Connecting Cisco ASA 5505 to mutliple IPSec Vpn

[kylebqmacs]

I need to know if this is possible.  We currently have 2 different ASA 5505 connect to our ASA5510.  We want to VPN connect the 2 5505's to each other while still mantaining connection to our 5520.  Any ideas?  I have attached pdf of what we have.  What we want is to connect traffic between the two 5505's so that devices in either location can talk to each other while still mantainig connection to the 5510.

[Karsten Iwen]

that can easily be achieved. On each 5505 add a second sequence in the crypto map and another tunnel-group for the other ASA. So on each 5505 you will have a config that is similar to that of the 5510 which has also two VPN-definitions.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[kylebqmacs]

Will this work even if i have a nat behind each 5505. for example 172.16.5.0/24 = 192.168.2.0/24 and 172.16.6.0/24 = 192.168.3.0/24.  How will the 2 endpoint networks communicate with each other if the nat is in place?

[Karsten Iwen]

There won't be any challenge in that as long as your sites don't have overlapping IP-space. Just configure NAT-Excemption for the VPN-Traffic.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Julio Carvajal]

Hello Kyle,

So basically you want to communicate between both 5505 branches over an IPSec tunnel.

it can be done

You will need to create a VPN tunnel from both ASA's 5505 to the ASA5510.

Then permit the traffic from each of those branches to each other in the crypto ACL to the ASA 5510.

Any question..Sure.. Just remember to rate all of my answers.

Regards,

[kylebqmacs]

Good news is i already have the ipsec tunnel created for the 2 5505's connecting to the 5510.  How would the rule look when i add it to the acl.  Do i add something on the inside or outside?  would it be 5505-2 any ip to 5505-1 and vice versa?

[Julio Carvajal]

Hello Kyle,

It needs to be the crypto ACL.

Also remember to perform a nat (outside,outside) from the two remote offices.

If you want you can post the 5520 configuration and the subnets that need to talk to each other ( 5505 vs 5505)

Any question..Sure.. Just remember to rate all of my answers.

Julio

[kylebqmacs]

The only issue is that we dont want them to route back through our network just for them to talk to each other.  Can i not just setup another ipsec vpn on the each 5505 with one as host and the other as client?

[Julio Carvajal]

Hello Kyle,

if the 3 of them are reachable over the internet then yes, you can have a l2l between both ASA's without not going to the ASA 5520,

Any other question..Sure.. Just remember to rate all of my answers.

Julio

[kylebqmacs]

I know how to create the connection from a client to host.  How do i setup the 5505 as a host using asdm.

[Karsten Iwen]

you can control that with the crypto definition. Perhaps it's best to post the output of the following commands of both 5505s:

sh run crypto map

sh run tunnel-group

Then we can tell you what you need to add.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[kylebqmacs]

I am unable to post config for security reasons.  Can you guys post an example and show me what to add.

[kylebqmacs]

ok.  I have it working.  However i have ping each of the devices from each other.  Is there a way to auto establish the route?

Another similar issue i have is getting 2 asas that are both connected to same ipsec tunnel communicate with each other without having to ping each other to establish a route.

Any ideas?

[kylebqmacs]

Havent heard anything from you guys in a while.  Any ideas??