Cisco VPN :: ASA 5505 Site-to-site VPN With Multiple Networks

Jan 20, 2013

I have a problem configuring a Cisco ASA 5505.Our company established a second facility, that should be connected using VPN to our headquarter.I used the ASDM "Site-to-site VPN wizard" to create a connection, which works fine with our main network.
 
Following structure:

Headquarter:
Cisco ASA 5505, firmware 9.1, ASDM version 7.1
Outside: fixed IP
Inside: IP of the interface is 192.168.0.1/24  (data network)

Now I have a second network 192.168.1.0/24  (VoIP network), PBX address is 192.168.1.10.Both networks should be accessible via VPN.
 
New Facility:
Cisco ASA 5505, firmware 9.1, ASDM version 7.1
Outside: fixed IP
Inside: IP of the interface is 192.168.2.1/24
 
I already created a connection, so that a PC from the new facility reaches the data network. E.g. a ping from 192.168.2.100 to 192.168.0.100 is possible.Now, I would like to add some VoIP telephones to the new facility, that can reach the PBX on 192.168.1.10.In the connection, I already added both networks as Remote  network:

object-group network Testgroup
network-object 192.168.0.0 255.255.255.0
network-object 192.168.1.0 255.255.255.0
access-list outside_cryptomap extended permit ip object-group Testgroup object Remote-Network
 
My problem is now, I don't know what to set as "Gateway" on my PBX.I can't use 192.168.0.1 because it is another subnet. Also I can't set a second IP 192.168.1.1 to the interface of the ASA., how I can realize this, so that both subnets are accessible via VPN and all the devices have a gateway set?

View 5 Replies


ADVERTISEMENT

Cisco Firewall :: Site To Site VPN Multiple Networks With 3560x

Jul 24, 2012

I have Cisco 3560X L3 Switch. We have done Inter VLAN in our internal networks. Below are the VLAN details
 
Default VLAN1 IP 192.168.125.2 (Gi0/1, Gi0/23, Gi0/24)
Interface Gi0/1 (Port Configure as a Trunk)
Interface VLAN 10 SERVERS_SW (Gi0/2 to 0/6)
IP Address: - 192.168.0.1 255.255.254.0
Interface VLAN 20 USERS_SW (Gi0/7 to 0/18)
IP Address: - 192.168.152.1 255.255.248.0
Interface VLAN 30 SPARE_SERVER_SW (Gi 0/19 to Gi 0/22)
IP Address: - 192.168.8.1 255.255.248.0
 
We have Sonicwall NSA2400 Firewall and we have setup Site-to-Site between our other offices who has Sonicwall TZ210 firewall. It works fine and they are able to access all the above networks.
 
Now the problem is we have one more site which uses Vigor Firewall (with Internal Network 192.168.100.0). We have setup the site-to-site vpn between Sonicwall NSA 2400 (Lets say SITE A) and Vigor (Lets say SITE B) but SITE A is unable to ping to SITE B Firewall but SITE B is able to *ONLY* SITE A firewall.
 
SITE A is trying to ping from User VLANs whose local ip is 192.168.152.0 range.
 
How to add route to 100.0 so that we will be able to ping and access SITE B networks.

View 5 Replies View Related

Cisco VPN :: ASA 5505 - Twice NAT Across Site To Site Tunnel With Same Private Networks

Mar 30, 2013

I'm currently trying to configure a Site to Site tunnel between an IOS Router and an ASA 5505 running 9.1
 
When the private subnet of the IOS Router was 10.0.0.0/24 and the private subnet of the ASA was 172.16.1.0/24, it connected fine.
 
I'm now trying to set it up where both private networks are 10.0.0.0/24, and created network objects, edited the ACL for interesting traffic, and created the twice NAT translation rule, but the tunnels aren't coming up.
 
There is the IOS Router(R1) and the ASA(F2). In between them is one Internet posing router that is just set up to allow both sides to reach their WAN addresses.
 
R1 and F2 have private network (10.0.0.0/24) and need to communicate. Twice NAT can be done all on the ASA to allow this, but I must be doing something wrong. The way I understand it, is that the R1 should see the traffic coming from 10.51.0.0/24 and sending to that traffic. The ASA will take that traffic, and the inside network should see it come inbound as 10.50.0.0/24. So the F2 private network communicates with 10.50.0.0/24 and R1 private network sends traffic to 10.51.0.0/24.
 
