cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
1177
Views
0
Helpful
5
Replies
zubair.sipra
Beginner

how to add another vlan subnet in existing EzVPN setup

I am using EasyVPN:


Head Office(ASA 5510 with public ip) connected to SiteOffice(Cisco Router 2810 with PPPoE)

Head Office network: 192.168.2.0/24

Site Office network: 192.168.1.0/24

Everything is working fine.


Now I have another VLAN subnet(192.168.100.0/24), how I can add this network with existing easyVPN setup?


Note: Network Diagram and Configurations are attached.


thanks

5 REPLIES 5
czaja0000
Beginner

Hi,

Possible solution.

You need to create VLANs on the ASA.

ASA reconfiguration.

For example:

1. Define VLANs on ASA5510

interface Ethernet0/0

description Trunk-to-SWxxx

no nameif

no security-level

no ip address

no shutdown

interface Ethernet0/0.1

description LAN

vlan 1

nameif inside

security-level 100

ip address 192.168.2.246 255.255.255.0

no shutdown

interface Ethernet0/0.10

description Network-VLAN-100

vlan 100

nameif zzzz

security-level 100

ip address 192.168.100.254 255.255.255.0

no shutdown

interface Ethernet0/0.20

description Network-VLAN-1010

vlan 1010

nameif uuuuuu

security-level 100

ip address 10.10.10.254 255.255.255.0

no shutdown

2. Modification on Easy VPN Server

A) NAT-0

access-list no-nat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list no-nat extended permit ip 192.168.100.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list no-nat extended permit ip 10.10.10.0 255.255.255.0 192.168.1.0 255.255.255.0

B) Define the traffic that should pass through the tunnel.

Remove existing standard ACL: Split_Tunnel_List and create new.

access-list Split_Tunnel_List extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list Split_Tunnel_List extended permit ip 192.168.100.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list Split_Tunnel_List extended permit ip 10.10.10.0 255.255.255.0 192.168.1.0 255.255.255.0

Switch SW modification.

Configure interface fa1/2 on SW as TRUNK !!

________________

Best regards,
MB

________________ Best regards, MB

Dear MB,

My question, if i will create vlan sub-interfaces with IP on ASA then how router will forward its traffic to those all, because on Router there is only one static route directed to interface ip 192.168.2.246/24(ASA vlan-1 interface), do i need to add any other static route on router or one route is enough or anything else ?

thanks

zubair sipra napisano:

Dear MB,

My question, if i will create vlan sub-interfaces with IP on ASA then how router will forward its traffic to those all, because on Router there is only one static route directed to interface ip 192.168.2.246/24(ASA vlan-1 interface), do i need to add any other static route on router or one route is enough or anything else ?

thanks

In this scenario, by me, static routes can't be used.

I suggest use the feature: Policy Based Routing (PBR)  on the router.

Can you specify the model of switch (SW)?

Is there switch L2 or L3?

Maybe may solve your problem otherwise...

________________

Best regards,
MB

________________ Best regards, MB

Dear MB,

it is 3com L3 switch and model #  "3Com Switch 4800G".

I think if i use PBR even then i need to mention next hop, then what will be next hop ip address?

thanks


Hi,

next hop - it must be address of the appropriate interface on the ASA.

I'm sorry, but I don't have great knowledge about 3Com devices.

________________ Best regards, MB
Content for Community-Ad