Solved

Rerouting of VPN Traffic

Posted on 2014-01-23
6
424 Views
Last Modified: 2014-01-23
Have a bizarre request:

2 Sites are connected via VPN Tunnel. Site 2 has a private circuit for internal users. Traffic from internal users in Site 2 goes from inside to private line and gets PATed there. The request is:
Users in Site 1 to be able to access the private circuit in Site 2 via the VPN Tunnel. Configuration has been done so that if Users in Site 1 initiate traffic to the Private Line Subnets, this traffic goes via the VPN Tunnel and reaches Site 2 (outside interface where it gets terminated). Issue is that after VPN traffic reaches Site 2, it doesn't go via the Private Line interface or to be precise, it gets routed but is dropped due to "no translation found for source outside destination private line."
Have tried all sorts of NAT, PAT and Static translations with no success. Was able to make it work...but all internal traffic to the outside stopped working :-) This was done through "nat (outside) 10 Site1UsersSubnet outside"
Any suggestions will be appreciated. ASA is 5505 with 8.3 IOS and nat-control enabled.
0
Comment
Question by:Strinalena
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39804510
First of all I would suggest updating to the 9.1 branch. NAT is so much more evolved in that release.

Secondly what you want can be done easily. When the traffic reaches the private line, is there a requirement that the source address is from Site1 or is it ok if the source address is the inside interface IP of the ASA at site 2?
0
 

Author Comment

by:Strinalena
ID: 39804539
Thanks for the quick response! Can certainly raise the question about the upgrade with Management but doubt that they will accept as all else is working :-)
No requirement for the source address, as long as Users in Site1 are able to get to the Private Line subnets, all is fine. At the moment, users in Site 2 go via inside - private and configuration is:
nat (inside) 10 0.0.0.0 0.0.0.0
global (private) 10 10.37.237.252
0
 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39804566

1

Make sure that the private LAN network segment is sent over the VPN by adding it in the crypto map

2

Create a NAT statement on the site 2 ASA:
nat (outside,inside) source dynamic SITE1-NETWORK interface destination static PRIVATE-LAN-NETWORK PRIVATE-LAN-NETWORK

3

Add a route to the PRIVATE-LAN-NETWORK
route inside PRIVATE-LAN-NETWORK SUBNETMASK ROUTERIP
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:Strinalena
ID: 39804585
Apologies - have made a mistake - just checked and the ASA in Site 1 Is 5505 but there is a PIX in site 2 - 515E - IOS 6.1. Do you think this will be possible?
0
 
LVL 12

Accepted Solution

by:
Henk van Achterberg earned 500 total points
ID: 39804607
I don't know if that is possible with a PIX515E. It will work with a 5505.
0
 

Author Comment

by:Strinalena
ID: 39804626
Thanks - I have tried so many things an couldn't make it work. Will just ask the company to get new ASAs for this site. Sorry again for the false information and thanks for your help!
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
connect to cisco 2690 series 6 76
Reconfigure Corporate IP Address Scheme 2 63
Setting up two DCs 4 47
PCI report results 1 17
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question