Cisco VPN :: ASA 5510 - Route Between Two VPNs
Feb 22, 2012
I have been endlessly searching around online, and trying things on the firewall, and cant seem to find an answer to this problem. Its probably something really simple right under my nose! I am using an ASA 5510, which currently has a few seperate site-to-site VPN connections configured, which connect to other Cisco devices on clients networks.
I work from home, so also connect to our network using Remote Access VPN (any connect) to connect to the network at the data centre.
Just to be clear, here is my amazingly drawn network diagram:
[[my house]]-------------- <any connect VPN>------------[[ASA 5510 / Data centre]]-----------<site-to-site>-----------------[[Client network]]
The problem I am having, is that I cannot connect directly from my house to the client network, I need to RDP into some server in the data center, then from there I can see the Clients network. Is there routing to be setup somewhere? between VPN's? Ive looked into the routing options on the firewall and cant seem to find anything that works. I've searched for this and cant find answers, even some sources saying its impossible.
View 7 Replies
ADVERTISEMENT
Jul 12, 2012
I have to connect through VPN for work so that I can RDP into my remote development machine, but their internet speed is painfully slow. Is there any way I can route my general internet browsing traffic through my local connection, while still maintaining the VPN connection to my remote box?
View 1 Replies
View Related
Sep 9, 2012
I would like to create two site-to-site VPNs, one for data and one for VoIP, between the same sites. One end is an ASA 5510 and the other is a third party firewall. Is this possible if I use different sets of IP addresses for each tunnel?
View 3 Replies
View Related
Jun 24, 2011
I've enabled antispoof on all interfaces on asa 5510.If you start a traceroute to a network on the default route, everything works, since replies comes to an interface with route 0.0.0.0/0 defined.If you start a tracer route to a network that is NOT on the default route (let's assume coporate MPLS), you only get response from first carrier router, the other are discarded because of anti spoof violation.
I have ICMP inspection and icmp-error inspection enabled.
View 1 Replies
View Related
Aug 12, 2012
I am adding a second external connection to an existing system on an ASA 5510 with ASA V8.2 and ASDM 6.4. I added the new WAN using an other interface (newwan).
The intention is to route most internet traffic over the new route/interface (newwan) but keep our existing VPNs using the former interface (outside).
I used the ASDM GUI to make the changes and most of it works.ie. The default route goes via (newwan). Outgoing VPNs of a site to site nature use the previous route via (outside) as they now have static routes to achieve this.
The only problem is that incomming Remote Access Anyconnect VPNs are not working. I set the default static route to use the new interface (newwan) and the default tunneled route to be via (outside) but this is the point is goes wrong....
I can no longer ping the outside IP address from an external location. It seems the outside interface does not send traffic back to the - outside interface (or at least that's where I think the problem lies). How do I force replies to the incomming VPN remote traffic from unknown IPs to go back out on the outside interface?
The only change I need to make to get everything working on the outside interface again is to make the Default Static route use the outside interface. Which puts all the internet traffic back on the original (outside) connection.
View 6 Replies
View Related
Jul 1, 2011
I need to know how to setup my ASA with dual wan links. 1 is 10/10 fiber, other will be a 50/5 Cable Wideband link. The 10/10 fiber is currnetly being used for VPN's and Internet, (about 20 point to point IPSEC vpn's currently).
I want to add the Wideband link and use the "Tunneled (Default gateway for VPN traffic)", feature for the current fiber link and the new Wideband link for any other internet traffice. I tried this however as soon as I set my fiber link to "Tunneled (Default gateway for VPN traffic), I lost all connectivity.
I also setup my "VPN" link with the "tunneled" option and my "INTERNET" link with a default route to the internet. This would only let me ping internet sites from the ASA device but not from client computers, also the VPN's would not come backup.
I have tried the sla setting with a DSL line for failover and that works good, i've since got rid of the DSL and want to utilize 2 wan links for different purposes/traffic.
ASA 5510, SSM-10 1GB RAM
ASA version 8.4(1)
ASDM Version 6.4(3)
Context Mode Single
FW Mode Routed
License Security Plus
View 5 Replies
View Related
Oct 10, 2012
I have a ASA 5510 at our corporate HQ that has one site to site VPN. I need to add 6 additional site to site VPN's to this ASA for our remote branches. How can I add them without affecting the existing site to site VPN? The 6 site to site VPN's will all have the same settings however these settings are different from the existing site to site that I already have set up. How can I set it up so the 6 additional VPN's use their own crypto map and all use the same settings?
View 1 Replies
View Related
Sep 14, 2011
I would like to route traffic that are coming in and going out to the same interface on ASA. I am using inside interface with security-level 100. In this URL, [URL], ASA is able to do that.
View 5 Replies
View Related
Nov 15, 2011
I have configured a remote access VPN on my Firewall ASA5510. Everything worked fine and I can successfully connect through the VPN. The problem is I cannot ping or connect to any of my internal network resources. I tried to add a new NAT route from outside to my internal servers using the defined pool but due to a new ASA version there are many changed I see in the NAT routes
View 37 Replies
View Related
Nov 14, 2011
I am having a strange requirement. actually I am not sure it is strange or not. I am having ASA5510 with 8.4 sw version. Currently one ISP is connected to it. It is working fine. We have some servers that are directly connected to internet using another ISP connection. These servers having public IP addresses configured on their LAN settings. I need to move these servers in to the DMZ zone.
When i connect it to the ASA's DMZ zone,servers will get internet through the first ISP that is already configured on ASA. But i need to NAT the DMZ servers with the IP address provided by the other ISP, which even not configured on ASA.
So what should i do? In short my requirement is
1) need to NAT the server with the IP address provided by another ISP
2) Also note that the default route is configured for the first ISP only in ASA
so Do i need to configure another default route? Do i need to make it with larger AD? So i do it will act as the secondary route only.
I need to make the ASA up and running for two ISP, and servers in the LAN should be able to NAT with the IPs of first ISP and ,the servers in the DMZ zone should be able to NAT with the public IP of the new ISP.
View 2 Replies
View Related
Oct 15, 2012
We have a ASA 5505 and a 5510, that we are using site to site.I need to traceroute from the 5505-5510.. From the outside interfaces.. Don't want to do this through the site-to-site.I have temporarily added a few acl on the outside interfaces.when i traceroute it only goes one hop.. Maybe thats the way it suppose to be? I need to know all the hops between the outside interfaces on the 5505 to the outside interface on the 5510.
View 12 Replies
View Related
Jul 31, 2012
I have an ASa 5510 and setup remote dial in users.
I wanted to use the windows 7 built in client and also the draytek site to site VPN options however when they connect VPN traffic will not work however when i use the cisco VPN client then everything works fine.
All the VPN's connect pretty quickly.In the syslog I a getting errors when i try and ping something: [code]
View 2 Replies
View Related
Apr 23, 2012
My setup has two firewalls to the internet, one is for all internal users who want to access the internet and the other is an ASA5510 acting as VPN terminaton to remote workers accessing using Anyconnect.
Each of the firewalls has a public interface on the same network (ex. 196.160.100.192/26).
We have a server with a public interface, and all traffic (internal and external) has to access via the public ip (again in the same network as above) and there are different profiles and access levels on that server depending if you are accessing from an internal IP or a public IP.
Well, when users are connected thrugh the VPN, although they have an internal IP address, as they are accessing the server on the public IP, the ASA sends the packets through its external interface (direct connected route) instead of sending it to the default internal gateway that is a "trusted" entry point on the server.
Any way to force the ASA to send that traffic to the internal default gateway instead of sending it to the external (direct connected) interface?
I have no access to the server (appliance under warranty) so I can't make any changes to it...
View 1 Replies
View Related
Jul 21, 2011
In the restructuration of my company network we install due ASA 5510 in failover for the management of internal network and DMZ. We configure the ASA in routed mode, we create the sub interface for server, client and dmz subnet and we connect the firewall ti the network. Everything works very good except the intervlan routin. If i try to send or receive a file in every protocol, ftp, http, smb o if i try to conne with rdp or vns to an host in a different vlan the connection goes very very slow. I particular a ftp connection between two host goes ti 15kb/s. I check all cable and port for some error on duplex ro speed, end all the uplink are 1gb and the single client connection 100Mb. I know that the main purpose of the ASA is not doing routing stuff but this behavior is very strange.
View 1 Replies
View Related
Sep 21, 2011
Is it possible to assign a static route to an interface and not globally on a ASA 5510 ver 8.3.
I have two links between my offices one for Data via a VPN and one for video traffic which is a secure connection with QOS end to end.
All interfaces are on the same security level of 100 except Outside which is 0.
Office 1 Interfaces ASA 5510
VLAN 1 vOffice1Data 10.40.1.0/24
VLAN 3 vOffice1Video 10.40.2.0/24
VLAN 5 vInterOffice 10.40.5.0/24 (QOS connection Between Offices)
[Code]....
At the moment if I try and access data from VLAN 1 to VLAN 4 it gets to the destination ok going through the static route and over the vInterOffice connection but the problem is VLAN 4 returning the traffic. This fails because there is no static route back to VLAN 1. If I create a static route from Office 2 to VLAN 1 then it will route all my data traffic over it as well.
View 2 Replies
View Related
May 15, 2013
I am trying to set up my ASA5510 the fail over of ISP when it can't ping three different IP. I create three different tracking to three different IP using sla monitor & track rtr. But when I do
route isp2 0 0 yy.yy.yy.yy 50
route isp1 0 0 xx.xx.xx.xx 31 track 1
route isp1 0 0 xx.xx.xx.xx 32 track 2
route isp1 0 0 xx.xx.xx.xx 33 track 3
the last route will replace the previous two and only the last route command takes effect.Is there anyway I can set up the fail over to ISP2 only when it can't ping three different IP from ISP1?
View 1 Replies
View Related
Nov 13, 2012
Firewall: ASA 5510
Switch: Linksys SRW2048
Physical topology: PC - > VLAN99 - > SRW2048 - trunk - > ASA5510
Switch Setup:
I've been tasked with breaking up a network that has run out of IP's, and have decided to use VLANs to accomplish this. I have to use an ASA5510 to accomplish all the routing between hosts in different VLANs.Port 48 is trunked to the ASA eth0/0 interface, with VLAN 99 and VLAN 20 tagging packets, VLAN 1 Untagged. Hosts hooked up to appropriate ports on Switch.
View 2 Replies
View Related
May 28, 2012
I am a complete newbie to Cisco equipment. So far I've been able to figure out how to do most of what I needed by using the ASDM but I have run into something that is a little more complicated that just opening a port. We currently have a connection to our remote site. This site has a T1 internet connection. Our connection is a site to site VPN with an ASA-5510 on this end and a ASA-5505 on the other.
We are upgrading this connection to a 75mbit hybrid microwave/fiber link. The provider is going to hand it off to us as an untagged VLAN. We made the decision to route all of the remote site's internet access through this location as to avoid having to split off part of the bandwidth of this link to dedicate to internet access.........
View 23 Replies
View Related
Mar 11, 2012
We are deploying a new office in the building next to our main office. The main office has a Cisco ASA 5510 behind that is a Cisco 3750 stack. In the new office we are deploying a new Cisco 3750, they will be connected via fiber cable. I have sliced off VLAN 800 as a transit link /30 with an address space of 10.249.249.1-4. The new 3750 only has two VLAN's 800 and 112 (10.112.0.0/24). VLAN 112 routes are advertised to the neighboring 3750 properly as seen in the routing tables of the 3750 stack:
D 10.112.0.0/24 [90/3072] via 10.249.249.2, 00:22:24, Vlan800
Traffic passes between all local VLANS with no issue. I found in order to get packets to pass between the ASA and the new 3750 I had to add a static route to the ASA:
S 10.112.0.0 255.255.255.0 [1/0] via 10.100.0.1, inside
My question is why is EIGRP not advertising the 10.112.0.0 network to the ASA. Here are EIGRP configs on the switches
Existing 3750 Stack
router eigrp 100
network 10.0.0.0
redistribute static
[code]....
