06-23-2010 10:17 AM - edited 02-21-2020 04:42 PM
I have an ASA serving mostly as a data center firewall and as user remote access. I recently added a LAN2LAN IPsec tunnel to a temporary office. But I notice that the remote IPsec tunnel can not reach the spoke LAN.
So imagine home user with laptop 192.168.1.100 and he creates a split IPsec tunnel to the ASA whereby 10.0.0.0/8 is encrypted/tunneled.
No off of the ASA is a LAN to LAN tunnel to an office with IP block 10.10.70.0/24. How could the home user reach a device at the remote site on the 10.10.70.0 network? Is this possible?
Solved! Go to Solution.
06-23-2010 10:35 AM
There are mutliple examples even on the forums here.
First of all you need to allow U-turn on same interface of ASA (if you terminate crypto on one interface only).
same-security perm intra-interface
Following this you will need to allow remote-access subnet to go to the remote lan-to-lan subnets.
I'd also suggest to add reverse route injection to avoid routing problems on ASA.
Remember that also that remote l2l device will need to be adjusted (possibly nat, routing and access-list adjustments).
Doc example:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml
06-23-2010 10:35 AM
There are mutliple examples even on the forums here.
First of all you need to allow U-turn on same interface of ASA (if you terminate crypto on one interface only).
same-security perm intra-interface
Following this you will need to allow remote-access subnet to go to the remote lan-to-lan subnets.
I'd also suggest to add reverse route injection to avoid routing problems on ASA.
Remember that also that remote l2l device will need to be adjusted (possibly nat, routing and access-list adjustments).
Doc example:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide