cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
263
Views
25
Helpful
12
Replies
Highlighted
Contributor

Setup a Temporary Location to Location Setup

Hello All,

*Let me know if I should post this under a different category...

I'm wondering if it would be possible to setup some type of temporary VPN'like connection between 2 locations. One of our branches is moving to a new location. The private MPLS circuit won't be getting installed for quite some time, however we'll be having some local broadband installed prior to them moving to this new location.

So I'm wondering if there is anything we could do temporarily to setup a connection between the remote location and our HQ.

Remote Location has:

- 1 x ISR4321

- 1 x WS-C3650-48FD-S

HQ Location has:

- Lots of Cisco Gear. But most importantly, 2 x ASA5525

 

Is there anything we can do with the ASA and the ISR in the remote location to setup sometype of direct VPN-like connection so we can get their IP Phones up and running while we wait for the MPLS circuit to be installed?

Any thoughts or suggestions would be greatly appreciated!

Thanks in Advance,
Matt

12 REPLIES 12
Highlighted
VIP Advisor

Re: Setup a Temporary Location to Location Setup

Hi,

You could setup a VPN between the ISR and the ASA, either a VTI or traditional crypto map. You do need to be running ASA v9.7 or newer to configure a VTI.

 

Here are some examples VTI and Crypto Map.

 

HTH

Highlighted
Contributor

Re: Setup a Temporary Location to Location Setup

It looks like our ASA is currently running v9.4(4)20.

I see in the ASDM there's an option to configure a Site-to-Site VPN...?

Also, the remote office will have the local broadband's Router in between our ISR and the Internet. Would this cause any issues in setting up one of these options?

-Matt
Highlighted
VIP Advisor

Re: Setup a Temporary Location to Location Setup

In that case you can only setup a crypto map site to site VPN, you can use Asda wizard to set this up.

 

Does your ISR router have a public IP address or will it be natted behind the isp router? If natted behind the isp router you will need to setup port forwarding to your ISR routers IP address.

 

Highlighted
Contributor

Re: Setup a Temporary Location to Location Setup

Thanks again for the reply!

Ok, thanks. The ISR does not have its own public IP. It'll be natted behind the ISP router. Is the port forwarding done via the ISR or the ISP Router? I know those ISP Routers usually have port forwarding settings in the admin GUI...

Thanks Again,
Matt
Highlighted
VIP Advisor

Re: Setup a Temporary Location to Location Setup

The ISR’s outside interface will have a private IP address, the isp router will port forward to this IP address.

Highlighted
Contributor

Re: Setup a Temporary Location to Location Setup

Ok thank you.

In all of our Branch locations, I setup the ISP Router's LAN addressing to use 10.x.3.0 (*where x is the subnet for that particular branch).

On our branch ISR routers. For the interface connecting the ISR to the ISP's Router. For example, I have that interface configured with IP Address 10.19.3.2, and the ISP Router configured as 10.19.3.1.

So on the ISP's Router, I would configure Port Forwarding to 10.19.3.2? Is that correct? Would there be a specific port range that needs forwarding?

 

Thanks Again,

Matt

Highlighted
VIP Advisor

Re: Setup a Temporary Location to Location Setup

Yes 10.19.3.2, ports udp/500 and udp/4500
Highlighted
Collaborator

Re: Setup a Temporary Location to Location Setup

Hi,

 

    If there is another layer 2 device in front of your ASR, no problem. If there is another layer 3 device in front of your ISR, regardless if it does NAT for you or not (it depends if you get a public or private IP), it needs to allow all IP traffic towards your ISR, no firewalls. See below guides to help you set it up, both via crypt-map (if you want to keep the current ASA version) and via VTI (if you want to upgrade):

 

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119141-configure-asa-00.html

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/119425-configure-ipsec-00.html

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/214109-configure-asa-ipsec-vti-connection-to-az.html

https://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1063136

 

Regards,

Cristian Matei.

Highlighted
Contributor

Re: Setup a Temporary Location to Location Setup

Thanks Cristian.

Would using the ASDM's "Site-to-Site VPN Connection Wizard" work for what you're describing doing it via a crypto-map?

Thanks,
Matt
Highlighted
Collaborator

Re: Setup a Temporary Location to Location Setup

Hi,

 

  Yes it would.

 

Regards,

Cristian Matei.

Highlighted
Hall of Fame Master

Re: Setup a Temporary Location to Location Setup

As far as ports to forward on the ISP device @Rob Ingram correctly identifies udp 500 and 4500 which takes care of ISAKMP. You would also need to forward ESP packets (note that ESP is an IP protocol and not a port number).

HTH

Rick
Highlighted
Contributor

Re: Setup a Temporary Location to Location Setup

Thanks Richard, much appreciated!

-Matt
CreatePlease to create content
Content for Community-Ad