69-47
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter69 General VPN Setup
Configuring AnyConnect VPN Client Connections
Exempting AnyConnect Traffic from Network Address Translation
If you have configured your ASA to perform network address translation (NAT), you must exempt your
remote access AnyConnect client traffic from being translated so that the AnyConnect clients, internal
networks, and corporate resources on a DMZ, can originate network connections to each other. Failing
to exempt the AnyConnect client traffic from being translated prevents the AnyConnect clients and other
corporate resources from communicating.
“Identity NAT” (also known as “NAT exemption”) allows an address to be translated to itself, which
effectively bypasses NAT. Identity NAT can be applied between two address pools, an address pool and
a subnetwork, or two subnetworks.
This procedure illustrates how you would configure identity NAT between these hypothetical network
objects in our example network topology: Engineering VPN address pool, Sales VPN address pool,
inside network, a DMZ network, and the Internet. Each Identity NAT configuration requires one NAT
rule.
Table69-3 Network Addressing for Configuring Identity NAT for VPN Clients
Step1 Log into the ASDM and select Configuration > Firewall > NAT Rules.
Step2 Create a NAT rule so that the hosts in the Engineering VPN address pool can reach the hosts in the Sales
VPN address pool. In the NAT Rules pane, select Add > Add NAT Rule Before “Network Object”
NAT rules so that the ASA evaluates this rule before other rules in the Unified NAT table. See
Figure 69-2 on page69-48 for an example of the Add NAT rule dialog box.
Note NAT rule evaluation is applied on a top-down, first match basis. Once the ASA matches a packet
to a particular NAT rule it does not perform any further evaluation. It is important that you place
the most specific NAT rules at the top of the Unified NAT table so that the ASA does not
prematurely match them to broader NAT rules.
Network or Address Pool Network or address pool name Range of addresses
Inside network inside-network 10.50.50.0 - 10.50.50.255
Engineering VPN address pool Engineering-VPN 10.60.60.1 - 10.60.60.254
Sales VPN address pool Sales-VPN 10.70.70.1 - 10.70.70.254
DMZ network DMZ-network 192.168.1.0 - 192.168.1.255