ASA with EZVPN

[rafik.harrar]

Hi,

Im having trouble configuring with EZVPN on ASA5510.

EZVPN uses the local Lan as the source IP, now since the EZVPN is configured on the ASA, it will use its local port 2.2.2.1 as the source local LAN. The actual local network is behind a firewall and i need the tunnel to extend to the 10.10.10.10 network. Is there a way to extend the tunnel to use the 10.10.10.10 as the source LAN? And does anyone know how to do it via the GUI? I hope this makes sense.

[Jennifer Halim]

No, you can't extend the subnet to be encrypted through EZVPN tunnel to the subnet a few hops away from the ASA.

For EZVPN, it only supports one local interface subnet that has the highest security level configured on the ASA.

For what you want to do, it is best to configure site-to-site VPN tunnel instead.

[rafik.harrar]

Hi Jennifer,

thanks for the reply. The customer doesnt support site-to-site vpn and they only use EZVPN for some security reason. any other suggestions with ASA?

[Jennifer Halim]

The only other solution would be to PAT/NAT the 10.10.10.10 subnet to an ip address within the 2.2.2.x subnet (whether it's the FW IP: 2.2.2.2, or any other ip address within the 2.2.2.x subnet).

That way, the 10.10.10.10 subnet can access the EZVPN tunnel.