Setup of IPSec Passthrough

jialoh — Mon, 11 Mar 2019 22:48:22 GMT

Hi All,

I would like to get some help on IPSec Passthrough on an ASA 5520, with version 8.3, and ASDM 6.3. Currently I have a requirement for users in my internal network (10.10.249.128 / 25) to be able to connect to external IPSec VPN servers.

So I created a network object with 10.10.249.128 / 25, and used dynamic PAT to translate the source ip address to the external internet facing outside interface:

I then added the following rules on the inside-in ACL:

However troubleshooting shows that isakmp is passing through the firewall, but esp and ah is not.

For isakmp:

For ESP:

Seems like the nat rule is drawing my ESP traffic, can any one point me in the correct direction?

Kind Regards,

Jia Wei

Setup of IPSec Passthrough

Jouni Forss — Thu, 29 Mar 2012 09:17:47 GMT

Hi,

Have you tried an actual VPN Client connection through the ASA from the guest network? Or is the problem only based on testing this thing with packet-tracer on ASDM side?

I dont remember ever opening ESP/HA for Cisco VPN Client traffic

topic Setup of IPSec Passthrough in Network Security

Setup of IPSec Passthrough

Setup of IPSec Passthrough