connecting 3 sites

[tallpaulroe]

i need a little help in connecting 3 sites

site A  10.x.x.x networks

site B 192.168.x.x  networks

site C 192.168.x.x networks

we also need to connect over the internet

site A has around 30 devices that will send data to a server at site B

site B has a server that will from time to time request data from the devices at Site A

Site D needs to access the devices at Site A for development support only

my thoughts were that i need static NAT for the 30 ish devices at Site A

then a 2 VPN's from site A to site's B and C.

so i kind of thought that i would end up with this kind of setup

site A 10.x.x.x--R1(doing Static NAT)--Firewall/Router------Internet-------Firewall/router---R2(doing Static Nat)---Site C 192.168.x.x

                                                                                                 |

                                                                                                 |__Firewall/router----R3(doing static NAT)--- Site B 192.168.x.x

am i heading in the right direction??

[mvsheik123]

Hi,

As you already figured this out, your best best bet would be VPN. If the VPN tunnel is UP, you do not need static NAT for the IPsto reach the other site . (only if they need to goto internet- then you can think about it, provided you got enough public IPs). Also, for side D - make sure to include only developement subnet at siteA in the interesting traffic ACLs. All the best.

Thx

MS

[Marwan ALshawi]

The best and easiest way is to use DMVPN

This will let you have a hub and spoke topology over the Internet with multipoint gre tunnels protected by IPSec for security

Also these mgre tunnel let you have multicasting and dynamic routing to be run between your sites for full connectivity

Also you can have only one public static ip over internet on the hub

And spoke to spoke can go direct without going through

The hub

Please search

Google or cisco.com about DMVPN

HTH

If helpful rate

Sent from Cisco Technical Support iPhone App

[Marwan ALshawi]

how DMVPN works and example

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps6658/prod_presentation0900aecd80313c97.pdf

DMVPN example

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008019d6f7.shtml

HTH

pls rate the helpful posts

[tallpaulroe]

could i do this with an ASA at each site?

[Marwan ALshawi]

NO you need a router

however if you have ASA connected to the Internet and a router behind it then you can do NAT and ACL permitting GRE to the router inside the LAN

if you do not have rouer in each site only ASAs then you can use cleint server VPN also know as easy VPN on the ASA

http://tekcert.com/blog/2011/03/17/asa5510-asa5505-easy-vpn-server-client-configuration-sample

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/ezvpn505.html

HTH

if helpful Rate