In Cisco ASA Versions 8.

3 and later, the “nat-control”, “static” and “global” commands are not available
anymore. Also, the new version’s syntax uses the “nat” command differently.

----------------

PASSWORD RECOVERY

rommon #1>confreg
The security appliance displays the current configuration register value, and asks if you want to change the value.
Answer no when prompt. Current Configuration Register: 0x00000011 Configuration Summary: boot TFTP image,
boot default image from Flash on netboot failure Do you wish to change this configuration? y/n [n]: n
rommon #2>confreg 0x41
rommon #3>boot
ciscoasa>enable
Password: <Hit Enter>
ciscoasa#
ciscoasa# copy startup-config running-config
Destination filename [running-config]? <Hit Enter>
ciscoasa#conf term
ciscoasa(config)#enable password strongpass
ciscoasa(config)# config-register 0x01
ciscoasa(config)# wr mem
ciscoasa(config)# reload

----------------------

The higher the security level, the more trusted the interface (and hence the network connected behind it). The
primary rule for security levels is that an interface (or zone) with a higher security level can access an interface with a
lower security level. On the other hand, an interface with a lower security level cannot access an interface with a
higher security level, without the explicit permission of a security rule (Access Control List - ACL).

------------

Security Level 0: This is the lowest security level and it is assigned by default to the ‘Outside’ Interface of the
firewall. It is the least trusted security level and must be assigned accordingly to the network (interface) that
we don’t want it to have any access to our internal networks. This security level is usually assigned to the
interface connected to the Internet. This means that every device connected to the Internet can not have access
to any network behind the firewall, unless explicitly permitted by an ACL rule.

Security Levels 1 to 99: These security levels can be assigned to perimeter security zones (e.g. DMZ Zone,
Management Zone, Database Servers Zone etc).

Security Level 100: This is the highest security level and it is assigned by default to the ‘Inside’ Interface of the
firewall. It is the most trusted security level and must be assigned accordingly to the network (interface) that
we want to apply the most protection from the security appliance. This security level is usually assigned to the
interface connecting the Internal Corporate network behind it.
--------------------------

We can override the default behavior and allow access from Lower Security Levels to Higher Security Levels by using
Static NAT (only if required) and Access Control Lists

---------------------------

Traffic between interfaces with same Security Level: By default this is not allowed, unless you configure the
same-security-traffic permit inter-interface command (ASA version 7.2 and later).

---------------

Basic Firewall Configuration

STEP1: Configure a privileged level password (enable password)

ciscoasa(config)# enable password mysecretpassword

STEP2: Enable Remote Command Line Management

Create a username “ciscoadmin” with password “adminpassword” and use this LOCAL username to !authenticate for
SSH connections. Privilege 15 is the highest privilege level for a user.
ciscoasa(config)#username ciscoadmin password adminpassword privilege 15
ciscoasa(config)#aaa authentication ssh console LOCAL

Generate a 1024 bit RSA key pair for the firewall which is required for SSH
ciscoasa(config)# crypto key generate rsa modulus 1024 Keypair generation process begin. Please wait...
ciscoasa(config)#
Specify the hosts allowed to connect to the security appliance.
ciscoasa(config)#ssh [Link] [Link] inside
ciscoasa(config)#ssh [Link] [Link] outside

STEP3: Configure a Firewall Hostname (Optional)

ciscoasa(config)# hostname NewYork-FW
NewYork-FW(config)#

STEP4: Configure Interface Commands

ciscoasa(config)# interface GigabitEthernet0/1
ciscoasa(config-if)#  Configure Interface specific sub-commands

For Cisco ASA 5505, the interface commands are configured under the “Interface Vlan x” mode.
For Cisco ASA 5505:
ciscoasa(config)# interface Vlan [vlan number]
ciscoasa(config-if)#  Configure Interface specific sub-commands

--------------------

The absolutely necessary Interface Sub-commands that you need to configure in order for the interface to pass
traffic are the following:
o nameif “interface name”: Assigns a name to an interface
o ip address “ip_address” “subnet_mask” : Assigns an IP address to the interface
o security-level “number 0 to 100” : Assigns a security level to the interface
o no shutdown : By default all interfaces are shut down, so enable them.

-----------------

ASA NAT is disabled by default (i.e nat-control disabled). If you enable nat-control (using the command:
asa(config)#nat-control ) then you MUST have a NAT rule for ALL traffic passing from a high security interface to a
lower security interface. The NAT rule must match a corresponding “global” command (more on NAT later). With the
default configuration (nat-control disabled) the ASA passes traffic between interfaces with no need to configure any
NAT statements. You just need to have the proper Access Control Lists applied on each interface to enforce traffic
flow policies.

NOTE: From ASA version 8.3 and later, “nat-control” and “global” commands are no longer supported.

------------------

Network Address Translation

From Cisco ASA version 8.3 and later, the Network Address Translation (NAT) configuration has been completely
redesigned to allow for greater flexibility.

Note that the translation is usually applied to the “source” IP address of the packets.

The Real IP address is the address which is actually configured on the host (the untranslated address).
The mapped IP address is the address that the Real address is translated to.

Four types of NAT address translations

1. Dynamic NAT translation: The “nat” command defines which internal hosts will be translated, and the
“global” command (ASA versions prior to 8.3) defines the address pool (mapped addresses) on the outgoing
interface. Dynamic NAT is used for outbound communication only. Unidirectional (many-to-few) and the
only thing changed is the source IP. If the NAT pool Ips are exhausted, the next packet will be dropped.
 2. Dynamic Port Address Translation (PAT): A group of Real IP addresses are mapped to a Single IP address
using a unique source port of that address. Unidirectional and many-to-one. Source IP and source port get
changed.
3. Static NAT translation: Provides a permanent, one-to-one address mapping between a Real IP address and a
Mapped IP address. The Real IP should be on a higher security interface and the Mapped IP on a lower
security interface. With the appropriate Access Control List (ACL), static NAT allows hosts on a less secure
interface (e.g Internet) to access hosts on a higher security interface (e.g Web Server on DMZ) without
exposing the actual IP address of the host on the higher security interface. Static NAT is used for
Bidirectional communication.
4. Identity NAT: Identity NAT lets you translate a Real IP address to itself, essentially bypassing NAT. Identity
NAT is usefull in VPN configuration where we need to exempt VPN traffic from the NAT operation.

--------------

Dynamic NAT translation: (Cisco ASA Versions prior to 8.3)

The Real IP network to be translated is defined by the “nat” command and the Mapped IP pool that will be used for
translation is defined by the “global” command. The nat-id binds the nat command with the global command.

ciscoasa(config)# nat (Real_interface_name) “nat-id” “internal network IP subnet”

ciscoasa(config)# global (Mapped_interface_name) “nat-id” “external IP pool range”

Example:
ciscoasa(config)# nat (inside) 1 [Link] [Link] Inside net to be translated
ciscoasa(config)# global (outside) 1 [Link]-[Link] netmask [Link] Outside pool

Another example:
ciscoasa(config)# nat (inside) 1 [Link] [Link] First Internal Network
ciscoasa(config)# nat (inside) 2 [Link] [Link] Second Internal Network
ciscoasa(config)# global (outside) 1 [Link]-[Link] netmask [Link]
ciscoasa(config)# global (outside) 2 [Link]-[Link] netmask [Link]

Another example:
ciscoasa(config)# nat (inside) 1 [Link] [Link] Inside Subnet
ciscoasa(config)# nat (DMZ) 1 [Link] [Link] DMZ Subnet
ciscoasa(config)# global (outside) 1 [Link]-[Link] netmask [Link]
ciscoasa(config)# global (DMZ) 1 [Link]-[Link] netmask [Link]

Note: Because of the same nat-id of 1, “inside” hosts can initiate connections to lower security level interfaces (i.e to
both “DMZ” and “outside”). Also, these security levels allow hosts on the DMZ interface to initiate connections
towards the outside interface.

Note: Because of the same nat-id of 1, when hosts on the inside interface access hosts on the DMZ, the global(DMZ)
command causes their source addresses to be translated

Names “inside” and “outside” are the ones assigned under the interface configuration with the “nameif”
command.

-----------------

Dynamic NAT translation: (Cisco ASA Versions 8.3 and later - announced on March 8, 2010 )

In versions 8.3 and later (including 9.x versions), the ASA firewall implements NAT in two ways:
 “Network object NAT”
 “Twice NAT” (or Manual NAT)

Cisco recommends using “Network object NAT” instead of “Twice NAT” because is easier to configure and more
reliable. Twice NAT on the other hand is more scalable and has some extra features but is more complex than
network object NAT.

