Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1086
  • Last Modified:

Cisco VPN with Anyconnect - What outside IP address to use?

Ok, this may seem like a silly connection but here goes.

I have a Site-to-site vpn set up between two of our offices.  The main and a branch.  For this site to site vpn I'm using our 'public' IP address that all the workstations get when they access the internet, (we use NAT).  The site-to-site works fine.

We also want to set up an anyconnect VPN.  It works internally using 192.168.1.1.  I thought I could use one of our 5 external IP's (e.g. 70.x.x.19).  Is this the correct way of doing this?  I'm basically am confused on what IP address I shoud be using.  We have 5 address, 4 are used already for email server, web server and two other servers.

Any help would be appreciated!
0
Jesh1975
Asked:
Jesh1975
  • 4
  • 3
1 Solution
 
Henk van AchterbergSr. Technical ConsultantCommented:
You should use the "interface IP address" for anyconnect. You cannot use another IP address for terminating anyconnect on it.

If you have for example the outside interface with ip 2.2.2.2/29 then you cannot use 2.2.2.3 for anyconnect, you have to use 2.2.2.2.
0
 
Jesh1975Author Commented:
Ok.  That is what I thought, but the problem is the outside IP is 10.1.10.200, which connects to our comcast business modem.

Inside 192.168.1.1/24
Outside 10.1.10.200/24
Then the cable modem is our public 70.xx.xx.xx.  

So I'm not sure what we are supposed to do here?
0
 
Henk van AchterbergSr. Technical ConsultantCommented:
You say that you have several public IP's but your ASA has a private IP address? Why is that?
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
Jesh1975Author Commented:
Our setup is:

Inside->Firewall->Cable modem so all traffic hits the cable modem first, then is routed to the firewall, which has always been like this for this company.  I don't think we can make the cable modem 'transparent'.

Any ideas??
0
 
Henk van AchterbergSr. Technical ConsultantCommented:
well if that is the case you should look at the cable modem if you can NAT all ports to one inside IP address (10.1.10.200). If that is not the case you should MAP port by port. At least HTTPS, 443, to 10.1.10.200.

You should use the external 70.x.x.x IP for your clients to connect.
0
 
Jesh1975Author Commented:
Thank you this worked.  I still don't understand why my other public IP addresses (e.g. email, web server and so on) are working correctly.  They all work and do not have one to one mapping or anything.

Anyhow, I mapped our sslvpn.xxxx.com address to 10.1.10.200 (ASA "outside") and it worked!  Next on the list is getting VPN clients to be able to access the 192.168.1.0/24 network (the inside).

Thanks again for your help!
0
 
Jesh1975Author Commented:
Update: This ended up breaking our site-to-site VPN.  I forgot to update the comments on this.  I'm going to need to reopen this question...
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now