enable lan2lan connection via "webpage"

[gerard van rij]

Dear all,

we have a cisco ASA 5510 which is also used for lan2lan connections. we have the following "problem".

certain companies can only have access when we allow. currently this has to be done via ASDM/SSH. is there a way to make this easier? e.g. via a script or webpage? so that an end user can do this and that they don't have to rely on the IT guys.

regards,

Gerard

[raga.fusionet]

Hello Gerard,

There is no easy way to do this, not a Cisco supported way if you want to call it like that.

The only way to disable a L2L tunnel would be thru SSH or ASDM.

Now if you manage to create a script that logs in to the ASA via SSH and does something like:

no crypto map outside_map 1 match address outside_1_cryptomap

That would "disable"  your first tunnel. To enable it you would have to do the equivalent but with

crypto map outside_map 1 match address outside_1_cryptomap

You can then invoke the script from a CLI or a Web page.

I think that is the closest thing you could do and that would allow you "disable" tunnels without having to get in the ASA and do it manually.

I hope this helps.

Raga

[gerard van rij]

I will give this tutorial a try

http://www.xpresslearn.com/cisco/general/automate-cisco-commands-from-windows

[raga.fusionet]

Yeah, Exactlly that's kind of what you need. Perl is also a very strong languaje for scripting, if you have someone on your team that knows Perl Scripting it might be even easier.

I hope this helps.

Raga

Please remember to mark this question as answered. Thanks!

[gerard van rij]

Dear Raga,

the only thing I think I need to sort is a privilage level for a user

privilege level 5 mode group-policy "command"

any idea how this works?

via ADSM I got the following commands to enable and disable a lan2lan connection

enable

      group-policy lan-2-lan-test attributes

        vpn-tunnel-protocol svc IPSec

disable

      group-policy lan-2-lan-test attributes

        vpn-tunnel-protocol svc

thanks

Gerard

[raga.fusionet]

Gerard, to be hones I've never played with privilege levels so I cant really guide you on that. However, someone else asked about it before.

Feel free to check the following post:

https://supportforums.cisco.com/thread/2040973

I hope this helps.

Have fun.

Raga.

[vabruno]

Gerald,

I would like to give you another option rather the taking the tunnel down you cam created timed ACL's which will allow you to disable all or portions of the tunnel access rather than an all on/off switch which is what your script will do. If you are looking for the flexibility to possibly monitor a device across the tunnel but disable all other access then just use timed acl's to achieve this. This way you cam monitor the uptime of your tunnels and avoid technical issues after enabling the tunnel.

Sent from Cisco Technical Support iPhone App