I currently have site-to-site VPN tunnels from two remote sites with 1720s connecting to an ASA5510 at my TOWN_HALL site. (see attached diagram)
This is working fine but I want to add connectivity between the 1720-A LAN (172.20.3.0/24) and the 1720-B LAN (172.22.3.0/24). What's the best way to do this? Can the 1720s be configured with direct L2L VPN tunnels or will that affect the current tunnels to the ASA5510? If so, I'm guessing each 1720 will have to go through the ASA first.
Thanks.
Configs below:
ASA5510
ASA Version 7.2(2)
!
names
name 172.18.3.19 Postal description Mail Server
name 172.18.3.33 helpdesk description Helpdesk Server
dns-guard
!
interface Ethernet0/0
description Comcast Link
nameif ComCast_Out
security-level 0
ip address 29.92.14.73 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.10.2 255.255.255.252
!
interface Ethernet0/2
security-level 0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 10.10.10.1 255.255.255.0
management-only
!
boot system disk0:/asa722-k8.bin
boot system disk0:/asa706-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
access-list inbound extended permit ip any host 29.92.14.74
access-list inbound extended permit icmp any any unreachable
access-list inbound extended permit icmp any any echo-reply
access-list inbound extended permit tcp any host 29.92.14.73 eq 3000
access-list inbound extended permit tcp any host 29.92.14.73 eq smtp log
access-list inbound extended permit tcp any host 29.92.14.73 eq www
access-list inbound extended permit tcp any host 29.92.14.73 eq 3389
access-list inbound extended permit tcp any host 29.92.14.73 eq pptp
access-list inbound extended permit tcp any host 116.204.226.42 eq 3000
access-list inbound extended permit tcp any host 116.204.226.42 eq smtp
access-list inbound extended permit tcp any host 116.204.226.42 eq www
access-list inbound extended permit tcp any host 116.204.226.42 eq 3389
access-list inbound extended permit tcp any host 116.204.226.42 eq pptp
access-list inbound remark FTP Server
access-list inbound extended permit tcp any host 29.92.14.73 eq ftp
access-list acl_out extended permit tcp host 29.92.14.73 any eq smtp
access-list acl_out extended permit tcp host 192.168.1.4 any eq smtp
access-list acl_out extended deny tcp any any eq smtp
access-list acl_out extended permit ip any any
access-list 121 extended permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list nonat extended permit ip 172.18.3.0 255.255.255.0 172.22.3.0 255.255.255.0
access-list nonat extended permit ip 172.18.3.0 255.255.255.0 172.20.3.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 172.22.3.0 255.255.255.0
access-list nonat extended permit ip 172.30.1.0 255.255.255.0 172.31.255.0 255.255.255.0
access-list nonat extended permit ip 192.168.10.0 255.255.255.252 172.31.255.0 255.255.255.0
access-list nonat extended permit ip 172.17.1.0 255.255.255.0 172.31.255.0 255.255.255.0
access-list nonat extended permit ip 172.18.0.0 255.255.0.0 172.31.255.0 255.255.255.0
access-list nonat extended permit ip 172.31.3.0 255.255.255.0 172.31.255.0 255.255.255.0
access-list nonat extended permit ip 192.168.0.0 255.255.0.0 172.31.255.0 255.255.255.0
access-list backup_access_out extended permit ip any any
access-list outside_access_out extended permit ip any any
access-list outside_access_out remark Barracuda
access-list outside_access_out extended permit tcp host 172.18.3.8 any eq smtp inactive
access-list outside_access_out remark SMTP Block
access-list outside_access_out extended deny tcp any any eq smtp inactive
access-list inside_access_in remark Schools SMTP
access-list inside_access_in extended permit tcp host Postal eq smtp any eq smtp
access-list inside_access_in extended permit tcp host 172.18.3.8 any eq smtp
access-list inside_access_in extended permit tcp host 172.18.3.30 any eq smtp
access-list inside_access_in extended deny tcp any any eq smtp
access-list inside_access_in extended permit ip any any
access-list ComCast_Out_20_cryptomap extended permit ip 172.18.3.0 255.255.255.0 172.22.3.0 255.255.255.0
access-list ComCast_Out_20_cryptomap extended permit ip 192.168.1.0 255.255.255.0 172.22.3.0 255.255.255.0
access-list ComCast_Out_25_cryptomap extended permit ip 172.18.3.0 255.255.255.0 172.20.3.0 255.255.255.0
access-list vpn_access standard permit 192.168.10.0 255.255.255.252
access-list vpn_access standard permit 172.17.1.0 255.255.255.0
access-list vpn_access standard permit 172.18.0.0 255.255.0.0
access-list vpn_access standard permit 172.31.3.0 255.255.255.0
access-list vpn_access standard permit 172.30.1.0 255.255.255.0
access-list vpn_access standard permit 192.168.0.0 255.255.0.0
pager lines 24
logging enable
logging monitor emergencies
logging buffered warnings
logging asdm informational
mtu ComCast_Out 1500
mtu inside 1500
mtu NOT_IN_USE 1500
mtu management 1500
ip local pool vpnpool 192.168.20.2-192.168.20.254
ip local pool VPN-POOL 172.31.255.1-172.31.255.250 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
nat-control
global (ComCast_Out) 1 interface
global (NOT_IN_USE) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 192.0.0.0 255.0.0.0
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,ComCast_Out) tcp interface 3000 172.18.3.22 3000 netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface smtp 172.18.3.8 smtp netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface www 172.18.3.30 www netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface 3389 172.18.3.22 3389 netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface pptp 172.18.3.22 pptp netmask 255.255.255.255
static (inside,NOT_IN_USE) tcp interface 3000 172.18.3.22 3000 netmask 255.255.255.255
static (inside,NOT_IN_USE) tcp interface smtp 172.18.3.8 smtp netmask 255.255.255.255
static (inside,NOT_IN_USE) tcp interface www 172.18.3.30 www netmask 255.255.255.255
static (inside,NOT_IN_USE) tcp interface 3389 172.18.3.23 3389 netmask 255.255.255.255
static (inside,NOT_IN_USE) tcp interface pptp 172.18.3.22 pptp netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface 3101 172.18.3.8 3101 netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface ftp helpdesk ftp netmask 255.255.255.255
static (inside,ComCast_Out) tcp interface ftp-data helpdesk ftp-data netmask 255.255.255.255
static (inside,ComCast_Out) 29.92.14.74 172.18.3.16 netmask 255.255.255.255
access-group inbound in interface ComCast_Out
access-group outside_access_out out interface ComCast_Out
access-group inside_access_in in interface inside
access-group inbound in interface NOT_IN_USE
access-group backup_access_out out interface NOT_IN_USE
route ComCast_Out 0.0.0.0 0.0.0.0 29.92.14.78 1 track 1
route inside 192.168.0.0 255.255.0.0 192.168.10.1 1
route inside 172.17.1.0 255.255.255.0 192.168.10.1 1
route inside 172.18.0.0 255.255.0.0 192.168.10.1 1
route inside 172.31.3.0 255.255.255.0 192.168.10.1 1
route inside 172.30.1.0 255.255.255.0 192.168.10.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy vpnclient internal
group-policy vpnclient attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn_access
group-policy remote internal
group-policy remote attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value 121
http server enable
http 172.0.0.0 255.0.0.0 inside
http 192.0.0.0 255.0.0.0 inside
http 10.10.10.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 123
type echo protocol ipIcmpEcho 168.87.71.226 interface ComCast_Out
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
crypto ipsec transform-set 3des esp-3des esp-md5-hmac
crypto ipsec transform-set SHA3DES esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set 3des
crypto dynamic-map outside_dyn_map 10 set transform-set ESP-3DES-SHA
crypto map vpnremote 20 match address ComCast_Out_20_cryptomap
crypto map vpnremote 20 set peer 202.13.116.209
crypto map vpnremote 20 set transform-set ESP-DES-MD5
crypto map vpnremote 25 match address ComCast_Out_25_cryptomap
crypto map vpnremote 25 set peer 207.147.31.97
crypto map vpnremote 25 set transform-set ESP-DES-MD5
crypto map vpnremote 30 ipsec-isakmp dynamic dynmap
crypto map vpnremote 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map vpnremote interface ComCast_Out
crypto map VN1530600A 663 match address ACL663
crypto map VN1530600A 663 set pfs
crypto map VN1530600A 663 set peer 29.92.14.73
crypto map VN1530600A 663 set transform-set SHA3DES
crypto map VN1530600A 663 set security-association lifetime seconds 1800
crypto isakmp identity address
crypto isakmp enable ComCast_Out
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp nat-traversal 20
!
