Solved

Cisco ASA IPSec VPN - Is port forwarding needed?

Posted on 2014-12-17
1
243 Views
Last Modified: 2014-12-19
I have a Cisco ASA 5525 which serves only to provide IPSec VPN services to an outside business client.  There is one tunnel and all traffic is allowed.  The external interface of the ASA has a private IP address on it.  We have a router connected to the ISP that NAT's it's public IP to the ASA's external interface.  So the firewall's external interface appears as this ISP public IP.

The client needs to access hardware devices on the ASA's internal interface (192.168.97.0/24).  These hardware devices listen on port 5015.  The client cannot connect to the devices using the 192.168.97.x addresses across the VPN tunnel.  Do I need to do some sort of port forwarding (NAT) from the external ISP address to the ASA's internal network?  Shouldn't the client be able to see the hardware devices on the ASA's internal interface and access them via their private IP addresses? (We can access their servers across the VPN going the other way even though they have 10.x.x.x addresses)

Hopefully I'm not making this sound more complicated than it is.  Please feel free to ask clarifying questions.

I really need to solve this problem ASAP so thanks in advance for your assistance!!
0
Comment
Question by:CipherUser
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 70

Accepted Solution

by:
Qlemo earned 500 total points
ID: 40506679
NAT and routing are set up correctly, otherwise traffic would not flow at all. At least if the tunnel is up, no matter which partner starts communication.
It looks like one or both of the firewall/VPN devices blocks traffic initiated by your business client.
For Windows clients with active Windows Firewall,  you'll need to allow the remote network addresses too.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
A 2007 NCSA Cyber Security survey revealed that a mere 4% of the population has a full understanding of firewalls. As business owner, you should be part of that 4% that has a full understanding.
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question