topic Access ASA that is behind a vpn tunnel and other network devices in Network Security

Access ASA that is behind a vpn tunnel and other network devices from behind another asa connected to same vpn

kylebqmacs — Tue, 12 Mar 2019 00:04:10 GMT

have an issue with accessing other asa's and network equipment from behind an asa that is connected to the network i need to access via vpn. I have the asa able to access the network but for some reason am not able to. Anyone have a solution?

Access ASA that is behind a vpn tunnel and other network devices

Jennifer Halim — Thu, 04 Oct 2012 13:27:09 GMT

A network diagram and configuration from both ASA would help. Otherwise, we won't be able to tell why it's not working.

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 13:36:43 GMT

Below is my map. I am trying to get the two endpoint devies to communicate with each other as well as manage the main 5510 via asdm. I will try to post the config here in a bit.

Access ASA that is behind a vpn tunnel and other network devices

Jennifer Halim — Thu, 04 Oct 2012 13:51:53 GMT

How is the main 5510 connected?

Do you have site-to-site VPN between the 5505 and 5510?

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 13:52:44 GMT

Yes. It is ipsec site to site.

Access ASA that is behind a vpn tunnel and other network devices

Jennifer Halim — Thu, 04 Oct 2012 13:54:29 GMT

Do you mean the IPSec VPN is not UP at the moment?

What is the output of:

show cry isa sa

show cry ipsec sa

from both ASAs?

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 13:55:59 GMT

Yes the ipsec vpn is up. I am able to access some of my network resources. I just cant access the 5510 from the 5505 and cant access one 5505 from the other 5505. Do i need to have reverse route enabled on the tunnel group?

Access ASA that is behind a vpn tunnel and other network devices

Jennifer Halim — Thu, 04 Oct 2012 14:01:37 GMT

You can't access the ASA itself? you mean you can't telnet/ssh/http to 5510 from 5505 LAN?

Are you trying to access it via its inside interface ip address?

Do you have "management-access inside" configured on 5510?

Do you have the 5505 LAN configured on 5510 telnet/ssh/http command?

Example:

http <5505-lan> inside

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 14:05:47 GMT

I am unable to telnet/ssh/https to 5510 from 5505 or from 5505 to 5505.

I have the managment configured on the inside interface for all address in the range.

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 14:15:09 GMT

Also note that i have one of the 5505 setup as an any ip rule in teh 5510. So it should be able to access whatever it wants.

Access ASA that is behind a vpn tunnel and other network devices

Jennifer Halim — Thu, 04 Oct 2012 14:20:39 GMT

copy of configurations from all ASA will definitely help. It is difficult to tell what is wrong without looking at the configurations.

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 14:42:32 GMT

I am working on getting you the config. I just have to edit out the confidential stuff. I may be a while. Note that i am able to access everything from my internal network just fine. However when the 5505's ping each other i am then able to access the management features etc. I am still unable to access the 5510 even after a ping.

Access ASA that is behind a vpn tunnel and other network devices

kylebqmacs — Thu, 04 Oct 2012 14:47:04 GMT

I just checked the logs for the 5510. It shows the 5505 trying to ping. but is built and removed because of the inspect icmp command. Do i need to add a rule for the 5505 to ping the 5510 so that the route is built?