Site to site VPN not working for DMZ

[IT Asitis]

Hi,

im setting up an ASA 5510 and i have set up a VPN tunnel to our hosting partner. The tunnel is set up exactly as it was on our old firewall and the tunnel works when using the inside network. However when using DMZ1 and DMZ2 networks the tunnel does not work. As far as i see it everything is set up correctly.

Internal:      10.42.10.0 255.255.255.0    

DMZ1:        10.42.1.0 255.255.255.0   

DMZ2:        10.42.2.0 255.255.255.0   

Source of the tunnel is 10.42.0.0 255.255.0.0

As far as i know this should cover all the networks.

Any ideas why the tunnel is working fine with Internal but not the other networks?

/Hilmar

[Jennifer Halim · Accepted solution]

can you pls post your config so we can look through the configuration.

Perhaps the NAT exemption has not been configured on DMZ1 and DMZ2?

[IT Asitis]

It is now attached

/H

[Jennifer Halim]

Which site-to-site vpn is affected?

The first one on the list only include 10.42.10.0/24 subnet:

access-list WAN1_cryptomap extended permit ip 10.42.10.0 255.255.255.0 object site-Asitis

Also, pls check if your access-list applied to both DMZ1 and 2 has included access to the remote end.

[IT Asitis]

That i should have mentioned it is the other tunnel we are talking about TDCH_LAN1 and TDCH_LAN2.

The other one is not an issue at the moment.

/Hilmar

[Jennifer Halim]

Pls remove the following 2 routes:

route WAN1 10.91.70.0 255.255.254.0 213.174.91.3 10

route WAN1 10.91.72.0 255.255.254.0 213.174.91.3 10

After removing the above 2, pls kindly share the output of"

show cry ipsec sa

[IT Asitis]

Ok i think i have fixed it.

You said  "Perhaps the NAT exemption has not been configured on DMZ1 and DMZ2?" it was only configured for Internal.

I added this for dmz1 and dmz2 and now i am able to talk to servers on the other end.

Great tip by the way

One thing i noticed was that there is no access rule for internal ( i think that the tunnel should bypass access rules ) can you confirm that this is not needed at all?

/H

[Jennifer Halim]

Correct, if you don't have any access rule configured on internal interface, by default the traffic from internal going outbound will be allowed. And for VPN tunnel, traffic from remote LAN towards internal LAN will also be allowed.

[IT Asitis]

Ok

Thanks for your help Jennifer.

/Hilmar