10-06-2012 04:16 AM
hi all,
here is my scanrio,
i have 3 sites siteA : HeadOffcie(Router 3825) , siteB : Datacenter(ASA5520) siteC:branch(Router 2911).
site A - static ip
site B -- static Ip
Site C -- Dynamic IP.
i configured site to site vpn between site A to Site B (Static to Static) and SIte B to Site C (Dynamic to Static).
now i want to use some of the hosts on the headoffice via Dataacenter because both from HO to branch Connecting to Datacenter.
i was used of Hairpinning with routers but in the ASA is there any limitation on Dynamic to static Vpn on hairpinning
i will provide my network address can anybody provide me the ACL
Site A : 10.66.102.0/24
SiteB : 10.222.0.0 /24
SiteC : 10.222.2.0 /23
From both sides VPN is working fine .only hairpinnig is not working.
thanks
cyril
10-06-2012 04:37 AM
Hi Cyril,
On Site B ASA, you would need to configure the following:
1) same-security-traffic permit intra-interface
2) Crypto ACL towards Site A:
access-list
On site A:
1) NAT exemption:
access-list
On site C:
1) Crypto ACL towards Site B:
access-list
2) NAT exemption:
access-list
10-06-2012 05:37 AM
it means,
no need to add any nat exempt or crypto acl on the asa ?
suppose we are connecting 2 or 3 additional sites to the same Datacenter , i need to add only on the branch side and also in the HO side. in ASA i no need to add any ACL traffic to pass.
is that correct?
10-06-2012 05:52 AM
You are absolutely correct for NAT exemption ACL on the ASA.
But on the ASA, you would still need to configure crypto ACL as I have listed above.
10-07-2012 05:51 AM
hi jeni,
is there any version matters in the configuration because i am using asa 8.2.5
10-07-2012 08:41 AM
Hello,
No version required for this, go ahead and tried what Jennifer requested.
Regards
10-07-2012 12:58 PM
Hi Cyril,
It doesn't matter which version of ASA as they are all supported.
Let us know how you go after the above changes.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide