Can I split Cisco ASA outside interface, that has public IP address, for site-to-site VPN, aceess to Internet...from that site-to-site tunnel, and client-ASA VPN connection?
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.– Ron Maupin ♦Aug 7, 2017 at 16:16
Add a comment
|
2 Answers
With your comment to Ron Trunk, I am assuming that you are using two ASA firewalls and one (ASA1) is connected to Internet through outside interface and the other ASA2 is having Site to Site connectivity to ASA1 (both are in differnt location and not connected through direct L2 connectivity). You want the user's behind ASA2 inside interface to use the Internet connectivity of ASA1..
If my assumption is correct, we can make it simple as below,
Place default route i.e., 0.0.0.0 towards Internet at ASA1 via its outside interface, so that all unknown public IP's will be routed towards Internet.
Place default route to next hop of ASA2 via outside interface.
Built the tunnel between ASA1 outside interface to ASA2 outside interface. So you have to bind crypto map at outside interface of both firewalls.
Allow ASA2 inside interface subnet (user's subnet) as local proxy and "any" as remote proxy in encryption domain of ASA2
In the encryption domain of ASA1, allow source (local proxy) as "any" and destination(remote proxy) as ASA2 inside interface.
If you want to block ASA1 inside talking to ASA2 inside, place deny statement in encryption domain between ASA1 inside and ASA2 inside *optional
With this, if a user sitting behind ASA2 inside try accessing internet, it will reach ASA2 inside, match the encryption domain, getting encrypted and send to ASA2 through tunnel. At ASA2, it will get decrypt and look for route for its public destination. Since we have default route towards outside interface, it will try to push the traffic through outside interface.
Here, the traffic entered into ASA1 through outside interface (Security level 0 - example) and trying to exit through the same outside interface (Security level 0) but by default, ASA won't allow traffic between the interfaces having same security level. So to make it work we have to permit the traffic between same security level interfaces. Below are those commands.
"same-security-traffic permit intra-interface" - this will allow the traffic entering and exiting through the same interface.
"same-security-traffic permit inter-interface" - this will allow the traffic entering and exiting through different interfaces having same security level.
So if you configure this, the traffic from ASA2 inside interface will take the default route of ASA1 and reaches Internet.
Return communication will happen vice versa.
Cisco link explaining security level - http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/intparam.html#wp1039276
You can built, remote access VPN bind to outside interface of ASA1 for home user connectivity and they can take the same site to site to reach ASA2 inside if required.
If you want further explanation with configurations, I could provide.
-
Thank for answer. Lets talk about outside interfaces from both ASA-s. Correct me if I wrong, on ASA1 I only need physical interface with public IP subnet 1. On second ASA, ASA2, I need physical interface with IP subnet 1, these interfaces will be used for tunnel creation, but I need two more sub interfaces on ASA 2, with two different IP subnets? One for internet client-ASA VPN connection, and one for Internet gateway?– JohnOct 12, 2015 at 8:34
-
-
-
-
Yes. Think of the VPN tunnels (S2S and remote access) as additional logical interfaces.
answered Oct 9, 2015 at 14:56
-
Does anyone have maybe conf file of some kind...I need site to site VPN between two ASA-s. I want users from both places go to Internet from one place, and also that client from internet can be attached to ASA VPN. Maybe some link? Best practise?– JohnOct 9, 2015 at 16:11