topic Connecting Cisco ASA 5505 to mutliple IPSec Vpn in Network Security

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Mon, 11 Mar 2019 23:54:17 GMT

I need to know if this is possible. We currently have 2 different ASA 5505 connect to our ASA5510. We want to VPN connect the 2 5505's to each other while still mantaining connection to our 5520. Any ideas? I have attached pdf of what we have. What we want is to connect traffic between the two 5505's so that devices in either location can talk to each other while still mantainig connection to the 5510.

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

Karsten Iwen — Fri, 14 Sep 2012 15:22:48 GMT

that can easily be achieved. On each 5505 add a second sequence in the crypto map and another tunnel-group for the other ASA. So on each 5505 you will have a config that is similar to that of the 5510 which has also two VPN-definitions.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Fri, 14 Sep 2012 15:26:34 GMT

Will this work even if i have a nat behind each 5505. for example 172.16.5.0/24 = 192.168.2.0/24 and 172.16.6.0/24 = 192.168.3.0/24. How will the 2 endpoint networks communicate with each other if the nat is in place?

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

Julio Carvajal — Fri, 14 Sep 2012 15:26:36 GMT

Hello Kyle,

So basically you want to communicate between both 5505 branches over an IPSec tunnel.

it can be done

You will need to create a VPN tunnel from both ASA's 5505 to the ASA5510.

Then permit the traffic from each of those branches to each other in the crypto ACL to the ASA 5510.

Any question..Sure.. Just remember to rate all of my answers.

Regards,

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

Karsten Iwen — Fri, 14 Sep 2012 15:33:11 GMT

There won't be any challenge in that as long as your sites don't have overlapping IP-space. Just configure NAT-Excemption for the VPN-Traffic.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Fri, 14 Sep 2012 15:33:47 GMT

Good news is i already have the ipsec tunnel created for the 2 5505's connecting to the 5510. How would the rule look when i add it to the acl. Do i add something on the inside or outside? would it be 5505-2 any ip to 5505-1 and vice versa?

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

Julio Carvajal — Fri, 14 Sep 2012 16:04:10 GMT

Hello Kyle,

It needs to be the crypto ACL.

Also remember to perform a nat (outside,outside) from the two remote offices.

If you want you can post the 5520 configuration and the subnets that need to talk to each other ( 5505 vs 5505)

Any question..Sure.. Just remember to rate all of my answers.

Julio

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Fri, 14 Sep 2012 16:40:02 GMT

The only issue is that we dont want them to route back through our network just for them to talk to each other. Can i not just setup another ipsec vpn on the each 5505 with one as host and the other as client?

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

Julio Carvajal — Fri, 14 Sep 2012 17:08:44 GMT

Hello Kyle,

if the 3 of them are reachable over the internet then yes, you can have a l2l between both ASA's without not going to the ASA 5520,

Any other question..Sure.. Just remember to rate all of my answers.

Julio

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Fri, 14 Sep 2012 17:19:46 GMT

I know how to create the connection from a client to host. How do i setup the 5505 as a host using asdm.

Re: Connecting Cisco ASA 5505 to mutliple IPSec Vpn

Karsten Iwen — Fri, 14 Sep 2012 17:23:33 GMT

you can control that with the crypto definition. Perhaps it's best to post the output of the following commands of both 5505s:

sh run crypto map

sh run tunnel-group

Then we can tell you what you need to add.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Mon, 17 Sep 2012 12:58:49 GMT

I am unable to post config for security reasons. Can you guys post an example and show me what to add.

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Mon, 17 Sep 2012 16:17:02 GMT

ok. I have it working. However i have ping each of the devices from each other. Is there a way to auto establish the route?

Another similar issue i have is getting 2 asas that are both connected to same ipsec tunnel communicate with each other without having to ping each other to establish a route.

Any ideas?

Connecting Cisco ASA 5505 to mutliple IPSec Vpn

kylebqmacs — Tue, 18 Sep 2012 16:09:41 GMT

Havent heard anything from you guys in a while. Any ideas??