Solved

Site to Site VPN Tunnel ASA 5505 with 2 VLANs

Posted on 2013-01-24
4
677 Views
Last Modified: 2014-10-21
I have 2 Cisco ASA 5505 appliances.  1 has a security plus license and the other is the base license.  I need to connect a remote office using a VPN site-to-site tunnel.

At the main site I have Cisco switches setup on 2 VLANs.  VLAN20 for 192.168.2.0 network and VLAN10 used for an ESI IP Phone system that uses UDP/TCP ports 59101 and 59002.  The phone controller is at the main site with an IP of 192.168.1.50.  At the main site I'm wanting to use the sec plus license to allow both VLANs to connect to the internet and certain traffic into both VLANs as well, but I don't need interVLAN traffic.

At the remote site I'm planning on using a 192.168.3.0 network with 2 VLANs (10 & 20 as well).  There will be a couple IP phones connected to VLAN20.  I want their VLAN 10 internet traffic to go out through their respective WAN connection, but the IP phones to only connect to the main site through the VPN tunnel. If possible, I would also like for the remote site to be able to communicate with the main site at 192.168.2.0 network through the VPN tunnel.  I was planning on using the ASA 5505 base license at the remote site, but I may need to purchase a sec plus license for it as well to make this work.

I'm needing some help configuring both ends to make this all work.  I haven't configured either device yet,  and thought it would be a good idea to have an "expert" involved at this point.  I'm needing to know:

1) Will this work?
2) Is a security plus license required on both ends?
3) Given that it will work and that I have the correct equipment, can you provide me with some configuration guidelines for this scenario to get me started?
0
Comment
Question by:choelt
4 Comments
 
LVL 10

Accepted Solution

by:
rscottvan earned 200 total points
ID: 38815545
1.  Yes

2.  You will need Security Plus to have multiple internal VLANs, as well as if you have more than 10 client PCs inside the firewall.

3.  Start with the Site to Site VPN wizard in the web interface - you will probably be able to get it going using that.

Post specific questions and I'll try to answer them.
0
 
LVL 12

Assisted Solution

by:Henk van Achterberg
Henk van Achterberg earned 200 total points
ID: 38816004
The ASA 5505 base license has a DMZ Restricted feature which means you can have three networks of which one can not communicate with another.

So for example:

vlan 1: outside (WAN)
vlan 2: inside (LAN)
vlan 3: dmz (VOIP) (restricted to forward traffic to vlan 2)

In this setup you do not need a sec. plus license. Although if you want to use one cable with dot1q (with multiple vlans) you do need a sec. plus license.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Suggested Solutions

Like many others, when I created a Windows 2008 RRAS VPN server, I connected via PPTP, and still do, but there are problems that can arise from solely using PPTP.  One particular problem was that the CFO of the company used a Virgin Broadband Wirele…
For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now