topic Re: Easy VPN Remote Enabled (Site 2 Site), Setup another tunnel? in Network Security

Easy VPN Remote Enabled (Site 2 Site), Setup another tunnel?

Thomas_homeusr — Fri, 21 Feb 2020 15:50:39 GMT

In our company we have a ASA5505 connected to a branch office. This setup was done by the branch office's third party IT company.

They've used Easy VPN Remote for the setup. Now we temporary could use another tunnel from our office to my home server. (We're gonna use my server as a temporary backup for our fileserver.)

Is it possible to use the Wizard in ASDM to accomplish this without interfering with the already setup tunnel? Or if perhaps I manually set it up without changing any policys previously setup?

I'm asking this, because I get a warning in ASDM stating that EasyVPN Remote is enabled and policys etc. cannot be changed with this feature turned on.

On my end I'm gonna try use Softether, which should be able to connect to a cisco tunnel. (If this doesn't work I also own a 5505, which I currently don't use.)

Re: Easy VPN Remote Enabled (Site 2 Site), Setup another tunnel?

Florin Barhala — Tue, 05 Jun 2018 09:26:31 GMT

I never tried but I think you'll run into issues. What Easy VPN does on the client, grabs all traffic and sends it over. Now if you build a new tunnel how can you "ask Easy VPN" to some kind of split tunneling and send all the traffic BUT some src_dst pair.

So if you really need the new tunnel I would clear the Easy VPN, build the tunnel then ack any leftover requirement.

Re: Easy VPN Remote Enabled (Site 2 Site), Setup another tunnel?

Thomas_s — Tue, 05 Jun 2018 09:38:08 GMT

So, to not mess up the existing tunnel, the only alternative is to set up something else?

Or is it possible to connect another device to the same tunnel? And will will all networks be available on all three sites then?

Re: Easy VPN Remote Enabled (Site 2 Site), Setup another tunnel?

Florin Barhala — Fri, 08 Jun 2018 11:05:50 GMT

You cannot connect another device to the same tunnel on the client side - your ASA acts as a client toward the Easy VPN Server.
I would suggest to keep things simpler and the config logic as well.