topic Remote Access VPN through a Tunnel in Network Security

Remote Access VPN through a Tunnel

Lakeram Harrypersaud — Mon, 11 Mar 2019 21:39:36 GMT

Hi Guys,

I have a site to site VPN between SiteA to SiteB which is working fine. SiteA has an ASA5520 and SiteB Pix501. The ASA5520 is running version 804 with split tunneling. Users connect to SiteA using remote access VPN. Is it possible to setup SiteA ASA5520 so that when users connect to SiteA they can access servers located on SiteB through the tunnel? I know i can setup the Pix501 for remote access VPN but it is located in another country and i don't want to take a chance just incase i lose connectivity.Any help will be greatly appreciated.

Thanks,

Lake

Remote Access VPN through a Tunnel

Jennifer Halim — Wed, 19 Oct 2011 02:14:40 GMT

Yes you can, here is all the config that you would need:

On ASA 5520:

1) Split tunnel ACL needs to include Site B LAN.

2) Configure: "same-security-traffic permit intra-interface"

3) Crypto ACL for the site-to-site VPN should include:

access-list permit ip

On PIX501:

1) Crypto ACL for the site-to-site VPN should include:

access-list permit ip

2) NAT exemption ACL should include:

access-list permit ip

Hope this helps.

Remote Access VPN through a Tunnel

Lakeram Harrypersaud — Wed, 19 Oct 2011 02:19:40 GMT

Hi Jennifer,

I will try that.

Thanks,

Lake

Remote Access VPN through a Tunnel

Lakeram Harrypersaud — Wed, 19 Oct 2011 03:01:26 GMT

Hi Jennifer,

It worked like a charm.

Thank you very much.

Regards,

Lake

Remote Access VPN through a Tunnel

Jennifer Halim — Wed, 19 Oct 2011 03:02:33 GMT

Excellent, thanks for the update and ratings.

Remote Access VPN through a Tunnel

Lakeram Harrypersaud — Wed, 19 Oct 2011 23:40:43 GMT

Hi Guys,

I know this problem has been solved but i really need some help with a similar setup but still different and i am not sure if i should start another discussion?

It is now understood that SiteA and SiteB has a tunnel which is working fine. SiteA is the hub for all the remote locations. Also, SiteC and SiteD is connected to SiteA via tunnel which is working fine. Now i need SiteC to connect to a server in SiteD? I think it would be easier for SiteC to go through SiteA in order to get to SiteD so users from SiteC can have one connection and choose to connect to a server in SiteA or SiteD?

Should i just create the above access list in SiteC and SiteD because SiteA configuration should be fine? If not please advise?

Thanks,

Lake

Remote Access VPN through a Tunnel

Jennifer Halim — Thu, 20 Oct 2011 04:20:10 GMT

If you require access from Site C to Site D and vice versa, and with the current deployment of Site A being the HUB, here is what is required:

Site A:

- Crypto ACL towards Site C should include:

access-list permit ip

- Crypto ACL towards Site D should include:

access-list permit ip

Site C:

- Crypto ACL towards Site A should include:

access-list permit ip

Site D:

- Crypto ACL towards Site A should include:

access-list permit ip

Hope this helps.

Remote Access VPN through a Tunnel

Lakeram Harrypersaud — Thu, 20 Oct 2011 18:02:27 GMT

Thank you very much Jennifer.

Regards,

Lake