Hi there  I need to get the following scenario working and hope someone can help.  I have two sites (A -1.1.1.1 and B-2.2.2.2). both have Cisco ASAs as their perimeter firewalls. They have site to site VPN configured between them.  Site B has a web server (192.168.1.100) in it's internal network. The web service (https) hosted on this server is not available via the Internet but it can be accessed from Site A via the S2S vpn. What I'm trying to do is provide access from internet, to this web service (that's hosted in site-B) using the public IP address of SITE-A. So Internet uses should be able to access this web service by using the https://1.1.1.1 . This request will hit the ASA at site-A, get translated/directed to 192.168.1.100 over the VPN tunnel.  Is this possible ?  I have attached a diagram for the setup.  Just some notes: I have already tested with solutions via anyConnect VPN, ssl VPN and those work. But want avoid using any remote access VPN for this.  Site A only has a Single public IP.  Thanks HR ... View more

Hi there I have a requirement to configure a site-to-site VPN on a ASA 5506 which is configured as a PPPoE client on its outside interface. I'm looking for any documentation or advice on on how the VPN section should be configured. Currently I have the following Configuration but I'll not sure if this would work as on the ASDM there is a error (red X) saying "This interface has crypto map configuration. It cannot be a part of Traffice Zone". Please see the attached for the error.  Interface config interface GigabitEthernet1/1 nameif outside security-level 0 pppoe client vpdn group ABCD ip address pppoe setroute ! PPPoE Config vpdn group ABCD request dialout pppoe vpdn group ABCD localname user@spark.co.nz vpdn group ABCD ppp authentication pap vpdn username user password ***** VPN Config crypto ikev1 enable outside crypto ikev1 policy 10 authentication crack encryption aes-256 hash sha group 2 lifetime 86400 group-policy GroupPolicy_x.x.x.x internal group-policy GroupPolicy_x.x.x.x attributes vpn-tunnel-protocol ikev1 tunnel-group x.x.x.x type ipsec-l2l tunnel-group x.x.x.x general-attributes default-group-policy GroupPolicy_x.x.x.x tunnel-group x.x.x.x ipsec-attributes ikev1 pre-shared-key ***** The 5506 is for a remote site so I would like to make sure I have the configuration right. It would be great if someone could point me to the correct documentation or confirm that this config is correct and if I should be worried about the attached error. I know on the routers the crypto map has to be applied to the  dialer interface. Is it something similar for ASAs ?  Thanks in advance.  ... View more

Hi there    I'm not even sure if this is possible but hope someone can help me out if it is :) .  What I would like to do: On a ASA 5505 (9.2(1)), i would like to do a shut and no shut of the outside interface every time out going traffic flow stops.  so if i was doing this manually, i would ping a public IP address (8.8.8.8 for example) every hour and if the ping fails, I would do a shut and a no shut on the outside interface. Is there a way to automate this process on the ASA?  The reason I would like to do this: Currently we are having to reset the outside interface every time our ISP has an outage( and they have a lot of them). The root cause for this seems to be DHCP and ARP request and i'm working with the ISP to get this resolve. In the mean time, is there is a way to automate the above process, it will save me from going to the office in the middle of the night to reset the ASA.  Hopefully someone will have a solutions for this.    Thanks   ... View more