg 2
  AnyConnect enable
  tunnel-group-list activate
  attributes of Group Policy DfltGrpPolicy
  VPN-tunnel-Protocol ikev1, ikev2 ssl clientless ssl ipsec l2tp client
  value by default-domain domain.com
  Group Policy GroupPolicy_VPN SITE internal
  attributes of Group Policy GroupPolicy_VPN to SITE
  WINS server no
  value of 172.18.83.10 DNS server 172.18.83.11
  VPN - 4 concurrent connections
  VPN-idle-timeout 120
  3600 VPN-session-timeout
  client ssl-VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value of SPLIT TUNNEL
  value by default-domain domain.com
  WebVPN
  AnyConnect mtu 1200
  time to generate a new key 30 AnyConnect ssl
  AnyConnect ssl generate a new method ssl key
  AnyConnect ask flawless anyconnect
  attributes global-tunnel-group DefaultWEBVPNGroup
  LOCAL VPN users authentication-server-group
  tunnel-group VPNTUNNEL type remote access
  tunnel-group VPNTUNNEL General attributes
  address IP-VPN-POOL pool
  LOCAL VPN users authentication-server-group
  Group Policy - by default-GroupPolicy_VPNTUNNEL
  management of the password password-expire-to-days 7
  tunnel-group VPNTUNNEL webvpn-attributes
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the ftp
  Review the ip options
  inspect the pptp
  inspect the tftp
  inspect the icmp
  class class by default
  Statistical accounting of user

  It is most likely your problem then.  Your VPN clients, 10.240.25.0/24 can get to the Site, but because the Site doesn't know how to return to 10.240.25.0/24 traffic is lost.  You will need to advertise out of site B.

• RV320 Hairpin (intra-interface)

  I use the RV320 router soon and I'm putting all the services I need. This router uses 2 networks, one with the public, the second IP address with the IP address of the provider network. All local network to the internet traffic going to more non-public (WAN2, the provider's IP) and IP address public (WAN1) is planned for remote access to the network local and several VPN services.

  I added a DNS record in the administration of the area, so anyone on the internet by typing 'remote.mydomain.xy' is redirected to WAN1 IP address where appears the login page of the router or NAS.

  When I type "remote.mydomain.xy" in LAN, the request is exceeded.

  As I have found, this feature is called crossed. I tried to google any solution, but they are all more or less away from my router configuration.

  It is the same for other services. They are accessible from outside the network, but does not not within LAN. I have to manually set the local IP address of the device with the service running and leaving the office, I come to the public IP or remote.mydomain.xy

  Is there a simple way how the hairpin on the router function?

  I tried to put it in the rules on access to the firewall, but without success. I think it must have something in common with the Firewall setting as the PIN seems to work when the firewall is disabled.

  Miroslav,

  Remove the transmission and access rules that point 443 and 8080 to 192.168.1.1. Port forwarding is not required for managing remote and the firewall can not redirect traffic to the WAN, only the LAN port. Nothing should never be sent to 192.168.1.1.

  If the grouping is still intermittently after the removal of these rules, save the configuration of RV320 and reset it to the factory settings. Connect to 1 WAN and enable management remotely on 433. Try to reach the web UI to https:// and see if it is still intermittent.

  -Marty

• VPN connects but stops internet surfing

  Dear all,

  When I connect to my corporate network through the vpn cisco client, it connects successfully and all required applications runs BUT

  Internet traffic stops, resulting, no. Browsing, etc etc.

  Please let know us, if I need to check the configuration of the vpn client or do I need to add something to my cisco 2811 router,

  Kind regards

  Junaid

  There are two ways to achieve this. If you want your users to use their local ISP gateway, you will want to configure the tunneling split for the customer group. Split tunneling is configured on the router and identifies which networks should be protected by the tunnel. Alternatively, you can tunnel all traffic from the client to the hub router when connected and set up hairpin of routing for Internet access. Here's the configs to sample from each.

  EasyVPN w / split Tunneling sample:

  http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps6659/prod_white_paper0900aecd80313bf8.PDF

  VPN Client Internet audience on a stick:

  http://www.Cisco.com/en/us/products/sw/secursw/ps2308/products_configuration_example09186a008073b06b.shtml

• The ASA with crossed VPN Port forwarding

  Hello

  I worked on a question for a while and I have managed to track down the issue, but I don't know how to solve the problem.

  I have an ASA 5505 8.4 (7) running with a tunnel for incoming remote users anyconnect vpn. I also want to configure incoming Web server port forwarding.

  The question seems to be traversed rule which stops incoming port forwarding:

  NAT (outside, outside) NETWORK_OBJ_172.16.1.0_28 interface description dynamic source hairpin to natting users vpn on the external interface

  When I disable the port forwarding will work perfectly (according to tracer packet that is).

  I have attached the config to this post. I would appreciate any idea how to get the through VPN and the transfer to the incoming port working.

  The config has been condensed to remove unneed config.

  Thank you

  Hello

  What is the configuration commands, you use to put in place the static PAT (Port Forward)?

  The problem is most likely order of the NAT configurations such as configuring NAT above in the upper part of the NAT configurations.

  Configuring static PAT, that you could use to make it work would be

  the SERVER object network

  host

  service object WWW

  tcp source eq www service

  NAT (server, on the outside) of the interface to the static SERVER 1 source WWW WWW service

  The above assumes the source for the host interface is "Server" and the service that you want to PAT static TCP/80.

  Note that we add the number '1' in the 'nat' command. This will add at the top. The same should be done for any other static PAT you configure you want for these VPN Clients.

  Hope this helps

  -Jouni

• RA VPN VPN L2L via NAT strategy

  Scenario: we have remote access VPN users who need to access a VPN L2L by ASA even outside the interface. This particular VPN L2L is a partner that requires us to NAT (192.168.x.x) addresses to another private address (172.20.x.x). We also access VPN L2L to internal hosts. NATing to the partner is accomplished through a NAT policy.

  Our remote VPN users cannot access the L2L VPN. It seems that the host address VPN (assigned through RADIUS) is not in THAT NAT would not, even if it is in the range object.

  "Group" is configured and works for the other VPN.

  NO - NAT ACL does not seem to be involved (which it shouldn't), as the address of the internal host (192.168.60.x) is not NAT to be the public address.

  Internal hosts that can access the VPN tunnel very well.

  Here are the relevant config:

  permit same-security-traffic intra-interface

  the OURHosts object-group network

  host 192.168.1.x network-object

  host 192.168.2.x network-object

  object-network 192.168.60.0 255.255.255.0

  the PartnerHosts object-group network

  network-host 10.2.32.a object

  network-host 10.2.32.b object

  network-host 10.2.32.c object

  access-list extended NAT2 allowed ip object-group OURHosts-group of objects PartnerHosts

  Global (OUTSIDE) 2 172.20.x.x

  NAT (INSIDE) 2-list of access NAT2

  The syslog error we receive:

  % ASA-4-402117: IPSEC: received a package not IPSec (Protocol = ICMP) 10.2.32.a to 192.168.60.x

  Yes. According to the config that you posted, there is no command currently in no place in vpn nat clients the RA to the hairpin above the tunnel.

  The inside of our customers work due to "nat (INSIDE) 2 NAT2 access-list. But because your VPN RA customers coming from "OUTSIDE", this statement by nat would have no effect on them.

• vpn NATting traffic

  I have my vpn set up exactly as I need.  Users can connect to the vpn and get an IP of 172.16.17.0/24.  These users can access then machines hidden behind the asa on the private interface 172.16.16.1/24.  Users on the 172.16.16.1 interface can also access any machine not on the private through the router using nat interface.  What I can not understand how is allowing vpn also users to access any machine not on the private via NAT on the router interface. Help would be appreciated.

  See the road from ciscoasa #.
  Gateway of last resort is a.b.c.1 to network 0.0.0.0

  C 172.16.16.0 255.255.254.0 is directly connected, igbprivate
  S 172.16.17.20 255.255.255.255 [1/0] via a.b.c.189, igbpublic
  C 255.255.252.0 a.b.c.0 is directly connected, igbpublic
  C 192.168.1.0 255.255.255.0 is directly connected, management
  S * 0.0.0.0 0.0.0.0 [1/0] via ak.b.c.124.1, igbpublic

  access list

  access list 101 line 1 permit extended ip 172.16.16.0 255.255.255.0 172.16.17.0 255.255.255.0

  in the running-config nat statements

  interface of global (igbpublic) 1
  NAT (igbprivate) 0-access list 101
  NAT (igbprivate) 1 0.0.0.0 0.0.0.0

  If your VPN users connect on the side of the SAA Public then I still think Hairpining is what you should look into. It is very similar to my problem in which I want to VPN users to access internet through VPN. Packets from the VPN users must enter the public interface and return directly. I hope I understand this.

• Publish a server with NAT anchored through a tunnel VPN with ASA

  Hi all

  Thanks in advance for helping me out - I know somebody did, and I have trouble finding how do.  I don't know that I'm missing something simple.

  I have a client who wants to view a DVR device through a VPN tunnel that is published through the public firewall to collocation.  Endpoint DVR is endpoint ip assigned dynamically which tunnelle the host on demand (I know that the tunnel could fall).

  So I think / thought I could hairpin hair/policy nat this, but I'm not the best at this.

  Let's see if I can get this

  IP public 1.1.1.1\

  > External interface of ASA

  2.2.2.2 / private ip

  My config as I know it is pertinant is as follows:

  permit same-security-traffic intra-interface

  list of allowed incoming access extended ip any host 168.215.x.x

  Access-group interface incoming outside

  public static 168.215.x.x (outside, outside) 10.10.x.xnetmask 255.255.255.255

  I am running version 8.2.5 of the image of the SAA.

  If you could take a look and let me know what Miss me you please.

  Thank you

  Hello

  The problem here is of course the fact that we can not configure NAT0 without causing all traffic from the remote Internet can flow through the VPN connection.

  So I wonder if another type of NAT configuration would actually work.

  I would call it static political identity NAT if such a name exists yet.

  Something like that

  Note of DVR-POLICY-NAT-list of Direct HTTP access to VPN traffic

  allow to Access-list DVR-POLICY-NAT tcp host 10.10.2.253 eq 80 a

  public static 10.10.2.53 (inside, outside) access list DVR-POLICY-NAT

  This should basically do what

  • When the DVR is sending any traffic source TCP TCP/80 (essentially the traffic back to the connection from the main site) to ANY destination address (The Internet) then the host must translate to himself.
  • If we consider that NAT is performed before the VPN rules are processed this should mean that since we have concerns address itself, it must match the VPN rule only in this particular case where the traffic is TCP/80, which could only be the result of her replying to a link any destination TCP/80)
  • Which leads me to believe it shouldn't cause any problems with the Central connection on remote site (NAT0 is processed before political static NAT) or the RECORDER to Internet
  • Unless the DVR must be accessible directly via the Internet connection of the remote site. (He would send his answers to these HTTP connections outside with the originating source IP address) Or maybe even completely before connecting the phase failure. I have not tested.

  Hope this helps

  Be sure to mark it as answered in the affirmative. And/or useful response rate.

  Ask more if necessary.

  EDIT: typos

  -Jouni