5

I have two L2L VPNs connected to a central ASA. I want these VPNs to communicate with each other but there are some caveats i'm having issues with.

On the first VPN (VPN1), everything is working fine. This is a more "traditional" IPSEC VPN, with limited to no NAT. That is to say that everything communicates via real addresses and traffic is routed through the use of an interesting ACL. There are no problems here: HQ and VPN traffic move just fine to one another.

On the second VPN (VPN2), a newly provisioned link, I want clients on VPN2 to communicate with a server at VPN1. The challenge is that VPN2 uses IP space that overlaps with VPN1 and with the headquarters ASA that both of these VPNs connect to.

I want VPN2's traffic, all of it, to PAT to a single address. Headquarters should see this traffic as the PAT'd address and should never see the real addresses. In an ideal world, this PAT would be handled on VPN2 so that HQ doesn't need to know any details or manage any specifics. From HQ's perspective, and from VPN1's perspective, all traffic is simply sourced from an address that is in the interesting traffic ACL.

Additionally, once the PAT traffic hits HQ, another NAT needs to take place. This time, HQ needs to NAT, on a 1:1 basis, traffic going to servers in a "hidden" subnet. HQ exposes a subnet (which is in the interesting traffic ACL of VPN2's ASA, and thus encrypted via ipsec). The logical way you would do this on today's ASA code is 

object network foo
 nat (outside,outside) static foo.bar.baz.bang

I can't seem to get a configuration with the following characteristics to work:

  • HQ ASA: Twice NAT with the source being the PAT address of VPN2 and the destination being the hidden and real subnets of VPN1
  • HQ ASA: Simple NAT (with only the straight exposed "hidden" subnet)

I'd like to figure out what the right configuration model is to achieve this. Ideally, my requirements would be that VPN2 only shows up to me as a PAT (and it should be handled on their end), and HQ ASA handles the NAT for traffic from VPN2 to VPN1.

So:

  • HQ talks to VPN1 normally (10.4.0.0->10.5.0.0)
  • I want clients at VPN2 to talk to servers behind VPN1 (192.168.1.1->192.168.200.1)
  • I want HQ to NAT VPN1's "real addresses" to a "hidden subnet" for VPN2 (192.168.200.0->10.5.0.0)
  • I want VPN2's clients to be seen as a single address (PAT) (10.4.0.0->192.168.1.1)
  • Ideally VPN2 would do its own PAT before the traffic ever gets to me (10.4.0.0->192.168.1.1)
  • The interesting traffic ACLs are all correct
  • All devices are running 8.4+ (some 9.x+)
                                        +----+        
                                        |SRV |       
                 Outside +--------+     +----+        
                +-------->  FW1   +-----+             
                |        +--------+ Inside            
                |                           
                |                                     
+----+          |                            +-------+
| HQ |  outside |                            |Client1|
|----+----------+        +--------+          +-------+
                  |        |  FW2   |          |        
                  +--------+--------+----------->       
                   Outside                     |        
                                               +-------+
                                               |Client2|
                                               +-------+
                        
Improve this question
6
  • 1
    Could you add IP examples to your question? They don't have to be your real IP space, but as is I'm having a hard time following what you wanted NAT-ed where and when =/
    – Eddie
    Dec 27, 2014 at 16:40
  • Added some IP addressing. If I need to re-clarify anything, let me know. Basically FW0 wants to NAT the spoke-to-spoke traffic from FW2 to FW1, but FW2 does some NAT on its side as a precursor before FW0 receives its traffic.
    – Arima
    Dec 30, 2014 at 0:49
  • The question could still use a bit more clarity. Your description of the traffic flows only include "NAT", then your desired traffic details start mentioning a PAT address. Also, your sample configuration contains no IP addresses of your current setup. That would help me understand what is going on. As it stands, I think you want FW0 to NAT traffic between FW2 and FW1, even though FW2 already NAT's the traffic once. If so, that is absolutely possible, but until I know exactly how it is currently working, I won't be able to offer a solution for your intended request.
    – Eddie
    Dec 31, 2014 at 21:17
  • Specifically, please include all the relevant NAT and Encryption Domain portions of FW0, FW1, and FW2. That would indicate definitively what is going on. Then please describe definitely what you want changed, or how you want it to work.
    – Eddie
    Dec 31, 2014 at 21:18
  • @Eddie I added a bunch of details and reworded the question. Can't include even sanitized configs but hopefully there's enough detail here.
    – Arima
    Jan 5, 2015 at 17:48

1 Answer 1

Reset to default
2

This is a really old post, and that's a complex set of requirements. But I'll try to answer this question for anyone else who may be looking to do a similar thing.

First, a diagram:

enter image description here

Now, some notes:

  1. I did not actually test this in a lab, but it should work in real life.
  2. I chose not to do the VPN1<->VPN2 NAT on the HQ, although you can using nat (outside,ouside) .... In order to keep the HQ config more simple, I have the spokes do their own NAT towards each other.
  3. Because of the PAT on VPN2, no traffic will be able to enter VPN2 unless it originated from there. I assume that's what you wanted. If not, just create a twice NAT (a.k.a., A manual NAT) higher up in the order to do something different, instead.

Now, the code:

!! VPN1
access-list crypto_vpn1_acl permit ip 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
access-list crypto_vpn1_acl permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
object network obj_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
object network obj_192.168.200.0_24
 subnet 192.168.200.0 255.255.255.0
object network obj_10.4.0.0_24
 subnet 10.4.0.0 255.255.255.0
object network obj_10.5.0.0_24
 subnet 10.5.0.0 255.255.255.0
nat (inside,outside) source static obj_10.5.0.0_24 obj_10.5.0.0_24 dest static obj_10.4.0.0_24 obj_10.4.0.0_24
nat (inside,outside) source static obj_10.5.0.0_24 obj_192.168.200.0 dest static obj_192.168.1.0_24 obj_192.168.1.0_24
route outside 10.4.0.0 255.255.255.0 x.x.x.x
route outside 192.168.1.0 255.255.255.0 x.x.x.x

!! HQ
same-security-traffic permit intra-interface
access-list crypto_vpn1_acl permit ip 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
access-list crypto_vpn1_acl permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0
access-list crypto_vpn2_acl permit ip 10.4.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list crypto_vpn2_acl permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
object network obj_10.4.0.0_24
 subnet 10.4.0.0 255.255.255.0
object network obj_10.5.0.0_24
 subnet 10.5.0.0 255.255.255.0
object network obj_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static obj_10.4.0.0_24 obj_10.4.0.0_24 dest static obj_10.5.0.0_24 obj_10.5.0.0_24
nat (inside,outside) source static obj_10.4.0.0_24 obj_10.4.0.0_24 dest static obj_192.168.1.0_24 obj_192.168.1.0_24
route outside 10.5.0.0 255.255.255.0 x.x.x.x
route outside 192.168.1.0 255.255.255.0 x.x.x.x

!! VPN2
access-list crypto_vpn2_acl permit ip 192.168.1.0 255.255.255.0 10.4.0.0 255.255.255.0
access-list crypto_vpn2_acl permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0
object network obj_10.5.0.0_24
 subnet 10.5.0.0 255.255.255.0
object network obj_pat_address
 host 192.168.1.1
object network obj_10.4.0.0_24
 subnet 10.4.0.0 255.255.255.0
object network obj_192.168.200.0_24
 subnet 192.168.200.0 255.255.255.0
nat (inside,outside) source static obj_10.5.0.0_24 obj_pat_address dest static obj_10.4.0.0_24 obj_10.4.0.0_24
nat (inside,outside) source dynamic obj_10.5.0.0_24 obj_pat_address dest static obj_192.168.200.0_24 obj_192.168.200.0_24
route outside 10.4.0.0 255.255.255.0 x.x.x.x
route outside 192.168.200.0 255.255.255.0 x.x.x.x

Hope this helps somebody.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.