View 9 Replies
View Related
Mar 3, 2013
I recently added a business cable modem to relieve some of the congestion I was getting on my T1 for our MPLS network. There was an ASA 5510 collecting dust in a closet here and I thought it would be the perfect device for firewalling the traffic coming in from the Cable modem, and handling the routing of our internal MPLS traffic as well. Internet setup was cake. The test laptop I have using the ASA as it's gateway has great internet service but it cannot ping across either of our MPLS networks. I have one MPLS with AT&T and one MPLS with EarthLink. My hope was to use the cable modem as the Default route for all unspecified internet traffic and route our internal MPLS traffic to the cisco 2800 routers that are currently in place for the MPLS. I can ping across the MPLS when I telnet to the ASA, but I cannot ping across the MPLS from the client that is connected to the ASA.
Here's the topology I'm working with
Internet
|
Cable Modem
|
ASA 5510 10.52.120.23
[Code].....
View 8 Replies
View Related
Jul 24, 2012
how to configure a backup route to the internet. My client has 2 ISP and basically they want to use 1 ISP and in case the ISP fails, use the other one as backup route to the internet.
The problem I’m facing is that each ISP is plugged to a dedicated ASA 5510, so 1 ISP in one firewall and 1 in the other. Both ASA are plugged to an internal network in a dedicated VLAN with a L3 switch and that L3 switch manages the internal network.
My question is, how can I tell my switch to use ASA1 to go out to the internet and in case the ASA 1 OR THE LINK TO INTERNET used by ASA 1 fails, use ASA 2? It would be great if I can send traffic to the internet thru both connections at the same time. Also, I know the ASA has High Availability configuration, but that applies only if both licenses in the devices are the same and I have a mismatch with the SVPN license, and also I don't know if with my current topology I can use the High Availability model, so I think I can’t use that option and the solution must be applied in the L3 switch, but I don’t know how to tell it to use ASA1 and if failure of the device or the outside interface plugged to ISP 1, then use ASA2. Besides, I would like to know how to optimize this config to do the switch between internet connections seamless to the users if possible (there are VoIP calls on this floor, so I don't want to drop the calls).
View 5 Replies
View Related
Aug 12, 2012
I am having touble with a NAT concept. What I have is a 3rd party software VPN product that basically tunnels encapsulated traffic to/from a server sitting inside the network. Right now this traffic utiluizes a physical interface on the ASA5510, but I need the interface for another project.
What I have is this:
Internet<----->ASA<-->router<-->4507(layer3)
| |
| |-Vlan1
[Code]......
View 1 Replies
View Related
Feb 1, 2013
I am putting an pre-labbed DMVPN Hub config onto a production 1841. We had to upgrade the IOS to support protection with NAT so the current IOS we're running is c1841-adventerprisek9-mz.124-25g.bin.I can paste the configuration in fine (via the tunnel interfaces) and the router accepts it however the 'show dmvpn', 'debug dmvpn' and other related commands don't work. I have checked the IOS feature navigator and it definitely shows that DMVPN phase 1 and 2 are supported in this image.
View 5 Replies
View Related
Feb 1, 2012
Actually I have to make a VPN between an 5520 ASA and a Cisco 887VA-K9 Router. Connected to ASA I have the outside interface, the inside-DMZ interface, the PCs interface and the VoIP interface. In the other site I will need to have a new subnet and a VoIP phone which I need to connect to the VoIP subnet in the other side in order to work with our CCM servers.I need two VPN established between ASA and 887 Router?
View 15 Replies
View Related
Oct 24, 2011
I have a pair of 5505s with an IPsec VPN between them. On the first 5505, I also have a user connecting to it via client based vpn. The user cannot access systems on the other side of the ipsec tunnel. That 5505 protects subnet a.b.c.d, the user is on subnet a.b.e.d which is not inclusive to a.b.c.d. First, am I correct in the assumption that I need to add the vpn network of a.b.e.d to the list of protected networks, and second if I change the list, does it drop and reset the ipsec vpn?
View 2 Replies
View Related
Aug 16, 2011
How much the CPU is impacted by SSL VPNs on Cisco ASA 5500's?I believe that the ASA offloads a lot of its encryption/decryption on a built in VPN accelerator rather than placing load on the main CPU. Is this correct?
According to the ASA 5520 specs - it can handle a throughput of up to 225Mbps of VPN traffic. Of course, it does not say whether this is SSL or IPSEC but I would like to understand what impact say 100Mbps of SSL VPN traffic would have on the main CPU.