track 1 rtr 123 reachability
tunnel-group remote type ipsec-ra
tunnel-group remote general-attributes
address-pool vpnpool
default-group-policy remote
tunnel-group remote ipsec-attributes
pre-shared-key *
tunnel-group 29.92.14.73 type ipsec-l2l
tunnel-group 29.92.14.73 ipsec-attributes
pre-shared-key *
tunnel-group 202.13.116.209 type ipsec-l2l
tunnel-group 202.13.116.209 ipsec-attributes
pre-shared-key *
tunnel-group 207.147.31.97 type ipsec-l2l
tunnel-group 207.147.31.97 ipsec-attributes
pre-shared-key *
telnet 192.168.0.0 255.255.0.0 inside
telnet 172.0.0.0 255.0.0.0 inside
telnet timeout 120
ssh timeout 5
console timeout 0
management-access inside
dhcpd address 10.10.10.11-10.10.10.20 management
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect pptp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:82155434d3cfa69cd7217f20aaacabb7
: end
1720-A
version 12.2
service timestamps debug datetime
service timestamps log datetime
service password-encryption
!
hostname 1720-A
!
logging buffered 4096 debugging
!
memory-size iomem 20
clock timezone EST -5
clock summer-time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00
ip subnet-zero
!
!
no ip domain-lookup
ip name-server 172.18.3.24
ip dhcp excluded-address 172.20.3.1 172.20.3.20
!
ip dhcp pool dhcppool
network 172.20.3.0 255.255.255.0
default-router 172.20.3.1
dns-server 172.18.3.24 172.18.3.26
!
ip audit notify log
ip audit po max-events 100
ip ssh time-out 120
ip ssh authentication-retries 3
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key Cisco address 29.92.14.73
!
!
crypto ipsec transform-set TOWN_HALL esp-des esp-md5-hmac
crypto ipsec transform-set DES-MD5 esp-des esp-md5-hmac
crypto mib ipsec flowmib history tunnel size 200
crypto mib ipsec flowmib history failure size 200
!
crypto map VPNmap 10 ipsec-isakmp
set peer 29.92.14.73
set transform-set TOWN_HALL
match address TOWN_HALL
!
!
!
!
interface Ethernet0
ip address 207.147.31.97 255.255.255.252
ip access-group PERIMETER in
ip nat outside
half-duplex
crypto map VPNmap
!
interface FastEthernet0
description LAN
ip address 172.20.3.1 255.255.255.0
ip nat inside
speed auto
!
interface Serial0
no ip address
shutdown
!
ip nat inside source list NAT_ADDRESSES interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 207.147.31.98
no ip http server
ip pim bidir-enable
!
!
ip access-list extended NAT_ADDRESSES
deny ip 172.20.3.0 0.0.0.255 172.18.3.0 0.0.0.255
permit ip 172.20.3.0 0.0.0.255 any
ip access-list extended PERIMETER
permit udp host 29.92.14.73 host 207.147.31.97 eq isakmp
permit esp host 29.92.14.73 host 207.147.31.97
permit ip 172.18.3.0 0.0.0.255 172.20.3.0 0.0.0.255
permit icmp any any unreachable
permit icmp any any echo-reply
permit tcp any host 207.147.31.97 eq telnet
permit tcp any host 192.168.20.1 eq telnet
permit tcp any eq www any
permit tcp any eq 443 any
permit udp host 173.13.116.209 host 207.147.31.97 eq isakmp
permit esp host 173.13.116.209 host 207.147.31.97
permit ip 172.22.3.0 0.0.0.255 172.20.3.0 0.0.0.255
deny ip any any
ip access-list extended TOWN_HALL
permit ip 172.20.3.0 0.0.0.255 172.18.3.0 0.0.0.255
!
alias exec sr show run
alias exec s sh ip int br
alias exec srt show ip route
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
exec-timeout 60 0
logging synchronous
login local
transport input telnet
!
no scheduler allocate
ntp clock-period 17180009
end
1720-B
version 12.1
no service single-slot-reload-enable
service timestamps debug datetime
service timestamps log datetime
service password-encryption
!
hostname 1720-B
!
logging buffered 4096 debugging
no logging buffered
logging rate-limit console 10 except errors
!
memory-size iomem 25
clock timezone ET -5
clock summer-time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00
ip subnet-zero
no ip finger
no ip domain-lookup
ip name-server 172.18.3.24
ip dhcp excluded-address 172.22.3.1 172.22.3.20
!
ip dhcp pool dhcppool
network 172.22.3.0 255.255.255.0
default-router 172.22.3.1
dns-server 172.18.3.24 172.18.3.26
!
ip audit notify log
ip audit po max-events 100
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key Cisco address 29.92.14.73
!
!
crypto ipsec transform-set TOWN_HALL esp-des esp-md5-hmac
!
crypto map VPNmap 10 ipsec-isakmp
set peer 29.92.14.73
set transform-set TOWN_HALL
match address TOWN_HALL
!
!
!
!
interface Ethernet0
ip address 202.13.116.209 255.255.255.252
ip access-group PERIMETER in
ip nat outside
half-duplex
crypto map VPNmap
!
interface FastEthernet0
description LAN
ip address 172.22.3.1 255.255.255.0
ip nat inside
speed auto
!
ip nat inside source list NAT_ADDRESSES interface Ethernet0 overload
ip kerberos source-interface any
ip classless
ip route 0.0.0.0 0.0.0.0 202.13.116.210
no ip http server
!
!
ip access-list extended NAT_ADDRESSES
deny ip 172.22.3.0 0.0.0.255 172.18.3.0 0.0.0.255
deny ip 172.22.3.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 172.22.3.0 0.0.0.255 any
ip access-list extended PERIMETER
permit udp host 29.92.14.73 host 202.13.116.209 eq isakmp
permit esp host 29.92.14.73 host 202.13.116.209
permit ip 172.18.3.0 0.0.0.255 172.22.3.0 0.0.0.255
permit icmp any any unreachable
permit icmp any any echo-reply
permit tcp any eq www any
permit tcp any eq 443 any
permit ip 192.168.1.0 0.0.0.255 172.22.3.0 0.0.0.255
deny ip any any
ip access-list extended TOWN_HALL
permit ip 172.22.3.0 0.0.0.255 172.18.3.0 0.0.0.255
permit ip 172.22.3.0 0.0.0.255 192.168.1.0 0.0.0.255
alias exec sr show run
alias exec s sh ip int br
alias exec srt show ip route
alias exec sri show run | i
alias exec srb show run | b
!
line con 0
logging synchronous
transport input none
line aux 0
line vty 0 4
exec-timeout 0 0
logging synchronous
login local
!
no scheduler allocate
ntp clock-period 17180266
end
