2

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-Datacenter subnet too which is 172.20.0.0 and confused how do i add that remote subnet in my IPsec tunnel?

enter image description here

We have following ACL for interesting traffic.

access-list ACL-VPN extended permit ip 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0

I have tried add following ACL to see if it work but it didn't work.

access-list ACL-VPN extended permit ip 10.0.0.0 255.0.0.0 172.20.0.0 255.255.0.0

EDIT

My ASA Config:

crypto isakmp identity 49.XX.XX.101
crypto ikev1 enable outside
crypto ikev1 policy 100
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400
!
tunnel-group 49.XX.XX.101     type ipsec-l2l
tunnel-group 49.XX.XX.101     ipsec-attributes
ikev1 pre-shared-key  SuperSecret

!
crypto ipsec ikev1 transform-set TSET esp-3des esp-md5
!
crypto map VPN 10 match address ACL-VPN
crypto map VPN 10 set peer 49.XX.XX.101
crypto map VPN 10 set ikev1 transform-set TSET
crypto map VPN 10 set security-association lifetime seconds 3600
!
access-list ACL-VPN extended permit ip 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0
!
nat (any,outside) source static 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 destination static 172.16.0.0 255.255.0.0  172.16.0.0 255.255.0.0
  • We need to see the rest of the ASA configuration. – Ron Trunk Dec 27 '17 at 23:54
  • I have added snippet for IPsec config in my question, Tunnel is up and i can ping remote LAN 172.16.0.0 but now i want to ping 172.20.0.0 which i don't know how to do that – Satish Dec 28 '17 at 0:11
  • Need the rest of the configuration – Ron Trunk Dec 28 '17 at 0:59
  • its massive config and we have many many tunnel terminated on ASA i don't know what specific you looking for. I don't know what portion i should put here and omit all security stuff, it would be massive cut paste for me. if you point specific section i can do that, all i want to know how IPsec VPN know or route remote subnet traffic, there is no route command i can use to tell route 172.20.0.0 subnet over VPN tunnel – Satish Dec 28 '17 at 1:10
5

1

What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:

At your end:

  1. Add Crypto ACL for additional subnet. You already did this.
  2. Add Interface ACL for additional subnet. I do not see rules for 172.16.0.0/16 in your configuration. Anyway, if you have rules configured for 172.16.0.0/16, you have to do the same for 172.20.0.0/16.
  3. Add NAT Exemption statement for additional subnet such as:

    nat (any,outside) source static 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 destination static 172.20.0.0 255.255.0.0 172.20.0.0 255.255.0.0
    
  4. Add a route for additional subnet. I do not see a route for 172.16.0.0/16 in your configuration, so I assume you have a default route. Otherwise, if you have a route for 172.16.0.0/16, you have to configure a similar route for 172.20.0.0/16.

At your US DC customer end:

On the device where VPN tunnel configured, they also have to update their VPN configuration (mirror points #1 - #3 mentioned above) for additional/second subnet 172.20.0.0/16 (EU DC).

In US DC network, they do not need the point #4, because they already a route for your network (10.0.0.0/8). However, they would need a route for their EU DC subnet on the device where VPN tunnel configured.

And At your EU DC customer end:

They would need a route for your network (10.0.0.0/8) with next-hop IP address located at US DC, so that the return traffic could be sent back through VPN tunnel.

=====

When everything is properly configured, VPN traffic from your network (10.0.0.0/8) to EU DC subnet (172.20.0.0/16) would hit the device (where VPN tunnel configured) at US DC. This traffic is decrypted, and then is forwarded/routed to US DC backbone network, then forwarded to EU DC via DC-Link. At EU DC, return traffic is sent back to US DC via DC-Link again thanks to newly-configured route I mentioned above.

enter image description here

2

Regarding the configuration on your ASA, you should avoid using IP addresses/subnets and TCP/UDP ports directly in your ACL and NAT rules as much as possible. It is ugly and would take you lot of efforts and time to maintain the configuration and troubleshoot when issues happen.

Always put them into an object or object-group with meaningful name. If you need to change or update the configuration related to them, you just only need to update that object or object-group.

==========

I hope it is helpful and you can get it worked.

  • Thanks for details, question related step 4. You said specify route what does that means? In IPsec there is no route option you can tell to ASA this is your gateway or out going interface? Can you explain what you trying to say? – Satish Dec 28 '17 at 23:51
  • @Satish ASA needs to know where to route/forward traffic for remote subnets (172.16.0.0/16 and 172.20.0.0/16). If you only have only one outside interface, a default route and there is no other specific routes for remote subnets, then VPN traffic will be sent to outside interface where you enable crypto IKEv1. That is why you do not need to add a route when creating new VPN tunnel for new customers. – Hung Tran Dec 29 '17 at 9:27
  • @Satish In some cases, when you have more than one outgoing interface, let us say you have outside and outside_2 interfaces, and you configure VPN tunnels for different customers on different outgoing interface, you have to put a route for additional remote subnet to correct outgoing interface. – Hung Tran Dec 29 '17 at 9:33
  • @Satish Have you got this fixed? – Hung Tran Jan 5 '18 at 9:13
  • I have add 172.20.0.0 in ACL for IPsec that didn't work but then US Datacenter folks did something which don't know but they said it has been fix our side and now i can ping everywhere. I would agreed with your theory too – Satish Jan 5 '18 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.