topic Hi the link is too old. i in Network Security

ASA behind Router VPN

Sheraz.Salim — Tue, 12 Mar 2019 09:45:38 GMT

Hi here is the problem.

Router1 SITE1--------- INTERNET ---------SITE2 ASA------Router2.

wanted to setup a VPN site to site vpn between the ROUTER1 and ROUTER2. however as there is a ASA between. is it possible. do not want to configure a VPN on ASA but wanted to configure a vpn on Router2.

router1

crypto isakmp policy 1
encr aes 256
hash sha512
authentication pre-share
group 5
crypto isakmp key cisco12345 address 209.165.201.254
crypto ipsec transform-set VPN esp-aes esp-sha512-hmac
mode tunnel
crypto map VPN 1 ipsec-isakmp
set peer 209.165.201.254
set transform-set VPN
match address 100
crypto map VPN

show access-list
Extended IP access list 100
    20 permit udp any any eq non500-isakmp
    30 permit udp any any eq isakmp
    40 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

Router2

crypto isakmp policy 1
encr aes 256
hash sha512
authentication pre-share
group 5
crypto isakmp key cisco12345 address 209.165.200.1
crypto ipsec transform-set VPN esp-aes esp-sha512-hmac
mode tunnel
crypto map VPN 1 ipsec-isakmp
set peer 209.165.200.1
set transform-set VPN
match address 100
crypto map VPN

#show access-lists
Extended IP access list 100
    10 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    20 permit udp any any eq non500-isakmp
    30 permit udp any any eq isakmp

I gave a spare public ip to ROUTER2 what config do i have to make on firewall. what nat. policy nat please hlep

Hi,

Aditya Ganjoo — Mon, 31 Jul 2017 16:05:18 GMT

Hi,

Yes it is possible.

You need to make ASA as a VPN passthrough device.

You need to allow UDP 500,4500 and ESP traffic on the ASA for the two VPN peers.

Hi sherazrose,

Spooster IT Services — Tue, 01 Aug 2017 15:19:44 GMT

Hi sherazrose,

You need to configure one to one NAT for routers public IP and allow traffic from WAN to LAN for these ports and protocols. Let me know the router private IP to help you with the configuration.

hi what will be the nat

Sheraz.Salim — Tue, 01 Aug 2017 15:20:53 GMT

hi what will be the nat statment

nat (inside,outside) source static INTERNAL EXTERNAL

nat (inside,outside) static PUBLIC-IPADDRESS

Hi the link is too old. i

Sheraz.Salim — Tue, 01 Aug 2017 15:22:02 GMT

Hi the link is too old. i mean they running version 7. where at the moment 9.x. even the nat statement is different.

Configuration will be like

Spooster IT Services — Tue, 01 Aug 2017 15:31:03 GMT

Configuration will be like the following:-

object network ROUTER2
host <Private IP of router>
nat (inside,outside) static 209.165.201.254

object network ROUTER1
host 209.165.200.1

object-group service VPN-SERVICES udp
port-object eq isakmp
port-object eq 4500
!
access-list outside_access_in extended permit udp object ROUTER1 object ROUTER2 object-group VPN-SERVICES
access-list outside_access_in extended permit esp object ROUTER1 object ROUTER2

Hi Sherazrose,

Spooster IT Services — Tue, 01 Aug 2017 17:29:49 GMT

Hi Sherazrose,

See my comment above for sample configuration