We need this information to gauge whether an existing firewall has enough capacity to cope with existing load plus additional new SSL VPNs.
View 1 Replies
View Related
Mar 24, 2013
I've got a setup where we have a wireless connection coming in and using mikrotik router. We have multiple stores coming in via the wireless with a dmvpn.
The vpn's terminate on the cisco c870 and can be seen when running: show dmvpn.The cisco has a default route to the fibre router (10.0.0.252). The wireless router is the default gateway for the network. The failover from wireless to adsl fails. (due to the cisco routing traffic back to the wireless router when wireless fails)
If I change the default route on the cisco to dialer1, the failover works, but none of the vpn's connect. The Branches all have dynamic ip addresses. The HO has a static ip.
My goal: I want to achieve adsl failover for when the wireless goes down and still have the vpn's connected.
Can I have some sort of "Dynamic" route on the cisco. So when the vpn traffic comes in via wireless and hits the cisco, the vpn traffic can then go back out that way via the wireless router, but still have a default gateway on the dialer interface for failover?
View 1 Replies
View Related
Feb 20, 2013
how many VPNS are configure in this device
the o/p:
sh vpn-sessiondb
Active Session Summary
Sessions:
Active : Cumulative : Peak Concurrent : Inactive
SSL VPN : 0 : 0 : 0
Clientless only : 0 : 0 : 0
With client : 0 : 0 : 0 : 0
Email Proxy : 0 : 0 : 0
[code]...
View 1 Replies
View Related
May 20, 2011
I have a Cisco 877 ADSL router which won't let me play with my VPNs like I used to in pre-Cisco days.I have a VPN server which resides on the inside of the network which used to get it's L2TP as well as PPTP tunnels passed straight through the ADSL router. No problems there with the old router.Now I opened the relevant ports for both TCP and UDP on the 877, but VPN simply won't establish when trying to connect from the outside. Process of getting the 877 to stop wanting to take charge of things VPN and just pass them off to an inside server?
I need to VPN into my work from my laptop on the private side of the 877. This works fine until after authentication, then the VPN connection goes silent, no traffic going through. Works fine when for instance using my iphone hotspot to connect through from my laptop. It's only not working when the 877 is in the equation.
View 0 Replies
View Related
Jul 2, 2012
We have a corporate site with a Cisco ASA 5580 (8.1), a remote office with a Cisco ASA 5510 (8.2) with a L2L VPN to corporate. A vendor has a L2L VPN to the corporate ASA with access to the remote office across the VPNs (hairpinning). The corporate office accesses an application at the vendor on port 23. Everything is working with regards to the vendor accessing resources to the remote office and the corporate office accessing the application at the vendor. Our goal now is to restrict the vendor to port 23 from the corporate network and port 9100 to the remote office. On the corporate ASA I setup a VPN filter and applied to the vendor's L2L vpn but when I apply the filter (see below) all traffic stops to the vendor such as telnet.
View 6 Replies
View Related
Nov 28, 2011
I have both a Easy VPN server and a site-to-site VPN on the same outside interface of a 2911 router.
Currently, a Easy VPN client has no route int the router then out the site-to-site VPN to the remote site.
How can I create this route?
[code]...
View 1 Replies
View Related
Jun 6, 2011
So I have a server running Linux and am looking to add VPN functionality to my home network. I have OpenSSH running and it works great for tunneling and remote file transfers but doesn't quite get the job done.I would like to be able to map a network drive in Windows to my Linux box and understand a VPN could accomplish this, problem is I really don't know anything about Virtual Private Networking! I was hoping someone could explain to me the differences between SSH / VPNs and point me in the right direction towards configuring OpenVPN on my Linux box.
View 4 Replies
View Related
Mar 21, 2011
I've been reading this site for a while, and finally decided to post I'm really interested to see what everyones opinion on this is.My company currently uses what i would call traditional site to site VPN's using crypto maps, main site has a pair of ASA's in HA and remote sites use ISR's like 1801's.I've recently been playing in my lab with GRE tunnels using IPSec protection (note this is config from my labs, so ip's and key's are just randomly selected)
View 17 Replies
View Related
