0

My company has created a network topology where we have 2 firewalls. The external one is a DrayTek and the internal one is a Cisco ASA. We also have a dmz connected to the ASA.

The DrayTek public IP address is not a private address. The internal is private 192.168.0.1. The ASA external IP is 192.168.0.2 and the internal is 192.168.1.1.

I am new to VPNs so can a VPN be connected directly to the ASA or does it have to be connected to the external firewall (DrayTek).

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 19:52
1

As far as I could understand, in your topology, you're having two firewalls. One is Cisco ASA and the other is DrayTek firewall device. Also, the outside interface IP address of ASA is 192.168.0.2 (Private IP) and the outside interface IP address for DrayTek perimeter firewall is a public IP address.

So, the DrayTek device is the device that keeps you to connect to the internet since it is having a public IP address. The VPN should be established on the DrayTek device.

If you are going to establish a SSL VPN or remote VPN, then you can configure the same in the firewall by configuring a virtual IP pool. Otherwise, if it is to be connected as a site-site or L2L VPN, you will be requiring the IKE/ISAKMP parameters from the adjacent peer as well for connection negotiation and data transfer. I would recommend to check with the DrayTek appliance guides and manuals for configuring the same.

0

If you are connecting to Azure via a public network (Internet) then add a public facing port on your ASA for the VPN tunnel to Azure. You could do some static NAT shenanigans to the ASA but it's poor engineering as it violates the KISS principle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.