VPN & Routing

[Terence Lockette]

Hello all,

I have a question for an upcoming project that I'm hoping to get some good,helpful, and quick responses for.  We have 2 vendors that need to communicate through our network.  Due to contractual agreements, they can't communicate directly through a site-to-site VPN solution.  Therefore, they have to come through our network.  Anyway, Vendor1 is requesting another S2S VPN tunnel to be configured on our ASA for a single host on their internal network (10.200.6.99) that will communicate to Vendor2's internal IP (unknown at this time).  Vendor2 is currently connected to us via a WAN link where we route to their WAN router from our Layer 3 switches.  Since Vendor1's inside host is located at another location on another subnet, I'll need to establish another VPN tunnel for that LAN.  What I need to know is how can I get Vendor1's inside host (10.200.6.99) to talk to Vendor2's inside host through our network with this type of set up?  Is it simple routing that needs to be configured only?  Or is it a combination of routing and NAT?  Or is there another way?  Any help would be appreciated.  Please see my quick diagram of how these two are set up.

Thanks,

Terence

[rizwanr74 · Accepted solution]

Hi Terence,

What you need is to include in the cryto-acl and in the no-nat acl vendor1's and vendor2's ip addresses (i.e. host address and network need access).

Also please include static routes to those next-hop interface's address on which those traffic is acessialbe.

thanks

[Terence Lockette]

Ok so static routes to the next hop IP addresses is understood but what I don't understand is the crypto ACL and no NAT ACL you mentioned.  Can you explain a little further please?

[rizwanr74]

What verion of your ASA?

Have you done, s2s land to land to vpan before?  Just to understand level of understand you have, so that  I will reply accordingly.

thanks

[Terence Lockette]

Yes sorry, I should've been more clear in my last response.  I'm just confused on how its worded.  It's ASA version 8.4; I have done S2S L2L tunneling before using this version of the software.  From what I'm thinking about what you're saying is that I need to create an ACL for the interesting traffic and a no NAT ACL for that same interesting traffic then create static routes to the destinations.  Is that correct?

[rizwanr74 · Accepted solution]

"From what I'm thinking about what you're saying is that I need to create  an ACL for the interesting traffic and a no NAT ACL for that same  interesting traffic then create static routes to the destinations.  Is  that correct?"

Yes that is correct, you would establish a vpn tunnel to vendor1 as you would create a normal vpn tunnel and then include the vendor2's ip address as well, as if vendor2's address (i.e. lan address) is your local lan to traverse in the vpn tunnel between vendor1 and your ASA.

thanks

[Terence Lockette]

Ok I think I get what you're saying.  So I would set the peer address for the tunnel to be Vendor1's outside IP and Vendor1 would set their peer address to be my outside IP.  Then when I specify the ACLs for the interesting traffic and no NAT, I would list Vendor1 and Vendor2 as the subnets instead of my actual local LAN subnet.  Is this what you're saying?

[rizwanr74]

Yes that is correct.

[Terence Lockette]

Ok great!  One last thing...when I specify my network objects if its only a single host that needs to communicate between these two vendors, then I just specify the "host" parameter for the object instead of the "subnet" parameter, correct?

[rizwanr74 · Accepted solution]

Yes that is correct and an example below.

object network obj-209.165.200.225

host 209.165.200.225

[Terence Lockette]

Thank you sir!  Your help is greatly appreciated!

[Terence Lockette]

I don't mean to reopen this discussion but I got some additional info I needed regarding this configuration.  Vendor2's IP address is a public IP that will be Natted by their firewall.  Vendor1 will use the existing VPN tunnel instead of creating a new tunnel.  In addition, Vendor 1 and Vendor 2 will only need 1 host on both networks to communicate via a specific TCP port number.  Here is a sample config that I would need to configure on my firewall to ensure this connection is made.  Please tell me if I'm correct or if I'm missing anything:

conf t

object network

host

exit

object network

host <--!!!Public IP that will be Natted to an inside IP!!!-->

exit

access-list extended permit tcp host host eq

nat (inside,any) source static destination static

route inside

Thanks,

Terence

[rizwanr74]

Hi Terence,

"Vendor2's IP address is a public IP that will be Natted by their firewall."

"Vendor2 is currently connected to us via a WAN link where we route to their WAN router from our Layer 3 switches."

Hi Terence,

I see, two of your statements above are kind of conflicting info.

So, please answer me, above.

Does Vendor2's public IP is being routed via the public cloud (i.e. internet) via your Firewall or via the WAN router?

I will answer your questions, when you answer mine.

Thanks

Rizwan Rafeek

[Terence Lockette]

Perhaps my wording is a bit confusing but to put it correctly, Vendor2 has a router/layer 3 device that has a route to one of our VLAN subnets.  Somewhere behind this router, this vendor has public IP space and we have a bunch of static routes for these public IPs that routes back to this vendor through that WAN link.  I don't know how this vendors network is setup but I would imagine that it goes through a firewall/router that NATs incoming requests on one of those public IPs.

[rizwanr74]

Hi Terence,

This is all you need.

object network

host

object network

host <--!!!Public IP that will be Natted to an inside IP!!!-->

access-list extended permit tcp host  host eq

nat (inside,any) source static destination static

route inside

You  are correct with your script and be sure to infom the Vendor1 to  include your vendor2's ip host address in the tunnel between your ASA  and their tunnel end point.

thanks

Rizwan Rafeek

Let me know, how it is coming alone.

Message was edited by: Rizwan Mohamed