Splitting Cisco ASA interface for traffic

Question

Can I split Cisco ASA outside interface, that has public IP address, for site-to-site VPN, aceess to Internet...from that site-to-site tunnel, and client-ASA VPN connection?

Answer 1

With your comment to Ron Trunk, I am assuming that you are using two ASA firewalls and one (ASA1) is connected to Internet through outside interface and the other ASA2 is having Site to Site connectivity to ASA1 (both are in differnt location and not connected through direct L2 connectivity). You want the user's behind ASA2 inside interface to use the Internet connectivity of ASA1..

If my assumption is correct, we can make it simple as below,

1. Place default route i.e., 0.0.0.0 towards Internet at ASA1 via its outside interface, so that all unknown public IP's will be routed towards Internet.

2. Place default route to next hop of ASA2 via outside interface.

3. Built the tunnel between ASA1 outside interface to ASA2 outside interface. So you have to bind crypto map at outside interface of both firewalls.

4. Allow ASA2 inside interface subnet (user's subnet) as local proxy and "any" as remote proxy in encryption domain of ASA2

5. In the encryption domain of ASA1, allow source (local proxy) as "any" and destination(remote proxy) as ASA2 inside interface.

6. If you want to block ASA1 inside talking to ASA2 inside, place deny statement in encryption domain between ASA1 inside and ASA2 inside *optional

7. With this, if a user sitting behind ASA2 inside try accessing internet, it will reach ASA2 inside, match the encryption domain, getting encrypted and send to ASA2 through tunnel. At ASA2, it will get decrypt and look for route for its public destination. Since we have default route towards outside interface, it will try to push the traffic through outside interface.

8. Here, the traffic entered into ASA1 through outside interface (Security level 0 - example) and trying to exit through the same outside interface (Security level 0) but by default, ASA won't allow traffic between the interfaces having same security level. So to make it work we have to permit the traffic between same security level interfaces. Below are those commands.

"same-security-traffic permit intra-interface" - this will allow the traffic entering and exiting through the same interface.

"same-security-traffic permit inter-interface" - this will allow the traffic entering and exiting through different interfaces having same security level.

9. So if you configure this, the traffic from ASA2 inside interface will take the default route of ASA1 and reaches Internet.

10. Return communication will happen vice versa.

Cisco link explaining security level - http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/intparam.html#wp1039276

You can built, remote access VPN bind to outside interface of ASA1 for home user connectivity and they can take the same site to site to reach ASA2 inside if required.

If you want further explanation with configurations, I could provide.

Answer 2

Yes. Think of the VPN tunnels (S2S and remote access) as additional logical interfaces.