Solved

Cisco ASA IPSec VPN - Is port forwarding needed?

Posted on 2014-12-17
1
232 Views
Last Modified: 2014-12-19
I have a Cisco ASA 5525 which serves only to provide IPSec VPN services to an outside business client.  There is one tunnel and all traffic is allowed.  The external interface of the ASA has a private IP address on it.  We have a router connected to the ISP that NAT's it's public IP to the ASA's external interface.  So the firewall's external interface appears as this ISP public IP.

The client needs to access hardware devices on the ASA's internal interface (192.168.97.0/24).  These hardware devices listen on port 5015.  The client cannot connect to the devices using the 192.168.97.x addresses across the VPN tunnel.  Do I need to do some sort of port forwarding (NAT) from the external ISP address to the ASA's internal network?  Shouldn't the client be able to see the hardware devices on the ASA's internal interface and access them via their private IP addresses? (We can access their servers across the VPN going the other way even though they have 10.x.x.x addresses)

Hopefully I'm not making this sound more complicated than it is.  Please feel free to ask clarifying questions.

I really need to solve this problem ASAP so thanks in advance for your assistance!!
0
Comment
Question by:CipherUser
1 Comment
 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
ID: 40506679
NAT and routing are set up correctly, otherwise traffic would not flow at all. At least if the tunnel is up, no matter which partner starts communication.
It looks like one or both of the firewall/VPN devices blocks traffic initiated by your business client.
For Windows clients with active Windows Firewall,  you'll need to allow the remote network addresses too.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Asa 5520 Configuration 3 69
sonicwall NSA exchange online logs 2 25
Turn off SIP ALG - Cisco ASA 5505 1 24
Website Issue 10 56
Optimal Xbox 360 connectivity requires "OPEN NAT". If you use Juniper Netscreen or SSG firewall products in a home setting, the following steps will allow you get rid of the dreaded warning screen below and achieve the best online gaming environment…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
A short film showing how OnPage and Connectwise integration works.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now