site-to-site tunnel (subinterfaces)

[allenelson]

ASA5520 7.2(1)

is it possible to setup l2l tunnels on an asa when the LAN terminates on a sub interface?

i have data and voice networks split on two seperate devices. data defaults to the asa, voice defaults to a master switch for inter-vlan routing.

l2l tunnels with interesting traffic on the inside interface work fine. that being said, on the sub interface traffic will not pass from node to node. it will however, successfully pass traffic from a switch sitting behind the firewall to the remote end.

remote access tunnels seem to work fine.

before i gave up tonight, i rebuilt the tunnel, and added interesting traffic from the inside subnet (192.168.10.x) and the subinterface subnet (192.168.143.x).

traffic passed from node to node on the 10.x subnet 100%, the 143.x subnet would not.

if you would like to see configs ask. thanks in advance.

--------------------------------------------

edit

i confused myself after reading this, the remote end is 10.100.100.x.

[0/1] 192.168.10.x ----------------- 10.100.100.x [OK]

[0/1.143]192.168.143.x ------------- 10.100.100.x [BAD]

[bwilmoth]

I think subinterface can be used to setup l2l tunnels. If you use subinterfaces, you typically do not also want the physical interface to pass traffic, because the physical interface passes untagged packets. Because the physical interface must be enabled for the subinterface to pass traffic, ensure that the physical interface does not pass traffic by leaving out the *nameif* command. If you want to let the physical interface pass untagged packets, you can configure the *nameif *command as usual.

Following link may help you

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/intrface.html