cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
581
Views
0
Helpful
1
Replies

ASA for the DR site

codered0001
Level 1
Level 1

Hello,

We have a situation where we are comissioning a DR site. We have three tunnel interfaces for our three remote sites and a loopback interface for crypto maps at the headoffice on a ciso 3845.the config is as followed.

As per my initial analysis loopback interfaces and GRE tunnels are not supported on the ASA firewall

We  dont have a router on our DR site what we have is a ASA 5510, now i  need to make sure that i have a solution to accomodate GRE tunnel and  loopback interface without procuring a router.

interface Loopback0
ip address 192.168.x.x 255.255.255.255
ip virtual-reassembly
!
interface Tunnel0
description --- GRE Tunnel to Site A ---
ip address 12.0.0.1 255.255.255.252
tunnel source 10.50.40.136
tunnel destination 10.20.230.34
!
interface Tunnel1
description --- GRE Tunnel to Site B ---
ip address 12.0.0.5 255.255.255.252
tunnel source 10.50.40.136
tunnel destination 10.20.230.58
!
interface Tunnel2
description --- GRE Tunnel to Site C ---
ip address 12.0.0.9 255.255.255.252
tunnel source 10.50.40.136
tunnel destination 10.20.230.86

!

!
interface Vlan35
description *** SP Radio VLAN ***
ip address 10.50.40.136 255.255.255.248
ip mtu 1400
ip nbar protocol-discovery
ip flow ingress
ip virtual-reassembly

!

!

#show crypto engine connection active

Crypto Engine Connections

   ID  Type    Algorithm           Encrypt  Decrypt IP-Address
1353  IKE     MD5+3DES                  0        0 192.168.x.x
1354  IKE     MD5+3DES                  0        0 192.x.x

1 Reply 1

sean_evershed
Level 7
Level 7

As far as I know you can only configure an ASA to permit or deny GRE traffic via an ACL.

http://www.cisco.com/en/US/partner/tech/tk583/tk372/technologies_configuration_example09186a00800a43f6.shtml

Have you considered the use of VPN tunnels instead?

See below an example focussed on firewalls where you have a hub and spoke VPN topology.

VPN traffic traversing the ASA at the DR site will need to be able to enter and exit the same interface.

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtmlP

Please remember to rate all posts that are helpful.

Review Cisco Networking for a $25 gift card