How forward all traffic over ipsec vpn tunnel ?

[decryptinfo]

Hello,

Excuse me for my english, I am french.

I currently have two Cisco ASA 5505.  They are at different  physical sites (SITE A, SITE B) and are configured with a site-to-site VPN which is  active and working.

I can communicate with the subnets on either site from the other and both are connected to the internet, however I need to ensure that all the traffic at my site B goes through this VPN to my site A.

I changed this access-list :

access-list outside_2_cryptomap extended permit ip network_siteB network_siteA

to

access-list outside_2_cryptomap extended permit ip network_siteB any

But this does not work. If I do http://checkip.dyndns.org/, site B IP address  is not same that site A.

thank you for your help.

Greg

[Gustavo Medina]

Hello Greg,

The change you have made to the access-list is fine however I suppose you had a NAT EXEMPTION on ASA B when going from network_siteB to network_siteA and the rest of the traffic was being PATed to the Public ASA B address so you would need to either exempt the traffic from being translated when it goes from network_siteB to any or remove the PAT config. On the ASA A you need to configure U-turn and PAT to translate the network_siteB subnet to the ASA A public IP address. Make sure the interesting traffic on ASA A is from any to network_siteB as well.

regards,

[decryptinfo]

Thanks for info.

I removed the PAT config of ASA B. However this does not work.

For Site B, I have not internet. It's good start !

the traffic passed through not the tunnel.

I attached config Site A and config Site B.

[Gustavo Medina]

Hi,

On site_B the config looks good however on the attached config for site A there is relevant information missing, what does the DECRYPTINFO object contain? The ACL for that tunnel on Site A should be:

access-list outside_cryptomap_2 extended permit ip any object NTEWORK_SITEB

The NAT is not properly configured either, try this:

object network obj_any

nat (any,outside) dynamic interface

And make sure you have this command:

same-security-traffic permit intra-interface

Regards,

[decryptinfo]

Ok,

I will test this.

Regards

[decryptinfo]

I  changed the NAT "obj_any" however this does not work.

I simplified the attachement configuration files.

that is strange it does not work.

Regards

[Gustavo Medina]

Hello,

You still have the PAT configuration on Site B:

object network obj_any

nat (any,outside) dynamic interface object network obj_any
nat (any,outside) dynamic interface

Regards,

[decryptinfo]

Hello,

Excuse me, the PAT configuration does not exist. It was to have internet ( for send mail).

Regards.