3

(newbie Cisco here)

I have an IPSEC vpn site to site tunnel between two ASAs. I have a set of networks in each location protected by the VPN tunnel.

So far, so good.

I would like to also protect traffic originated by the remote ASA, because I have an authentication server on this side.

Thanks!

Improve this question
5
  • serverfault.com/questions/346557/… (pre-dates NE)
    – Ricky
    Commented May 29, 2015 at 1:00
  • Can you clarify and add a specific question? Are you having routing issues?
    – Citizen
    Commented May 29, 2015 at 5:24
  • How can I protect traffic originated on the remote ASA? If I ping from the remote ASA (CLI) , I see it's using the External interface (internet) as source IP, but it's not going through the IPSEC tunnel.
    – Sergio
    Commented Jun 2, 2015 at 22:19
  • Not to be nit picky but protect and encrypt are two very different concepts. Nothing networked is truly protected (e.g. iCloud hack, Fed gov't breach, Iranian Nuclear Power Plant breach, Merkels cell phone tapped, etc.) Ultimately if you want to protect information, do not store or transmit it in electronic format. Again, I don't mean to sound nit picky but this is an important point.
    – Ronnie Smith
    Commented Jun 16, 2015 at 2:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 17:02

2 Answers 2

Reset to default
2

management-access Configure management access interface

In short, that's a the global configuration command to tell the system what interface is used for management (i.e. any traffic generated by the ASA itself.) Cisco's documentation fails to mention that, btw.

Improve this answer
3
  • I setup the Internal interface as management-access, but still the source IP is the External interface.
    – Sergio
    Commented Jun 2, 2015 at 22:20
  • I assume your aaa-server is defined on "(inside)"?
    – Ricky
    Commented Jun 3, 2015 at 4:46
  • My aaa-server is in site A. This ASA is the IPSEC termination in Site B. I want to configure aaa in site B, authenticating against a Radius server residing in Site A.
    – Sergio
    Commented Jun 4, 2015 at 15:37
1

There was a missing NAT line in the config, so traffic wasn't properly protected.

:-(

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.