--------------

“Network object NAT” : The network object itself defines the Real IP address/subnet which is going to be
translated. Also, inside the network object you configure the “nat” command which specifies a pair of interfaces
between which the NAT will take place and the Mapped IP address pool. Which means, the network object
which defines the Real IP addresses must contain the “nat” statement.

ciscoasa(config)# object network [obj-name]

ciscoasa(config-network-object)# {host ip-addr | subnet net-addr net-mask | range ip1-ip2}
ciscoasa(config-network-object)# nat (real if , mapped if) dynamic [mapped-ip | mapped-obj]

The “real if” and “mapped if” define the internal and external interfaces respectively between which the
Dynamic NAT will take place. After the “dynamic” keyword, we use a mapped IP or a mapped network object
which define the IP addresses that the real addresses will be translated to. In place of “real if” or “mapped if”
we can use the keyword “any” to specify any interface.

ciscoasa(config)# object network mapped_public_pool Create the Mapped addresses object

ciscoasa(config-network-object)# range [Link] [Link]  Outside public pool
ciscoasa(config)# object network my_internal_lan Create the Real IP addresses object
ciscoasa(config-network-object)# subnet [Link] [Link]  LAN to be translated
ciscoasa(config-network-object)# nat (inside,outside) dynamic mapped_public_pool

Another example:

ciscoasa(config)# object network mapped_IP_pool_1 Create the Mapped 1 addresses object

ciscoasa(config-network-object)# range [Link] [Link]  Outside IP pool 1

ciscoasa(config)# object network lan_1

ciscoasa(config-network-object)# subnet [Link] [Link] LAN1 to be translated
ciscoasa(config-network-object)# nat (inside,outside) dynamic mapped_IP_pool_1

ciscoasa(config)# object network mapped_IP_pool_2 Create the Mapped 2 addresses object

ciscoasa(config-network-object)# range [Link] [Link]  Outside IP pool 2

ciscoasa(config)# object network lan_2

ciscoasa(config-network-object)# subnet [Link] [Link] LAN2 to be translated
ciscoasa(config-network-object)# nat (inside,outside) dynamic mapped_IP_pool_2

Another example:

ciscoasa(config)# object network mapped_IP_pool_1 Create the Mapped 1 addresses object

ciscoasa(config-network-object)# range [Link] [Link]  DMZ IP pool 1

ciscoasa(config)# object network mapped_IP_pool_2 Create the Mapped 2 addresses object

ciscoasa(config-network-object)# range [Link] [Link]  Outside IP pool 2

ciscoasa(config)# object network inside_to_dmztranslation when going from inside to dmz

ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (inside,dmz) dynamic mapped_IP_pool_1

ciscoasa(config)# object network inside_to_outsidetranslation when going from in to out

ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (inside,outside) dynamic mapped_IP_pool_2

ciscoasa(config)# object network dmz_to_outsidetranslation when going from dmz to outside

ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (dmz,outside) dynamic mapped_IP_pool_2

Use the “interface” keyword just after the “mapped_public_pool“ network object as NAT fallback so that after
the mapped IP addresses are used up, then the IP address of the mapped interface (outside ASA interface) will
be used.

------------------
The “ciscoasa# show xlate” command displays the contents of the NAT translation table.

e.g Global [Link] Local [Link] The output above shows that a private local address [Link] is
assigned a global pool address of [Link].

----------------

Dynamic Port Address Translation (PAT):

Cisco ASA Versions prior to 8.3

ciscoasa(config)# nat (inside) 1 [Link] [Link]

ciscoasa(config)# global (outside) 1 [Link] netmask [Link]

ciscoasa(config)# nat (inside) 2 [Link] [Link]

ciscoasa(config)# global (outside) 2 [Link] netmask [Link]

Another example:
ciscoasa(config)# interface G0/0
ciscoasa(config-if)# ip address dhcp setroute Get outside address and gateway from ISP
ciscoasa(config)# nat (inside) 1 [Link] [Link] Inside Subnet to use PAT
ciscoasa(config)# global (outside) 1 interface  Use the outside IP address for PAT

The “setroute” parameter tells the Cisco Firewall to set its default route using the default gateway value that
the DHCP server provides. Do not configure a default route when using the setroute option.

The firewall keeps track of all NAT sessions using its xlate table
ciscoasa# show xlate command displays the contents of the PAT translation table.
e.g PAT Global [Link] (1024) Local [Link] (4513) The output above shows that a connection from the
private local address [Link] with source port 4513 is translated into address [Link] with source port
1024.

Another example (combining dynamic NAT and PAT)

ciscoasa(config)# nat (inside) 1 [Link] [Link]

ciscoasa(config)# global (outside) 1 [Link]-[Link] netmask [Link]
ciscoasa(config)# global (outside) 1 [Link] netmask [Link]

In this case, first the pool will be used. When it’s exhausted, the interface will be used for PAT.
Cisco ASA Version 8.3 and later

ciscoasa(config)# object network internal_lan

ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (inside,outside) dynamic [Link]

ciscoasa(config)# interface G0/0

ciscoasa(config-if)# ip address dhcp setroute Get outside address and gateway from ISP
ciscoasa(config)# object network internal_lan
ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (inside,outside) dynamic interface

Another example (combining dynamic NAT and PAT)

ciscoasa(config)# object network mapped_IP_pool

ciscoasa(config-network-object)# range [Link] [Link]

ciscoasa(config)# object network PAT_IP

ciscoasa(config-network-object)# host [Link]

ciscoasa(config)# object-group network nat_pat

ciscoasa(config-network-object)# network-object object mapped_IP_pool
ciscoasa(config-network-object)# network-object object PAT_IP

ciscoasa(config)# object network internal_lan

ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (inside,outside) dynamic nat_pat

-------------

per-session PAT is enabled by default. If need to disable it, use DENY with “xlate per-session” commands.

------------

Static NAT
Dynamic NAT and PAT are used for Outbound communication only, from higher security level to lower security
level.

To access from lower security to higher security levels – Outside to Inside, static NAT is used. That is, we want
to allow hosts from the Outside (e.g Internet) to initiate connections to a local internal server (e.g our Web or
email server).

Static NAT in Cisco ASA Versions prior to 8.3

ciscoasa(config)# static (real_interface_name , mapped_interface_name) “mapped_IP” “real_IP” netmask

“subnet_mask”

ciscoasa(config)# static (DMZ , outside) [Link] [Link] netmask [Link]

ciscoasa(config)# static (DMZ , outside) [Link] [Link] netmask [Link]

In the above example, 10.0.0.x is the real IP (DMZ) which is being accessed from outside as 100.1.1.x. The public
outside internet would see only 100.1.1.x.

The real interface (e.g DMZ interface or Inside interface) must have higher security level than the mapped
interface (e.g Outside interface).

The real_interface name comes first followed by the mapped_interface name, the mapped_IP address comes
first followed by the real_IP address.

NOTE: An ACL is needed on the outside interface to allow communication.

Another example (here a subnet is static NAT’d to another subnet of same mask):

ciscoasa(config)# static (DMZ , outside) [Link] [Link] netmask [Link]

Any packet sourced from a server address on subnet [Link]/24 on the DMZ will be translated to a host
address on the [Link]/24 subnet on the outside interface (e.g. host [Link] will be translated to
[Link]).

----------------------

Static NAT in Cisco ASA Version 8.3 and later

ciscoasa(config-network-object)# nat (real if , mapped if) static [mapped-ip | mapped-obj]  this is

under the object.

Static NAT configuration uses the same concept as Dynamic NAT (i.e using network objects) but instead of
using the keyword “dynamic” in the “nat” statement we use the keyword “static”.

ciscoasa(config)# object network web_server_static

ciscoasa(config-network-object)# host [Link]  Real IP of Web Server
ciscoasa(config-network-object)# nat (DMZ , outside) static [Link]  Mapped IP

ciscoasa(config)# object network email_server_static

ciscoasa(config-network-object)# host [Link]  Real IP of Email Server
ciscoasa(config-network-object)# nat (DMZ , outside) static [Link]  Mapped IP

Another example (which use subnets):

ciscoasa(config)# object network mapped_static_range

ciscoasa(config-network-object)# subnet [Link] [Link]

ciscoasa(config)# object network dmz_network

ciscoasa(config-network-object)# subnet [Link] [Link]  DMZ subnet
ciscoasa(config-network-object)# nat (DMZ , outside) static mapped_static_range

--------------

Port Redirection

Cisco ASA Versions prior to 8.3

ciscoasa(config)# static (real_interface_name , mapped_interface_name) [tcp|udp] “mapped_IP”

“mapped_port” “real_IP” “real_port” netmask “subnet_mask”

ciscoasa(config)# static (DMZ , outside) tcp [Link] 80 [Link] 80 netmask [Link]

ciscoasa(config)# static (DMZ , outside) tcp [Link] 25 [Link] 25 netmask [Link]

OR

ciscoasa(config)# static (DMZ , outside) tcp interface 80 [Link] 80 netmask [Link]

ciscoasa(config)# static (DMZ , outside) tcp interface 25 [Link] 25 netmask [Link]

-------

Port Redirection feature can be used to translate a well-known port to a lesser-known port or vice-versa. This
will help to increase security. For example you can tell your web users to connect to a lesser-known port 5265
and then translate them to the correct port 80 on the local network.

Cisco ASA Version 8.3 and later

ciscoasa(config)# object network web_server_static

ciscoasa(config-network-object)# host [Link]
ciscoasa(config-network-object)# nat (DMZ , outside) static [Link] service tcp 80 80

ciscoasa(config)# object network email_server_static

ciscoasa(config-network-object)# host [Link]
ciscoasa(config-network-object)# nat (DMZ , outside) static [Link] service tcp 25 25 NOTES:

 The first port number (25 or 80) : This is the Real Port (actual port listening on the server)
 The second port number (25 or 80) : This is the Mapped Port (port visible from outside)
 Instead of using a mapped IP (e.g [Link]) you can use the keyword “interface”.
Identity NAT (to exempt traffic from being NAT’d)

Cisco ASA Versions prior to 8.3

Use “nat 0” command or static NAT. Note that there is no corresponding “global” command.

ciscoasa(config)# nat (DMZ) 0 [Link] [Link]

OR
ciscoasa(config)# static (DMZ , outside) [Link] [Link] netmask [Link]

In both case, the DMZ side [Link]/24 communicate with outside without NAT.

In case of S2S VPN connection, more detailed NAT exempt must be configured. In that case, an ACL can be used
to define the traffic which needs to be exempted.

ASA-1(config)# access-list NONAT extended permit ip [Link] [Link]

[Link] [Link]  This is the ACL defining the traffic which should
not be NAT’d.
ASA-1(config)# nat (inside) 0 access-list NONAT  Exclude traffic from LAN1 to
LAN2 from NAT operation

Cisco ASA Version 8.3 and later

ciscoasa(config)# object network no_nat

ciscoasa(config-network-object)# host [Link]
ciscoasa(config-network-object)# nat (DMZ , outside) static [Link]

OR

ciscoasa(config)# object network identity_nat_range

ciscoasa(config-network-object)# subnet [Link] [Link]

ciscoasa(config)# object network dmz_network

ciscoasa(config-network-object)# subnet [Link] [Link]
ciscoasa(config-network-object)# nat (DMZ , outside) static identity_nat_range

In case of S2S VPN, a more detailed NAT is required to exempt VPN traffic from being NAT’d, hence we
use TWICE NAT (also called Manual NAT):

ASA-1(config)# object network obj-local

ASA-1(config-network-object)# subnet [Link] [Link]
ASA-1(config-network-object)# exit

ASA-1(config)# object network obj-remote

ASA-1(config-network-object)# subnet [Link] [Link]
ASA-1(config-network-object)# exit

ASA-1(config)# nat (inside,outside) 1 source static obj-local obj-local destination static obj-remote obj-
remote

------------------
ACL (8.3 before Vs after)

The following are guidelines for designing and implementing ACLs:

 For Outbound Traffic (Higher to Lower Security Levels), the source address argument of an ACL entry is the
actual real address of the host or network.
 For Inbound Traffic (Lower to Higher Security Levels), the destination address argument of an ACL entry is
the translated Mapped IP address. (For ASA versions prior to 8.3)

 In ASA Version 8.3 and later:

Always use the Real IP address in the Access List when NAT is configured because NAT rule executed first
before ACL rule.