I turned on "Debug crypto ipsec" and "debug crypto isakmp" but no output is showing up or giving any hint that it is trying to establish anything. 
 
R1#show run 
version 12.4
hostname R1
crypto isakmp policy 50encr 3desauthentication pre-sharegroup 2crypto isakmp key cisco address 10.2.0.254

[Code]......

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Site To Site VPN Route From Multiple LANs?

Dec 19, 2012

I've set up a standard site-to-site VPN between 2 ASA 5505s and the VPN is working fine for traffic between these ASAs and computers which are in the same LANs.but when I'm trying to connect to computers which are in another VLAN I have a problem.

View 1 Replies View Related

Cisco VPN :: 5505 - Site To Site Connected But Cannot Ping Remote Site

Oct 11, 2011

cisco products and am struggling getting a VPN going between an ASA 5505 and 5510.  I have a VPN created (using the VPN wizward on both) and it shows the VPN is up, but I can't ping the remote site (from either side).

View 11 Replies View Related

Cisco VPN :: ASA 5505 / Site To Site Vpn With One Site Always Initiate A Tunnel?

Feb 7, 2011

I have ASA 5505, i configured site to site vpn between central site and remote site and is working. Now the problem is we use remote site for troubleshooting purpose, so we need to create a tunnel from remote site to central site. I need to configure such a way that remote site can craete a tunnel to central site, but central site not able to create a tunnel, it just respond to remote site.

View 3 Replies View Related

Cisco VPN :: ASA 5505 Site To Site Connection / Remote Site?

Mar 6, 2011

i have 2 router asa 5505 with base license i wanna make site to site vpn connection and remote site using vpn client to connect first i have hdsl router with 5 public ip i wanna try it by giving 1 public ip to each router and try the vpn but nothing work?

View 1 Replies View Related

Cisco VPN :: 5510 Site-to-site VPN Adding New Networks

May 5, 2011

I have a S2S VPN setup between a pair of ASAs (5510 and 5505) both running latest. Works fine and connects 3 local vLANs to the remote site, which has one /24 subnet. When I try and add a fourth local subnet it takes it but I can't get it to pass traffic to/from the new subnet. [code] I have added vLAN 20 as a remote network on the 5505 and as a local network on the 5510. Applied, broke the connection and re-applied it.When I ping from the 20 vLAN I get destination cannot be reached from an ISP upstream router and when I tracert, I get DEF GW, ASA's next Hop to the internet and one hop farther out where I get a unreachable message from that (3 hops and a fourth 'hop' that says it cannot reach)
 
When I ping from vLAN 10 it returns a ping. When I tracert it hits the vLAN Def GW, and then directly to the server I am trying to ping in the remote location (two hops).I can ping all things local form the 10 & 20 vLANs and get out to the internet fine.

View 3 Replies View Related

Cisco Firewall :: Adding Multiple Site To Site VPNs In ASA 5510

Oct 10, 2012

I have a ASA 5510 at our corporate HQ that has one site to site VPN. I need to add 6 additional site to site VPN's to this ASA for our remote branches. How can I add them without affecting the existing site to site VPN?  The 6 site to site VPN's will all have the same settings however these settings are different from the existing site to site that I already have set up. How can I set it up so the 6 additional VPN's use their own crypto map and all use the same settings?

View 1 Replies View Related

Cisco WAN :: AES-128 IPSEC Site-to-Site VPN Multiple Crypto Maps For One Peer

Jan 28, 2013

With à customer we have à site to site VPN connection. In this tunnel there is one subnet routed with a 3des-sha encryption / hash. Now the want to add a new subnet in this tunnel, but with a AES-128 / MD5 encryption / hash. Is it correct if we make a new crypto map with a higher seq. number?

View 5 Replies View Related

Cisco VPN :: 2911 Multiple Site-to-site VPNs With Resilience - Possibilities?

Jan 24, 2013

[code] Site-to-site VPNs in place between Site A and Site B and between each site to the DC. Site A and Site B have Cisco 2911 routers, there are ASA’s at the DC. The existing Site-to-site VPNs carry data and voice traffic between the sites (though voice and data is on separate VLANs in separate subnets)
 
ISP1 currently used for the existing circuits at Sites A and B but we have experienced issues with them recently which has disrupted service. So new circuits are to be installed at each site with ISP2. (See basic diagram attached which shows current set-up with intention to get new circuits via ISP2 installed)
 
We have 3 ports on our Cisco 2911 routers with 2 ports already in use for the existing connections (1 for the LAN and 1 for the WAN connection to ISP1) Can we simply use the 3rd port for the connection to ISP2 or would it be far more advisable to use a 2nd router (for redundancy, etc)
 
Would it be feasible to have a set-up where we have e.g. voice traffic go over a site-to-site VPN via ISP1 and data traffic go via site-to-site VPN via ISP2 but each can take over from the other in the event of a failure?

View 5 Replies View Related

Cisco VPN :: Multiple Site To Site IPSec Tunnels To One ASA5510

Dec 4, 2012

Question on ASA VPN tunnels. I have one ASA 5510 in our corporate office, I have two subnets in our corporate office that are configured in the ASA in a Object group. I have a site to site IPSEC tunnel already up and that has been working. I am trying to set up another site to site IPSEC tunnel to a different location that will need to be setup to access the same two subnets. I'm not sure if this can be setup or not, I think I had a problem with setting up two tunnels that were trying to connect to the same subnet but that was between the same two ASA's. Anyways the new tunnel to a new site is not coming up and I want to make sure it is not the subnet issue. The current working tunnel is between two ASA 5510's, the new tunnel we are trying to build is between the ASA and a Sonicwall firewall.

View 3 Replies View Related

Cisco VPN :: 2821 - Multiple WAN Interfaces For Site-to-site

Mar 31, 2013

I have 2821 router at headquarters with 3 DSL WICs and Static IP's. There are 14 remote sites. All sites are equipped with 876 ADSL Routers and Static IP. I also have an application server at headquarters. Is it possible to split my VPN's in two groups each containing seven sites, one for the first DSL line and the second for the second DSL line. I am planning to use the third DSL line for internet surfing.

View 1 Replies View Related

Cisco VPN :: 2901 / 2921 / 5505 ASA - Router Versus Firewall Site To Site VPN?

May 30, 2013

I would like to know both Cisco 2901 or 2921 router and Cisco 5505 ASA can build site to site VPN.
 
1) what is the different to build site to site VPN between router and firewall ?

2) which is the best choice if using in site to site VPN connection ? 

View 9 Replies View Related

Cisco VPN :: 5505 Connection To Mapped File Shared Dropping On A Site-to-Site VPN

Nov 27, 2011

We've just deployed a site-to-site VPN using a 5505 ASA on the client's site and a checkpoint Nokia FW on our site. Everything seems to be fine except that the user's connections to their file shares seem to be intermittently dropping. One minute the connection to the shares is there, next thing it's lost. There is no logic to it because no two users are experiencing issues at the same time, as a matter of fact even on the same PC where a user has access to 3 shares on 3 different servers, one could be showing as connected whereas the other two be dropping. [code]
 
As you can see the Duplex and Speed are set to auto, I've rectified this since then and I'm keeping a close eye on the output errors, and collisions. However, I'm afraid that this did not rectify the issue and the users are still experiencing intermittent connection dropping to their file shares over the VPN!

View 1 Replies View Related

Cisco Firewall :: ASA 5505 / Site To Site VPN Using Public Addresses On Local Network

Jul 28, 2011

I have a request to establish a site to site VPN with a customer. While collecting the information I give them our local network subnet which is a private subnet (192.168.5.0). They asked me if I could give them a public address instead. They can not work with the 192.168.5 subnet. Is this possible?
 
My side of the VPN is an ASA 5505 running 8.2(2). The other side i believe is a Checkpoint.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Site To Site RTP Traffic Is Hitting Deny All Rule?

Aug 13, 2012

Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.

Currently the rules are as follows
 
 Incoming External
allow ip any any
allow tcp any any
allow udp any any
default deny

 [code].....
 
It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.

View 2 Replies View Related

Cisco :: ASA 5505 Site To Site RTP Traffic Is Hitting Deny All Rule?

Aug 14, 2012

Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.

Currently the rules are as follows

Incoming External
allow ip any any
allow tcp any any
allow udp any any
default deny

[code]....

It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Unable To Access Certain Ports Over Site To Site VPN

Jan 16, 2013

We have a client that has a Cisco 1801W Firewall that is setup as a site to site VPN terminating to a Cisco ASA 5505. The tunnel is up and established, I can ping from both sides of the tunnel.
 
The problem is the clients behind the Cisco ASA (192.168.2.x) cannot reach certain ports behind the Router (192.168.1.x). The main thing we're trying to do is browse via UNC path (ex: \192.168.1.120 from a 192.168.2.x machine).
 
I got 3389 working after I changed the - ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map DM_RMAP_1 extendable Modified the command to include the public IP instead of interface FastEthernet0
 
I believe it has something to do with the way NAT and route-maps are setup currently but I'm not familar enough with them to make the changes. I worked with Cisco to ensure the VPN tunnel was fine and it's something security related on the Router.
 
Here is the configuration (removed a few lines not necessary. y.y.x.x = WAN IP of Router x.x.y.y = WAN IP of ASA).
  
Building configuration...
  
Current configuration : 23648 bytes
!
version 12.4
no service pad

[Code].....

View 1 Replies View Related

Cisco VPN :: Setup Site-to-Site Connection With 5505 ASA Using IPSec And Isakmp?

Aug 8, 2011

im drawing a blank trying to setup a site to site connection with a 5505 ASA using ipsec and isakmp.i have the pre shared key as well as the external address of the other end of the tunnel but do not remember what the commands are to setup the crypto map and isakmp.

View 7 Replies View Related

Cisco AAA/Identity/Nac :: ASA 5505 - Procedure For Monitoring Site-to-site VPN Tunnel?

Apr 30, 2012

Need to know the step by step procedure for monitoring site-to-site VPN tunnel (up/down) using SNMP on Cisco ASA 5505. 

View 1 Replies View Related

Cisco WAN :: 5505 Correct Site-to-site / SSLVPN Security Device

Dec 12, 2012

I have tried Cisco presales but got bounced - go Cisco !So, i have a small customer who requires a single device which will provide .....
 
1/ Leased Line connection @ 10mb
2/ ADSL failover onbox (so configurable from CLI, unlike the 860’s which I see only have one ‘active’ wan port)
3/ IOS based
4/ integrated 4 ports (min) switch
5/ site to site VPN
6/ up to 10 x SSLVPN remote users
 
I did pitch in with ASA5505 with external ADSL router but he is “space-constrained”.It worries me when Cisco doc's say only one WAN port is 'active' - since it doesn't say the second port automatically comes up if the first goes down so I can't take a gamble on that being the case.

View 3 Replies View Related

Cisco VPN :: Site To Site VPN IPSEC Tunnel From ASA 5505 To Clavister Firewall

Nov 20, 2012

I have weird problem with a Site to site VPN tunnel from a Cisco ASA 5505 to an Clavister Firewall.When I restart the Cisco ASA 5505 the tunnel is up and down,up, down, down, and I get all strange messages when I see if the tunnel is up or down with the syntax: [code]
 
After a while like 5-10 min the vpn site to site tunnel is up and here is the strange thing happening I have all accesslists and tunnel accesslists right I can only access one remote network (Main site Clavister Firewall) trought the vpn tunnel behind the Cisco ASA 5505, and I have 5 more remote networks that I want to access but only one remote network is working trought the vpn tunnel behind the Cisco ASA. I see that when I do this syntax in ASA: show crypto ipsec sa.They had a Clavister Firewall before on that site before and now they have a Cisco ASA 5505 and all the rules on the main site thats have the big Clavister Firewall is intact so the problems are in the Cisco ASA 5505. [code]
 
All these remote networks are at the Main Site Clavister Firewall.

View 1 Replies View Related

Cisco Routers :: Site-to-site VPN From SRP527W (dynamic IP) To ASA 5505 (Static)

Sep 6, 2011

I have an ASA5505 running which is on a static IP. I have just got an SRP527W for a remote worker and want to create a site-to-site VPN into the ASA. I have a number of other router of non-cisco brand which just all dial-in and connect no problem.
 
On other routers I have been abloe to specify the DDNS hostname in the VPN setup so that the ASA can identify it. I'm not sure how I setup the SRP527 to connect to the ASA.

View 3 Replies View Related

Cisco VPN :: ASA 5505 / Site 2 Site VPN With Backup Peer Not Able To Send Traffic

Mar 13, 2011

I have 2 ASA 5505 Firewall, I Configured Site 2 Site VPN no both the fitrewall, as i have a dual ISP, i am able to create the tunnel with primary but once my primary is down i am not able to create the tunnel with back up ISP. During the troobleshoothing by typing Show isakmp sa and Show ipsec sa, i can see my tunnel is up, but not able to decap the packets.
 
