cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
268
Views
5
Helpful
3
Replies

Cisco ASA Site to Site VPN routing

kay.kang
Beginner
Beginner

Hi,

As far as I know, routing doesn't need to be set when set up Site to Site VPN on ASA as there is source and destination info on interesting traffics. (please correct me if I am understanding wrong).

I set a new site to site VPN with interesting traffic(destinations 10.2.2.2/32 and 10.2.2.3/32).

Two hosts are used to use WAN link before the VPN setup. We want two hosts send traffic over the new site to site VPN now. But It seems FW_A sends traffics through WAN when try to ping between 10.1.1.10 and 10.2.2.2, not through the site to site VPN. I guess FW-A still takes the existing routing(10.2.2.0/24).

Is there anything that I need to set to direct traffics through the site to site VPN?

BTW, we should keep 10.2.2.0/24 routing for other host's transaction over the WAN link.

VPN diagram.PNG

 

3 Replies 3

Rob Ingram
VIP Expert VIP Expert
VIP Expert

@kay.kang in a Policy Based VPN traffic must be routed to the correct egress interface, if the src/dst matches the interesting traffic in the crypto ACL, it is encrypted and routed over the tunnel. In this instance as you've a specific route via the WAN interface, it's sent going to go via the WAN and will not be routed via the VPN tunnel over the internet.

Setup a specific route via the internet interface with a lower priority than the WAN interface. You can then use IP SLA to failover to the WAN interface if the internet interface fails.

Seb Rupik
VIP Advisor VIP Advisor
VIP Advisor

Hi there,

From your description it sounds as if you need to configure a NAT exemption rule for the 'interesting' traffic as it is leaving the WAN/ outside interface.

This will ensure the interesting traffic is not source NAT'd as it leaves the interface, it is therefore picked up by the VPN ACL and exits via the VPN.

 

cheers,

Seb.

YazeedAshrafi
Beginner
Beginner
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers