Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

Question

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-Datacenter subnet too which is 172.20.0.0 and confused how do i add that remote subnet in my IPsec tunnel?

We have following ACL for interesting traffic.

access-list ACL-VPN extended permit ip 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0

I have tried add following ACL to see if it work but it didn't work.

access-list ACL-VPN extended permit ip 10.0.0.0 255.0.0.0 172.20.0.0 255.255.0.0

EDIT

My ASA Config:

crypto isakmp identity 49.XX.XX.101
crypto ikev1 enable outside
crypto ikev1 policy 100
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400
!
tunnel-group 49.XX.XX.101     type ipsec-l2l
tunnel-group 49.XX.XX.101     ipsec-attributes
ikev1 pre-shared-key  SuperSecret

!
crypto ipsec ikev1 transform-set TSET esp-3des esp-md5
!
crypto map VPN 10 match address ACL-VPN
crypto map VPN 10 set peer 49.XX.XX.101
crypto map VPN 10 set ikev1 transform-set TSET
crypto map VPN 10 set security-association lifetime seconds 3600
!
access-list ACL-VPN extended permit ip 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0
!
nat (any,outside) source static 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 destination static 172.16.0.0 255.255.0.0  172.16.0.0 255.255.0.0

Answer 1

1

What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:

At your end:

1. Add Crypto ACL for additional subnet. You already did this.

2. Add Interface ACL for additional subnet. I do not see rules for 172.16.0.0/16 in your configuration. Anyway, if you have rules configured for 172.16.0.0/16, you have to do the same for 172.20.0.0/16.

3. Add NAT Exemption statement for additional subnet such as:

   nat (any,outside) source static 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 destination static 172.20.0.0 255.255.0.0 172.20.0.0 255.255.0.0
   

4. Add a route for additional subnet. I do not see a route for 172.16.0.0/16 in your configuration, so I assume you have a default route. Otherwise, if you have a route for 172.16.0.0/16, you have to configure a similar route for 172.20.0.0/16.

At your US DC customer end:

On the device where VPN tunnel configured, they also have to update their VPN configuration (mirror points #1 - #3 mentioned above) for additional/second subnet 172.20.0.0/16 (EU DC).

In US DC network, they do not need the point #4, because they already a route for your network (10.0.0.0/8). However, they would need a route for their EU DC subnet on the device where VPN tunnel configured.

And At your EU DC customer end:

They would need a route for your network (10.0.0.0/8) with next-hop IP address located at US DC, so that the return traffic could be sent back through VPN tunnel.

=====

When everything is properly configured, VPN traffic from your network (10.0.0.0/8) to EU DC subnet (172.20.0.0/16) would hit the device (where VPN tunnel configured) at US DC. This traffic is decrypted, and then is forwarded/routed to US DC backbone network, then forwarded to EU DC via DC-Link. At EU DC, return traffic is sent back to US DC via DC-Link again thanks to newly-configured route I mentioned above.

2

Regarding the configuration on your ASA, you should avoid using IP addresses/subnets and TCP/UDP ports directly in your ACL and NAT rules as much as possible. It is ugly and would take you lot of efforts and time to maintain the configuration and troubleshoot when issues happen.

Always put them into an object or object-group with meaningful name. If you need to change or update the configuration related to them, you just only need to update that object or object-group.

==========

I hope it is helpful and you can get it worked.