Link to home
Start Free TrialLog in
Avatar of shanehooton
shanehooton

asked on

IPsec Branch Offices

We have recently moved most of our company Branch offices to local ISPs from leased lines. The sites have either 2811 or 1941 routers terminating the IPsec connection on the branch end, and our HQ end with ASA 5510s.

The Sites that have been moved to the VPN solutions cannot see or talk to other VPN sites.

ie. Someone in Site A cannot connect to the computers in Site B. but from the HQ side, anyone can see all branch sites. and all branch sites can communicate with the HQ side.

These are site-to-site VPN connections. Does anyone have any thoughts as to how we could make the different branch offices talk to each other.

I know that moving to a DMVPN solution would solve this problem, however that is not a possibility at this time. I'm hoping there is another work around for what we currently have in place.
Avatar of akhalighi
akhalighi
Flag of Canada image

This needs to be done through your 5510  in main branch ,you can setup routing to accomplish this. it's easy .

we have a similar setup and all branches can talk to each other but traffic goes through main branch as the central point .
Avatar of rauenpc
akhalighi is right that this can be done on the 5510. My guess would be that you are missing branch sites in your crypto maps, nonat statements, same-security permit, or a combination. It would be helpful to post the config of your HQ and at least 2 branches.

Good example:
http://popravak.wordpress.com/2011/11/02/cisco-asa-spoke-to-spoke-ipsec-vpn/
ASKER CERTIFIED SOLUTION
Avatar of Sandeep Gupta
Sandeep Gupta
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial