Solved

Cisco ASA Crypto Maps and NAT Rules for Site to Site VPN with Network Objects

Posted on 2014-04-25
3
840 Views
Last Modified: 2014-06-10
Hi all,

I have a site to site VPN with necessary Crypto Maps and Before NAT rules.  I have no control over my affiliates ASA but would like to make some changes on my end.

Have Crypto Maps and NAT rules for the following hosts on the other end.

10.0.0.3
10.0.3.105
10.0.3.107

These 3 hosts talk to many of the subnets and hosts on my end.  I would like to group those 3  hosts into a network object group and redo my NAT and Crypto Maps to reference the new group.  This would really cut down the length of my Crypto Map and Nat lists.

If I create the object group on my end, will my affiliate need to create the same group on his end as well as redo his NAT and Crypto Maps to match mine?  Or will we be OK being that there would still be NAT and Crypto Maps to mach each individual host on his end?

Running 8.4.1 on my ASA.
0
Comment
Question by:ckangas7
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 10

Assisted Solution

by:Schuyler Dorsey
Schuyler Dorsey earned 250 total points
ID: 40023889
Grouping your items into objects and object groups does NOT affect the other end of the tunnel; i.e. they do not have to put theirs in object groups as well.
0
 
LVL 57

Accepted Solution

by:
Pete Long earned 250 total points
ID: 40024551
Agreed, as long at the IP addresses don't change, you just need to alter the ACL that's declaring your 'Interesting traffic' (traffic to be encrypted)

Then you will need to change the nat rules accordingly. there will be no requirement to change the other end, just warn them that the tunnel will drop while you carry out the work.

PL
0
 

Author Comment

by:ckangas7
ID: 40027603
Very good,

So I can put 10.0.0.3, 10.0.3.105, 10.0.3.107 into one network  group object and modify my NAT and Crypro maps to use the new object.  Can then delete all the old individual rules.

Two final questions. My affiliate is running an older version IOS on their ASA (8.1 something).  Being they are using the older NAT structure, will that have any effect in my scenario?

Also, can I NAT, and Crypto protect network object group to network object group?  I would like to group some servers on my side and allow them to talk to the server group on their side.  So I would be doing many to many translations instead of one to many.  Being that all the traffic is going accross the tunnel and nothing is really being translated, I don't think that would be a problem.  Am I correct?
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco IOS upgrade c3560_backup and deletion of drwx 7 89
Moving vSAN traffic to a new network 4 110
SSL-VPN 1 91
Cisco WLC certificate question 4 16
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question