Revisions to Cisco site-to-site vpn multiple subnet route over tunnel

edited body

Source Link

edited Oct 25, 2017 at 8:02

3.8k
1
10
13

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly:. This make the configuration look nicer.

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 6070.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And please ensure to reflect the same setup at AWS end.

I hope it is helpful.

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly:

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 60.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And please ensure to reflect the same setup at AWS end.

I hope it is helpful.

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly. This make the configuration look nicer.

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 70.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And please ensure to reflect the same setup at AWS end.

I hope it is helpful.

added 4 characters in body

Source Link

edited Oct 25, 2017 at 7:45

Hung Tran

3.8k
1
10
13

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly:

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 60.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And make sureplease ensure to reflect the same setup at AWS end.

I hope it is helpful.

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly:

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 60.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And make sure to reflect the same setup at AWS end.

I hope it is helpful.

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly:

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 60.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And please ensure to reflect the same setup at AWS end.

I hope it is helpful.

Source Link

created Oct 25, 2017 at 7:20

Hung Tran

3.8k
1
10
13

You can try to put all subnets under single network object-group, then modify your ACL, crypto ACL and NAT Exemption rules accordingly:

For example:

object-group network Local_subnets
 network-object 10.0.0.0 255.0.0.0
 network-object 60.x.x.x 255.255.255.0
 network-object 60.x.x.x 255.255.255.0

object-group network AWS_subnets
 network-object 10.100.1.0 255.255.255.0

 
access-list inside extended permit tcp object-group Local_subnets object-group AWS_subnets   

access-list ACL-VPN extended permit tcp object-group Local_subnets object-group AWS_subnets

nat (inside,outside) source static Local_subnets Local_subnets destination static AWS_subnets AWS_subnets no-proxy-arp route-lookup

And make sure to reflect the same setup at AWS end.

I hope it is helpful.

Stack Exchange Network

Return to Answer