Global ACL (New feature post 8.3)

! The configuration below will allow all internal hosts to access only the internal SMTP server
([Link]) for sending emails and deny all other SMTP traffic from our internal network.

ciscoasa(config)# access-list SMTP extended permit tcp any host [Link] eq 25

ciscoasa(config)# access-list SMTP extended permit tcp host [Link] any eq 25
ciscoasa(config)# access-list SMTP extended deny tcp any any eq 25
ciscoasa(config)# access-list SMTP extended permit ip any any

! Apply the rules above globally no matter from which interface the traffic comes from. Useful when we
have many interfaces on the ASA.

ciscoasa(config)# access-group SMTP global

---------------

Methods of NAT procedure:

1. Dynamic NAT: Unidirectional and the only thing changed is the source IP.
2. Dynamic PAT: A group of Real IP addresses are mapped to a Single IP address using a unique source port of
that address. Unidirectional and many-to-one. Source IP and source port get changed.
3. Static NAT: Bi-directional, source (when inside to outside) and destination (when outside to inside) or both
IPs are translated.

Two ways of configuration in ASA:

1) Object NAT (Auto NAT)  done under the object (static and dynamic) – Section-2
2) Twice NAT (Manual NAT)  done globally (static and dynamic) – Section-1 by default.

In pre 8.3 codes, static always takes preference over dynamic. However, in post 8.3, NAT rules has been divided in to
3 sections: regardless or static or dynamic, section-1 takes preference over section-2 which takes preference over
section-3. All sections takes top to down preference, top being first taken.

In a production environment where there will be hundreds of NATs, its very important to which section we place the
NAT rules based on it’s execution priority and how it affect other section rules.

Sections:
Manual NAT (which is configured with “nat” command) is always placed in section-1
Auto NAT (object NAT) is always placed in section-2
Section-3 is also manual NAT, however, if we didn’t specify that a rule should go to section-3, be default all manual
NAT goes to section-1. To specify a NAT rule to go to section-3, use the keyword “after-auto”.
-----------
“show run object” doesn’t show Object NATs; need to use the command “show run nat”
“show nat” shows the nat entries, including it’s section.
Auto NAT is always recommended because, we cannot rearrange/edit the rule placement. It always goes to the end
of section-2. If we need to place an auto NAT in between rules in section-2, we have to first remove all auto NATs
after the rule and then configure the new rule and then re-add all removed rules again. This is very difficult.

However for manual NAT, we can define to which line it the entry should go.

(somewhat similar to number ACL Vs named ACL in routers 😊)

Object and object groups are must in ASA. You can’t define NAT without objects.

“show xlate” and “clear xlate” can be used to see the translations and clear them.

“clear configuration nat”  This command under config will remove all nat related configuration in ASA. Explore
the “clear” command options.

In pre 8.3, use the below commands to see the NAT:

Show run nat

Show run global
Show run static

Order of Operation:
1st Route
2nd Destination NAT
3rd Source ACL
4th Source NAT

Remove VPN

Three popular remote access VPN are:

1) Clientless SSL VPN tunnel (No clients required. SSL tunnel created via browser)
2) SSL (full tunnel) VPN tunnel using Anyconnect client software
3) IPsec (full tunnel) VPN tunnel with Anyconnect

A connection profile is required for creating VPN tunnels with ASA. It’s a file which defines what kind of traffic should
take what parameters and many other settings. The profile is saved as a XML file in flash. It can be edited using the
“Cisco Anyconnect profile editor”.

By default, if no profiles configured, all SLL connection will use “DeafultWebVPNGroup”

By default, if no profiles configured, all IPSEC connection will use “DefaultRAGroup”

Anyconnect VPN
VPN creates an SSL or TLS tunnel between corporate network and home PC.

Split tunnelling is a hot topic today (though the technology itself is pretty old) when the number of home VPN users
are increased. Usually, once you are connected to Corporate VPN, ALL traffic, corporate or non-corporate, comes to
the VPN device and then corporate traffic goes into the Corporate network whereas the pure internet traffic
(YouTube) goes to internet via the VPN device.

This would add a layer of security to browsing, though it could create a bottleneck at the VPN infrastructure when
the number of VPN users are increased.

Applications like o365 recommend Split tunnelling. The risk, however, is the accidental security breach.

Steps:
1) Define a local username/password account for authentication (or can use aaa)
2) http server enable
3) Define the split tunnel ACL (which define what traffic has to be tunnelled. The remaining will go to plain
internet from the PC)
4) Define network pool for clients (ip local pool ABC [Link]-[Link] mask [Link])
5) Configure actual VPN commands (under webvpn)

----------------
Useful commands which list the VPN details (RA and l2l)
show vpn-sessiondb summary
show vpn-sessiondb anyconnect
show vpn-sessiondb detail anyconnect
show vpn-sessiondb detail anyconnect filter a-ipaddress <ip>

----------