Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
My company has created a network topology where we have 2 firewalls. The external one is a DrayTek and the internal one is a Cisco ASA. We also have a dmz connected to the ASA.
The DrayTek public IP address is not a private address. The internal is private 192.168.0.1. The ASA external IP is 192.168.0.2 and the internal is 192.168.1.1.
I am new to VPNs so can a VPN be connected directly to the ASA or does it have to be connected to the external firewall (DrayTek).
As far as I could understand, in your topology, you're having two firewalls. One is Cisco ASA and the other is DrayTek firewall device. Also, the outside interface IP address of ASA is 192.168.0.2 (Private IP) and the outside interface IP address for DrayTek perimeter firewall is a public IP address.
So, the DrayTek device is the device that keeps you to connect to the internet since it is having a public IP address. The VPN should be established on the DrayTek device.
If you are going to establish a SSL VPN or remote VPN, then you can configure the same in the firewall by configuring a virtual IP pool. Otherwise, if it is to be connected as a site-site or L2L VPN, you will be requiring the IKE/ISAKMP parameters from the adjacent peer as well for connection negotiation and data transfer. I would recommend to check with the DrayTek appliance guides and manuals for configuring the same.
If you are connecting to Azure via a public network (Internet) then add a public facing port on your ASA for the VPN tunnel to Azure. You could do some static NAT shenanigans to the ASA but it's poor engineering as it violates the KISS principle.
