ASA Easy VPN remote and multiple subnets

[jmcburnett]

I've been reading changes in EASY VPN remote/server for the ASA and I don't see a clear answer regarding multiple VLANS.

I have multiple VLANS behind an ASA and want them all to connect across an EASY VPN Remote connection.

If this is correct who has a config sample for this or a link?

It should just be an ACL and usable via vpn remote.

Thanks,

Jim

[rvarelac]

Hi ,

According to the documentation. This might apply to your case. 

NEM with Multiple Interfaces

If you have an ASA 5505 security appliance (version 7.2 (3) and higher) configured as an Easy VPN Client in Network Extension Mode with multiple interfaces configured, the security appliance builds a tunnel for locally encrypted traffic only from the interface with the highest security level.

For example, consider the following configuration:

vlan1 security level 100 nameif inside
vlan2 security level 0 nameif outside
vlan12 security level 75 nameif work

In this scenario, the security appliance builds the tunnel only for vlan1, the interface with the highest security level. If you want to encrypt traffic from vlan12, you must change the security level of interface vlan1 to a lower value than that of vlan 12.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/ezvpn505.html#wp1025408

Is there any special reason to use EzVPN instead a regular Site-to-Site VPN ? 

Hope it helps

-Randy-

[mvsheik123]

Hi Jim,

In addition to what Randy mentioned, with 5505 as EasyVPN client, multiple vlans sitting behind ASA- will not work. Only directly connected Vlans work. The other option is use router (ex:800) as client. That works for this scenario.

hth

MS

[jmcburnett]

Cisco TAC just told me that this will work with the latest code..

I am waiting for the details...

[mvsheik123]

Thanks for the rating. Please post details once confirmed (on 5505).Interested to know.

Thx

MS

[jmcburnett]

I talked to one of the CCIE's at the local Cisco office and he told me that was fixed..

This link:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/asdm75/vpn/asdm-75-vpn-config/vpn-easyvpn.pdf

Has a section about NEM that mentions HOSTS on inside networks.. I guess I need to test this theory.

Easy VPN over regular static VPNs for scale and change control.. This would allow for head end change and re-auth of the VPN without changing EVERY remote site..

It may just become a DMVPN solution...