ASA Remote Access VPN to two inside interfaces

Hello I a VPN inquiry. Here are the details:

ASA 5520 v8.3
“inside” interface (network 1, 172.16.0.x/24)
“inside2” interface (network 2, 192.168.0.x/24)

REMOTE ACCESS VPN
I have an IPsec remote access vpn setup to access the first network on the “inside” interface, but I cannot access the second network on the “inside2” interface. I am not sure if I can make a static route on the ASA or other config.

Question: Will the ASA allow me to setup one remote access VPN to two inside interfaces or do I have to have one connection profile per interface?

I am not sure, but I am guessing there are a couple of solutions. Any suggestions that can get me headed in the right direction will help.

Just a note, there are two separate networks and Windows Domain. Each ASA physical inside interface is connected to a core switch to each respective network. I need to be able to remotely manage each network.
ItSecureProAsked:
Who is Participating?
 
Gareth GudgerConnect With a Mentor Commented:
Hi ItSecurePro,

No, you would not need a route. The ASA is aware of every subnet directly connected to its interfaces.

Off the top of my head, you should only need to modify an ACL. You would have created an ACL for the VPN when you first set it up. If you need the name of the ACL associated with the VPN it is likely referenced as:

NAT (inside) 0 access-list <name of ACL>.

Look for NAT 0. Probably the first NAT statement.

Just add an extra line in that ACL that permits traffic from the INSIDE IP subnet to the INSIDE2 IP subnet.

ie. access-list <name of VPN ACL> extended permit ip 172.16.0.0 255.255.255.0 192.168.0.0 255.255.255.0

That should do it.
0
 
ItSecureProAuthor Commented:
Thank you! I will give this a try and report back.
0
 
ItSecureProAuthor Commented:
Thank you for leading towards the right direction. I had to add the other network (on the other inside interface) and fix my NAT rule for the vpn.

I created a ACL for my VPN IP Pool, then added an ACE for both network (172.16.0.x/24, and 192.168.0.x/24.

Next I added a any, any static NAT for traffic on both inside interfaces:

nat (any,any) source static any any destination static VPN-Hosts-Object VPN-Hosts-Object
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
Gareth GudgerCommented:
Glad you got it resolved! I just noticed you were on 8.3 as well. I was giving you instructions for 8.2 and earlier - Sorry!
0
 
ItSecureProAuthor Commented:
No problem. It is taking me a little time to get used to the changes for 8.3 and higher. The NAT commands are completely different now, but I got it down. Thanks.
0
 
Gareth GudgerCommented:
Yes.... they are very different.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.