heather.burke wrote:
I have been working with another agency to set up a site to site VPN. During the course of this, we have run into several areas
where I fail to understand what they are saying. I have never done this before, but some of what they are saying is challenging some of my basic conceptions of how this process works, so I thought I would throw it out there and see what comes back.
Right now, we have a dynamic PAT to access the internet. To get our VPN traffic routed correctly, it would have to be outside of this, obviously. It was suggested that I put in Static NAT entries to tell that traffic how to be handled. The other agency has come back and said that this would send all that traffic in an unencrypted manner, outside of the tunnel. Is this true?
They also said that the only way to get VPN traffic to be routed correctly is to put a route on the internal switch, which would tell it where to go when it hits the firewall. I do not understand this. Isn't it on the ASA itself that it has to recognize which traffic to encrypt and which traffic not to? Why would the internal switch have anything to do with that? Since the traffic will come in an internal interface and leave via the external interface (albeit encrypted) the route should remain the same, shouldn't it? The tunnel would still take the same physical route to the endpoint, only encrypted, and then unencrypted at the specificed endpoint. They speak about it as a subinterface, which although setup for the VPN traffic, still travels through the external interface, right?
Any help clearing up my confusion would be appreciated. I feel like I'm missing a major part of the picture here.
You want to prevent NAT for traffic crossing the tunnel. Depending on the version of OS you're running, there are a couple of ways to do this. It's typically called NAT exempt or NAT 0. You will need a route in your network stating how to get ot the remote network, most people put this on the core router/switch. You are correct about all traffic leaving the outside interface/route.
