Setup a Temporary Location to Location Setup

[Matthew Martin]

Hello All,

*Let me know if I should post this under a different category...

I'm wondering if it would be possible to setup some type of temporary VPN'like connection between 2 locations. One of our branches is moving to a new location. The private MPLS circuit won't be getting installed for quite some time, however we'll be having some local broadband installed prior to them moving to this new location.

So I'm wondering if there is anything we could do temporarily to setup a connection between the remote location and our HQ.

Remote Location has:

- 1 x ISR4321

- 1 x WS-C3650-48FD-S

HQ Location has:

- Lots of Cisco Gear. But most importantly, 2 x ASA5525

Is there anything we can do with the ASA and the ISR in the remote location to setup sometype of direct VPN-like connection so we can get their IP Phones up and running while we wait for the MPLS circuit to be installed?

Any thoughts or suggestions would be greatly appreciated!

Thanks in Advance,
Matt

[Rob Ingram]

Hi,

You could setup a VPN between the ISR and the ASA, either a VTI or traditional crypto map. You do need to be running ASA v9.7 or newer to configure a VTI.

Here are some examples VTI and Crypto Map.

HTH

[Matthew Martin]

It looks like our ASA is currently running v9.4(4)20.

I see in the ASDM there's an option to configure a Site-to-Site VPN...?

Also, the remote office will have the local broadband's Router in between our ISR and the Internet. Would this cause any issues in setting up one of these options?

-Matt

[Rob Ingram]

In that case you can only setup a crypto map site to site VPN, you can use Asda wizard to set this up.

Does your ISR router have a public IP address or will it be natted behind the isp router? If natted behind the isp router you will need to setup port forwarding to your ISR routers IP address.

[Matthew Martin]

Thanks again for the reply!

Ok, thanks. The ISR does not have its own public IP. It'll be natted behind the ISP router. Is the port forwarding done via the ISR or the ISP Router? I know those ISP Routers usually have port forwarding settings in the admin GUI...

Thanks Again,
Matt

[Rob Ingram]

The ISR’s outside interface will have a private IP address, the isp router will port forward to this IP address.

[Matthew Martin]

Ok thank you.

In all of our Branch locations, I setup the ISP Router's LAN addressing to use 10.x.3.0 (*where x is the subnet for that particular branch).

On our branch ISR routers. For the interface connecting the ISR to the ISP's Router. For example, I have that interface configured with IP Address 10.19.3.2, and the ISP Router configured as 10.19.3.1.

So on the ISP's Router, I would configure Port Forwarding to 10.19.3.2? Is that correct? Would there be a specific port range that needs forwarding?

Thanks Again,

Matt

[Rob Ingram]

Yes 10.19.3.2, ports udp/500 and udp/4500

[Cristian Matei]

Hi,

    If there is another layer 2 device in front of your ASR, no problem. If there is another layer 3 device in front of your ISR, regardless if it does NAT for you or not (it depends if you get a public or private IP), it needs to allow all IP traffic towards your ISR, no firewalls. See below guides to help you set it up, both via crypt-map (if you want to keep the current ASA version) and via VTI (if you want to upgrade):

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119141-configure-asa-00.html

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/119425-configure-ipsec-00.html

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/214109-configure-asa-ipsec-vti-connection-to-az.html

https://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1063136

Regards,

Cristian Matei.

[Matthew Martin]

Thanks Cristian.

Would using the ASDM's "Site-to-Site VPN Connection Wizard" work for what you're describing doing it via a crypto-map?

Thanks,
Matt

[Cristian Matei]

Hi,

  Yes it would.

Regards,

Cristian Matei.

[Richard Burts]

As far as ports to forward on the ISP device @Rob Ingram correctly identifies udp 500 and 4500 which takes care of ISAKMP. You would also need to forward ESP packets (note that ESP is an IP protocol and not a port number).

[Matthew Martin]

Thanks Richard, much appreciated!

-Matt