topic Routing problem behind ASA VPN (lan2lan) ASA connection? in Network Security

Routing problem behind ASA VPN (lan2lan) ASA connection?

1pdemharter — Tue, 14 May 2019 15:35:54 GMT

Hi all,

I have an ASA L2L ASA connection (including VPN Dial-In on both ASAs) up and running. Additionally Internet connection works fine.

LAN 1----- ASA1 --------IPSec-VPN-L2L----- ASA2 ----- LAN 2.

All works fine.

Now I added a cisco 2960-x switch with an SVI Interface an 2 vlan to LAN 1.

VLAN 10-----SVI ------LAN1(VLAN1) ------ASA1-----IPSecVPN-----ASA2-----LAN2.

VLAN20------!

From VLAN 10, 20, 1 I can ping the Internet, but from VLAN 10,20 I can't reach LAN2 behind ASA2.

On ASA1 I extended my crypto-map ACL additionally to LAN1 with VLAN10,10 (Subnets) to allow it through the VPN Tunnel. Additionally I added to inside routes on ASA1 facing to the vlan10,20)

route inside 10.0.10.0 and 10.20.0 to VLAN1 interface Swicht-SVI-ASA1 transfer subnet. I think routing between switch and asa1 works because Internet access is ok. It seems to me that the source traffic doesn't enter the VPN-tunnel. Interesting. Ping from an host in vlan1-ASA1 through the VPN tunnel to LAN2 works?

Any ideas?

many thx

Peter

Re: Routing problem behind ASA VPN (lan2lan) ASA connection?

Seb Rupik — Tue, 14 May 2019 15:56:33 GMT

Hi there,

Have you added VLANs 10 and 20 to the NAT exemption rule on ASA1?

Can you share the running confg of ASA1 so we can confirm?

cheers,

Seb.

Re: Routing problem behind ASA VPN (lan2lan) ASA connection?

Netlabbuilder — Tue, 14 May 2019 17:00:26 GMT

Hello Peter,

When you want new IP ranges or subnets to be a part of existing VPN setup, you have to update these new ranges/subnets into all relevant configuration parts at both ends (object groups, crypto-map ACL, interface ACL, NAT, routing and so on...).

If it still does not work, please attach your configuration at both ends (in .txt files)

I hope it helps.

Re: Routing problem behind ASA VPN (lan2lan) ASA connection?

1pdemharter — Wed, 15 May 2019 08:03:34 GMT

Many thx! I will check it

Peter

Re: Routing problem behind ASA VPN (lan2lan) ASA connection?

1pdemharter — Wed, 15 May 2019 08:04:18 GMT

Hi,

many thx! I will check it.

Peter