Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 550
  • Last Modified:

Site to Site VPN - Cisco ASA - Multiple Subnets at Main Location

End Goal:  I need the Remote Office to communicate with the Main Office on the Security Camera Subnet too.

Current Situation:  The Site to Site is functional as I can route traffic from the Remote Office and Main Office on the Local Production LAN but nothing from the Remote Site can route traffic to the Security Camera Network.

Main Office Setup:
  • Cisco ASA 5515
  • Local Production LAN 10.5.1.0/24
  • Security Camera Network 10.10.15.0/24

Remote Office Setup:
  • Meraki MX 64
  • Local Production LAN 10.5.2.0/24

Please see attached ASA config and Network Diagram.  I have trimmed the config down but if it's missing something you need to see then please let me know.

Thank You
Config_ASA.txt
Simple_Network_Daigram.jpg
0
Wes Fields
Asked:
Wes Fields
  • 3
  • 2
1 Solution
 
Jan SpringerCommented:
Without having yet read the configuration, there are typically four areas that need configuration for this to all work:

1) the subnets must be appropriately reachable from the destination device either by being directly connected or routed further downstream.

2) the "nonat" statements as both ends of the VPN need to include any subnets that are "interesting"

3) the access list applied to the crypto map needs to list these same interesting subnets.

4) the access list applied to the crypto map should be an exact inverse match of the other end.
1
 
Wes FieldsAuthor Commented:
I will be the first to admit that I am no well versed in ASA land.  I have just enough knowledge to do some basic setup, configuration, and troubleshooting but the issue has just went above my head.  It doesn't help that obviously this ASA was configured prior to me taking over the company.

I am definitely going to use this as a learning experience if we can get this resolved.
0
 
Jan SpringerCommented:
That's no problem.  We all have different areas of expertise.

If you would be do a:

sh run crypto
sh run nat detail
sh access-list <acl of cryptomap to warehoue>

send it to my EE inbox.  we can work it out and i'll post an explanation of the fix without compromising network detail.
0
Turn Raw Data into a Real Career

There’s a growing demand for qualified analysts who can make sense of Big Data. With an MS in Data Analytics, you can become the data mining, management, mapping, and munging expert that today’s leading corporations desperately need.

 
Pete LongTechnical ConsultantCommented:
I read this this morning, and its made me write this up..

Cisco ASA – Adding New Networks to Existing VPNs

Pete
0
 
Jan SpringerCommented:
We corrected a static NAT statement that referenced the proper nameif interface, inserted it in the proper order and permitted ICMP on that interface.
0
 
Wes FieldsAuthor Commented:
Thank you for all the help!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now