Connectivity through 2 VPN tunnels without direct VPN tunnel

[Ejaz Ahmed]

Hi,

Can anyone help me on this.

Scenario

We have a site to site VPN connection to one of our client's head office location (ASA1 to ASA2). The VPN is configured between Cisco ASA.

From client head office (ASA2), there is another site to site VPN towards a branch office (ASA2 to Router), that is configured between ASA and a router (Cisco 2800 series). Please see attached the diagram

Question

Is it possible to access client's branch location network from our network using the two VPN tunnel (ie. from ASA1 to router without having a direct VPN. VPN for ASA1 is only towards ASA2)? If it is possible, what all additional configurations need to be done in which all devices.

Regards,

Ejaz Ahmed

[Eduardo Aliaga]

This can be done with Cisco routers, because they support route-based VPNs, and also Cisco publishes the order of operations of the packet (first check acls, then routing, then crypto, etc, etc) so you know how to avoid problems if multiple simulatenous features are conflicting each other (the most classic example NAT and crypto)

Sadly  Cisco doesn't publish the order of operations of packets in ASA. Maybe if we knew the order of operations we could have done a workaround with the configuration.

Also Cisco ASA doesn't support route-based vpns

For those reasons I say you can't do this with ASA.

Please rate if this helps.