Solved

Installing pfsense after cisco ASA for VPN only

Posted on 2014-04-01
3
1,459 Views
Last Modified: 2014-04-07
As the title suggests, I'm thinking about adding VPN capability to my site, for IT use only.  I want to stay away from the expensive Cisco vpn licenses and complicated setup.  This is only as a test right now.. But I'm wanting to know how difficult it'd be to configure a box running PfSense and place it inside the network and fwd ipsec VPN requests to it.

has anyone done this before or experienced enough to tell me if this will work and if not why?

Thanks
0
Comment
Question by:Ben Hart
3 Comments
 
LVL 17

Expert Comment

by:TimotiSt
ID: 39969948
Routing might be an issue, if the pfSense box is on the same subnet as the computers to be accessed, if you're thinking IPSec.
A bridged openvpn solution might be easier, with more features (remote wake-on-lan, ARP checks, etc.), but it'll be slightly lower bandwidth.
Doesn't the ASA provide a limited number of VPN connections by default?
0
 
LVL 14

Author Comment

by:Ben Hart
ID: 39969973
I believe the ASA as its configured right now is limited in vpn connections. Honestly though I am looking at this for myself only. Our main site is where all current vpn connections terminate. In the event of downtime as we had two days ago with a large ATT fiber being cut, I had no remote access to my site whose internet access was not affected.
0
 
LVL 1

Accepted Solution

by:
Marty Block earned 500 total points
ID: 39970096
This should be fairly easy . PFSense has a vpn wizard.. Assume that your cisco firewall will allow you to pass a public ip through the firewall to just one physical port on the ASA firewall. I suggest this because if you do a NAT you may have trouble with the VPN connection because of the actual IP (that is public) for vpn connection will not be the 'real' ip on the public side of the PF sense firewall. In this case you may find it necessary to use the public ip on the pf sense in place of the translated NAT ip.. in any event the pfsense wizard will take you through the process of creating the rules and the bridg-able ip space you need for the connection, and I think there is a separate wizard to create the self signed certs you need for the process.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco Maximum Prefixes Allowed for Customer 5 33
ip igmp join-group 8 43
TL-R470T+ and Cisco ASA 2 21
Layer 3 switch recommendation 15 13
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question