topic Re: Remote Access - VPN in Network Security

Remote Access - VPN

Rafael Jimenez — Mon, 11 Mar 2019 11:53:15 GMT

I have the following configuration in an ASA5505-SEC-BUN-K8:

interface Vlan1

nameif Servers

security-level 100

ip address 192.168.80.1 255.255.255.0

interface Vlan10

nameif internet

security-level 0

ip address 10.0.11.99 255.255.0.0

interface Vlan90

nameif huespedes

security-level 40

ip address 192.168.90.1 255.255.255.0

interface Vlan201

nameif dmz

security-level 50

ip address 201.245.184.225 255.255.255.224

interface Vlan254

nameif bogota

security-level 100

ip address 192.168.252.2 255.255.255.252

I would like to know on which interface has to enable the vpn ;

crypto map ?????_map interface ????

crypto isakmp enable ?????

My outside interface is called internet.

If i have 30 public ips and the dmz vlan is using one of this public ip's , how need setup my vpn access?.

Thanks

Re: Remote Access - VPN

ajagadee — Thu, 24 Jan 2008 22:40:59 GMT

I would recommend that you apply the crypto map on the interface where your default route is pointing to. The reason is, for Remote Access VPN, the user would be coming from any source IP and for the ASA to route the packets back to the VPN Client, a default route will scale much better.

Regards,

Arul

** Please rate all helpful posts **

Re: Remote Access - VPN

Rafael Jimenez — Thu, 06 Mar 2008 14:09:26 GMT

what about if my outside interface is not directly connected to the internet. My outside interface in my ASA5500 is conected to the ISP router but the ISP give me a 10.x.x.x/32 subnet.

The ISP routers forward to my firewall the subnet with the publict ip's.

Re: Remote Access - VPN

brettmilborrow — Thu, 06 Mar 2008 14:45:24 GMT

In that case you will not be able to terminate the Remote access VPN's on the firewall unless the ISP NAT's one of your public ip's to your external interface of your ASA.

The only other way around this will be to use some of your public address space on the network between the firewall and ISP router.

Re: Remote Access - VPN

onlyabhishek007 — Fri, 07 Mar 2008 07:11:10 GMT

you will enable on the internet.

Re: Remote Access - VPN

Rafael Jimenez — Fri, 07 Mar 2008 14:28:35 GMT

if I select the isp NAT option, how need setup the ASA to avoid the NAT-IPSEc issue?.

thanks.

Re: Remote Access - VPN

brettmilborrow — Fri, 07 Mar 2008 23:33:52 GMT

You need to enable nat traversal with the following command:

"isakmp nat-traversal"

Good Luck!