Connect two sites using Cisco ASA via a MPLS connection
Posted on 2011-10-05
Currently we have client that is expanding their business to an additional building. They have decided to use an MPLS to interconnect the two buildings, allowing the remote site to use the main site's resources and communicate in between each other effectively via voice and data communications.
Windstream is providing the MPLS in between their two routing devices and then handing it off to our ASA 5500s. The network setup is Main LAN -> Switch - > Cisco ASA -> Windstream Router -> MPLS -> Windstream Router -> Cisco ASA -> Remote LAN. Currently each site handles its own internet connection. Both ASAs have two connections to the windstream device; one on the ASA's outside interface to a interface on the Windstream router designated for Internet traffic, and one connection to one of the ASA's inside-network switchports connecting to the interface on the Windstream router designated for traffic in between the two LANs.
I was able to get both networks to communicate with each other via pings by creating a static route on the ASAs to the inside network windstream router interface for each corresponding LAN. I then had to create a NAT exemption rule for inboud and outboud traffic on the ASA inside-network interface, as packet traces revealed that NAT was blocking communications. Once this was done I was able to communicate via pings in-between the sites, however I can't perform any other more complicated functions in between the LANs like RDP or accessing shares.
As a troubleshooting step I have already allowed all IP (even added TCP and UDP for good measure) traffic inbound and outbound from these LANs to occur, so I know it is not a firewall rule that is preventing it. I have also performed a packet trace using the 3389 RDP port in between the sites and it passes, even though actually performing the function does not. If any other information is needed to help us troubleshoot this issue, please let us know.