Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Site to Site VPN Tunnel ASA 5505 with 2 VLANs

Posted on 2013-01-24
4
Medium Priority
?
819 Views
Last Modified: 2014-10-21
I have 2 Cisco ASA 5505 appliances.  1 has a security plus license and the other is the base license.  I need to connect a remote office using a VPN site-to-site tunnel.

At the main site I have Cisco switches setup on 2 VLANs.  VLAN20 for 192.168.2.0 network and VLAN10 used for an ESI IP Phone system that uses UDP/TCP ports 59101 and 59002.  The phone controller is at the main site with an IP of 192.168.1.50.  At the main site I'm wanting to use the sec plus license to allow both VLANs to connect to the internet and certain traffic into both VLANs as well, but I don't need interVLAN traffic.

At the remote site I'm planning on using a 192.168.3.0 network with 2 VLANs (10 & 20 as well).  There will be a couple IP phones connected to VLAN20.  I want their VLAN 10 internet traffic to go out through their respective WAN connection, but the IP phones to only connect to the main site through the VPN tunnel. If possible, I would also like for the remote site to be able to communicate with the main site at 192.168.2.0 network through the VPN tunnel.  I was planning on using the ASA 5505 base license at the remote site, but I may need to purchase a sec plus license for it as well to make this work.

I'm needing some help configuring both ends to make this all work.  I haven't configured either device yet,  and thought it would be a good idea to have an "expert" involved at this point.  I'm needing to know:

1) Will this work?
2) Is a security plus license required on both ends?
3) Given that it will work and that I have the correct equipment, can you provide me with some configuration guidelines for this scenario to get me started?
0
Comment
Question by:choelt
4 Comments
 
LVL 10

Accepted Solution

by:
rscottvan earned 800 total points
ID: 38815545
1.  Yes

2.  You will need Security Plus to have multiple internal VLANs, as well as if you have more than 10 client PCs inside the firewall.

3.  Start with the Site to Site VPN wizard in the web interface - you will probably be able to get it going using that.

Post specific questions and I'll try to answer them.
0
 
LVL 12

Assisted Solution

by:Henk van Achterberg
Henk van Achterberg earned 800 total points
ID: 38816004
The ASA 5505 base license has a DMZ Restricted feature which means you can have three networks of which one can not communicate with another.

So for example:

vlan 1: outside (WAN)
vlan 2: inside (LAN)
vlan 3: dmz (VOIP) (restricted to forward traffic to vlan 2)

In this setup you do not need a sec. plus license. Although if you want to use one cable with dot1q (with multiple vlans) you do need a sec. plus license.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question