As it will look like
 
#pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0      #pkts compressed: 0, #pkts decompressed: 0      #pkts not compressed: 15, #pkts comp failed: 0, #pkts decomp failed: 0      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0      #send errors: 0, #recv errors: 0

View 4 Replies View Related

Cisco Firewall :: Max Number Of Clients And Site To Site VPN Tunnels On ASA 5505

Aug 15, 2012

I wanted to know the maximum VPN client sessions (using the Cisco VPN  client) and Site-to-Site VPN tunnels that I can connect to my ASA 5505  simultaneously.
 
In other words, if I have x VPN clients and y Site-to-Site  tunnels, at any time, does x + y have to be <= 10 (Total VPN Peers)?  If yes, can I upgrade to the security plus license to increase the Total VPN Peers to 25?

Licensed features for this platform:
Maximum Physical Interfaces    : 8
VLANs                          : 3, DMZ Restricted
Inside Hosts                   : Unlimited
Failover                       : Disabled
VPN-DES                        : Enabled
[Code]...

View 3 Replies View Related

Cisco VPN :: ASA 5505 - Users Aren't Able To Reach Remote Network Through Site-to-site Tunnel

May 21, 2011

Remote-access users aren't able to reach our remote network through a site-to-site VPN tunnel between two ASA 5505's.
 
I've seen several threads about that here, I've run through the walkthrough at [URL] I've taken a stab at setting split tunnelling and nat exemption, but it seems I'm still missing something. Remote-access users can reach the main site, but not the remote site.
 
Remote-access (vpn-houston) uses 192.168.69.0/24.
The main site (houston) uses 10.0.0.0/24
The remote site (lugoff) uses 10.0.1.0/24

View 5 Replies View Related

Cisco VPN :: Establish Site-to-site VPN Tunnel Between ASA 5505 And C881?

Dec 27, 2012

Last week, I was able to establish a site-to-site VPN tunnel between an ASA 5505 and Cisco C881 router just fine. The tunnel was up and and running for a number of days but today the tunnel is no longer up.  I was wondering how, if there are any commands  to re-establish or re-initiate the tunnel.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Setup A Site To Site Tunnel?

Nov 13, 2012

I have a 5505 asa code version 8.3(2). Trying to set up a site to site tunnel with someone and he is asking if I can use ike v2. How do I go about setting up the tunnel to use ikev2? Is ikev2 an option with site to site tunnels?

View 5 Replies View Related

Cisco VPN :: Configuring VPN Site To Site ASA 5505 With Contivity Nortel

Oct 17, 2012

ASA is configured with the VPN site to site using the wizard, created the Public IP of contivity, local and remote LAN . I attached the configuration. In contivity have the following settings: Not able to communicate both subnets.Do I need to configure IP subnets and published in the contivity as was done in the ASA?

View 3 Replies View Related

Cisco Firewall :: Site-to-Site VPN Between ASA 5510 And 5505 Configuration

Apr 18, 2013

I am not very experienced with Cisco networking.

Here is the situation.
 
Site A - headquarters 192.168.1.x
Site B - remote office 192.168.20.x
Site C - remote office 192.168.30.x
 
Site A - ASA 5510
Site B - ASA 5505
Site C - ASA 5505
 
Site-to-site VPN is established and works between A and B, A and C. Users would like to establish a tunnel between B and C to work on a common project and the data is on Site B.
 
I tried configuring the S2S VPN with pre-shared keys on both firewalls at sites B and C but in the end it is not established (I cannot ping either side). I used the Wizard interface multiple times and one time the CLI. I generally followed the settings chosen between the headquarter and the individual remote sites and tried to replicate them. Obviously I have made a mistake somewhere.
 
Could there be any limitation on the ASA 5505 in terms of licensing and the number of S2S tunnels?

View 7 Replies View Related

Cisco VPN :: ASA 5505 Site-to-site VPN Tunnel And Client VPN Sessions?

Nov 14, 2012

i have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z).  His satellite office will have a single PC sitting behind the ASA.  In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.The first question I have is about the ASA 5505 and the various licensing options.  I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A.  Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules?  Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?

View 1 Replies View Related

Cisco VPN :: 1812 IOS And ASA 5505 Router - Setting Up Site-to-site VPN On 881

Mar 31, 2011

Just now my boss asked me to prepare to set up site-to-site VPN on Cisco 881 Integrated Services router to ASA 5505 router which is now running at the HQ side. I am now learning pdf file from Cisco which mention how to setup site-to-site VPN between Cisco 1812 IOS router and ASA 5505 router by using ASDM V6.1 and SDM V2.5. Can't find the paper for that Cisco 881 device.

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved