topic SITE 2 SITE VPN in Network Security

SITE 2 SITE VPN

saroj pradhan — Tue, 12 Mar 2019 00:59:15 GMT

Hi,

i have cisco ASA5510 Firewall and configured one site to VPN . i want to configure another s2s vpn in the FW for another Site location.

please advice what to in the existing Firewall so that 2 site to site vpn can work.

Thanks,

Saroj

SITE 2 SITE VPN

Julio Carvajal — Tue, 12 Feb 2013 05:15:58 GMT

Hello Saroj,

Pretty much you must configure another entry into the crypto map already configured pointing to the new peer, using a different CRYPTO-ACL ( including the traffic to be encrypted between the sites) also the transform set and the peer ip address as usual ( You already know how to do this as you already setup one)

Then finally configure a new tunnel group pointing to the other VPN endpoint ip address and specify the pre-shared key here as well,

Remember to configure the NO_Nat rules for the VPN traffic as well

Let me know if I was clear enough

Regards,

Julio

Security Trainer

SITE 2 SITE VPN

krishnanand.yadav — Tue, 12 Feb 2013 05:44:46 GMT

Hi Jcarvaja,

Q1. Is it possible to use same crypto map for second tunnel or there should be another Crypto Map policy? ( I mean crypto Map number or name)

Q2. Do i need to have two different local subnet for creating S2S VPN tunnels for two different sites or one local subnet can be used for both?

Q3. One No-NAT ststement will work for both or we need to create two NO-NAT statement for two tunnels.

I am little confused with this. Please bear with me if it sound silly question.

Regards,

Krish

SITE 2 SITE VPN

Anukalp S — Tue, 12 Feb 2013 13:48:38 GMT

Hello Krishan.

Ans 1 : Since you are configuring tunnel for another site location so it would be good to configure another cryptomap number & name. Cryptomap transform set "name" could be same.

Ans 2 : Subnets should be different otherwise managing routing could be massive for you.

Ans 3 : Since you use different subnets, you could make two access-list fo NO-NAT or configure it in one access-list with subnet mask which carry both subnetwork for both sites.

Pls rate if it is helpful.

SITE 2 SITE VPN

Julio Carvajal — Tue, 12 Feb 2013 15:49:12 GMT

Hello,

1) You can only have one crypto-map per interface so you must use the same one just that you will use a different entry for each tunnel and then specific parameter to each of those entries.

2) It is preferred to have different subnets but if you have the same then you would need to play with the NAT rules to allow the VPN to go up, so you can have them but it will require more work.

3) On the same NAT rule ( with the same ACL for the NO_NAT generate the required amount of entries to allow this VPN to go up,

Regards

Remember to rate all of the helpful posts

Julio