Solved

Site to Site VPN - Cisco ASA - Multiple Subnets at Main Location

Posted on 2016-09-19
6
134 Views
Last Modified: 2016-09-20
End Goal:  I need the Remote Office to communicate with the Main Office on the Security Camera Subnet too.

Current Situation:  The Site to Site is functional as I can route traffic from the Remote Office and Main Office on the Local Production LAN but nothing from the Remote Site can route traffic to the Security Camera Network.

Main Office Setup:
  • Cisco ASA 5515
  • Local Production LAN 10.5.1.0/24
  • Security Camera Network 10.10.15.0/24

Remote Office Setup:
  • Meraki MX 64
  • Local Production LAN 10.5.2.0/24

Please see attached ASA config and Network Diagram.  I have trimmed the config down but if it's missing something you need to see then please let me know.

Thank You
Config_ASA.txt
Simple_Network_Daigram.jpg
0
Comment
Question by:Wes Fields
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41805477
Without having yet read the configuration, there are typically four areas that need configuration for this to all work:

1) the subnets must be appropriately reachable from the destination device either by being directly connected or routed further downstream.

2) the "nonat" statements as both ends of the VPN need to include any subnets that are "interesting"

3) the access list applied to the crypto map needs to list these same interesting subnets.

4) the access list applied to the crypto map should be an exact inverse match of the other end.
1
 
LVL 3

Author Comment

by:Wes Fields
ID: 41805484
I will be the first to admit that I am no well versed in ASA land.  I have just enough knowledge to do some basic setup, configuration, and troubleshooting but the issue has just went above my head.  It doesn't help that obviously this ASA was configured prior to me taking over the company.

I am definitely going to use this as a learning experience if we can get this resolved.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41805511
That's no problem.  We all have different areas of expertise.

If you would be do a:

sh run crypto
sh run nat detail
sh access-list <acl of cryptomap to warehoue>

send it to my EE inbox.  we can work it out and i'll post an explanation of the fix without compromising network detail.
0
Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

 
LVL 57

Expert Comment

by:Pete Long
ID: 41806443
I read this this morning, and its made me write this up..

Cisco ASA – Adding New Networks to Existing VPNs

Pete
0
 
LVL 28

Accepted Solution

by:
Jan Springer earned 500 total points
ID: 41807085
We corrected a static NAT statement that referenced the proper nameif interface, inserted it in the proper order and permitted ICMP on that interface.
0
 
LVL 3

Author Closing Comment

by:Wes Fields
ID: 41807174
Thank you for all the help!
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ARP not working as expected 11 68
Force a WIFI client onto a specific access point 7 91
Site to Site VPN DNS issue 6 30
X.509 Cert Upload to Cisco WAP 6 47
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question