Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Cisco 5505 ASA Site to Site VPN question

Posted on 2014-10-09
7
Medium Priority
?
355 Views
Last Modified: 2014-10-22
Hi All...

I am preparing to configure a Site to Site VPN from our head office to a new remote location in the very near future. I am fretting about how our network is configured and if I'll run into problems.

Our Network it set up more or less as follows:

<--10.0.0.0/24 (LAN) (Linksys RVS4000 set to "Gateway") ---192.168.1.3(WAN)---> <---192.168.1.1(Cisco ASA 5505) ---Outside IP--->

When I set up the VPN, I need our remote location to be able to access the 10.0.0.0/24 network. Do I need to do any fancy configurations to get the Tunnel to cross the 192.168 network?
0
Comment
Question by:TORLYSIT
  • 3
  • 2
  • 2
7 Comments
 
LVL 1

Author Comment

by:TORLYSIT
ID: 40371594
Adding a simplistic vis. drawing of the network I'm speaking ofNetwork diagram
0
 
LVL 10

Expert Comment

by:Schuyler Dorsey
ID: 40375204
I'm sort of confused here...

Are are Linksys gateway and Cisco ASA separated across the internet? (I assume so by your saying a new remote site). But your diagram is confusing to me.

Just curious.. why do you have a Cisco RVS at 192.168.1.3 then going to the ASA at 192.168.1.1? I'm not quite sure what your WAN segment is accomplishing year. I often see a l3 switch or a router with a /30 between itself and the firewall for security reasons but unsure on your setup.

But.. a standard site to site vpn shouldn't be an issue regardless.
0
 
LVL 1

Author Comment

by:TORLYSIT
ID: 40379891
The ASA and the RVS4000 are at the same site (This was built before I was hired to admin it.)

Instead of creating a Port based DMZ, one of my predecessors installed an RVS4000 in Gateway mode with IP ACLs limiting traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network (All local traffic) sitting behind a Cisco ASA 5505 that terminates at our ISP Router.

I'm currently working on an initiative to find out if I can untangle it without impact but have to set up the new site in a short bit. Hence my question about site to site in our current environment.
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
LVL 10

Expert Comment

by:Schuyler Dorsey
ID: 40385290
There shouldn't be an issue setting up the site to site even in the current setup.
0
 
LVL 29

Accepted Solution

by:
Alan Huseyin Kayahan earned 2000 total points
ID: 40396014
RVS4000 in Gateway mode with IP ACLs limiting traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network

Make sure you put an permit ACE in RVS400 allowing traffic sourced from the local network of Beli networks destined to 10.0.0.0/24.

Second, make sure that RVS4000 is not doing any type of NAT between 10.0.0.0/24 and 192.168.1.0/24

Finally make sure that the local side of the interesting traffic ACL in ASA is 10.0.0.0/24 and not 192.168.1.0/24

Doublecheck if RSV4000 has either a default route or manual route regarding Beli Networks' local subnet to 192.168.1.1. Also ASA has a route to 192.168.1.3 for 10.0.0.0/24

As an advice, in case you need to go for restructuring your network, never use the factory default subnets of many vendors such as 192.168.1.0 or 10.0.0.0. It would cause you headaches if by any chance the remote end of the VPN is using the same subnet.
0
 
LVL 1

Author Comment

by:TORLYSIT
ID: 40397635
Thank you MrHusky.

The subnets were definitely not my choice as I inherited the whole thing when I started here.

Thanks for all the information!
0
 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 40398203
You are welcome!
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
Suggested Courses

877 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question