4

At work we have a cisco 3560 L3 core, in which we implement all our L3 VLANs and ACLs controlling inter-vlan routing. As far as client machines are concerned, the L3 switch is the default gateway, which then forwards packets on to the router. As far as the router is concerned, if it can't see a client machine, it is attached to the switch. However now there is requirement for remote-access VPNs, for which we will be using our 5520 ASA routers. The issue that arises here is that all our ACLs are in the switch, and I'd prefer to leave all these type of controls in the switch. Ideally, I would like VPN traffic to come in off the router, and to go into the switch on the appropriate VLAN, where the switch could then control ACLs.

I have noticed that the 5520s do have a 'vlan' option under the group-policy related to a remote connection, however I'm somewhat confused as to the best way about getting the data into the switch.

How would I best achieve this? My LAN port is GigabitEthernet0/1.

  • Do I use GigabitEthernet0/1.4?
  • Do I trunk GigabitEthernet0/1 to the switch, and set a loopback with my router's internal IP to retain routing?
  • Can I just tag the VLANs and push them into the switch somehow?

Here is a knock-together image of the topology.

Network Topology

  • The clients on the left are inside the LAN, in their appropriate VLANs as depicted in the picture.
  • Our core switch is a cisco 3560. Our router is a cisco 5520 ASA.
  • The clients on the right represent remote clients that are connected in via cisco SSL VPN.

Thanks all

ASA base config:

hostname CoreRouter
domain-name ***
enable password *** encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd *** encrypted
names
!
interface GigabitEthernet0/0
 speed 100
 duplex full
 nameif outside
 security-level 0
 ip address 30.0.0.2 255.255.255.0
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 10.0.6.5 255.255.255.0
!
ftp mode passive
clock timezone AWST 8
object network NET-10.0
 subnet 10.0.0.0 255.255.0.0
 description Per (Local)
object network NET-10.1
 subnet 10.1.0.0 255.255.0.0
 description Avv (Remote)
object network RemoteAccessCorp
 subnet 10.0.4.0 255.255.255.0
 description SSL Restricted Remote Access
object network RemoteAccessIT
 subnet 10.0.5.0 255.255.255.0
 description SSL Unrestricted Remote Access
object-group network NET-VPN
 network-object object NET-10.1
 network-object object RemoteAccessCorp
 network-object object RemoteAccessIT
!
access-list s2s-vpn-avv extended permit ip object NET-10.0 object NET-10.1
pager lines 24
mtu outside 1500
mtu inside 1500
mtu inside_12 1500
mtu inside_13 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static NET-10.0 NET-10.0 destination static NET-VPN NET-VPN no-proxy-arp route-lookup
!
nat (inside,outside) after-auto source dynamic NET-10.0 interface
access-group ingress-harden in interface outside
route outside 0.0.0.0 0.0.0.0 30.0.0.2 1
route inside 10.0.6.0 255.255.255.0 10.0.0.2 1
route inside 10.0.2.0 255.255.255.0 10.0.0.2 1
route inside 10.0.3.0 255.255.255.0 10.0.0.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
ldap attribute-map LDAP-MEMBEROF-VPN
  map-name  memberOf Group-Policy
  map-value memberOf "CN=IT Staff,OU=Production,OU=Groups,OU=All Users and groups,DC=internal" ItClient
  map-value memberOf "CN=ASA-VPN,OU=Production,OU=Groups,OU=All Users and groups,DC=internal" CorpClient
dynamic-access-policy-record DfltAccessPolicy
aaa-server LDAP protocol ldap
aaa-server LDAP (inside) host 10.0.6.2
 ldap-base-dn OU=Production Users,OU=All Users and groups,DC=internal
 ldap-scope subtree
 ldap-naming-attribute sAMAccountName
 ldap-login-password *****
 ldap-login-dn CN=ASA SSL VPN,OU=LDAP System accounts,DC=internal
 server-type microsoft
 ldap-attribute-map LDAP-MEMBEROF-VPN
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
no snmp-server location
no snmp-server contact
no snmp-server enable
no service password-recovery
crypto ipsec ikev2 ipsec-proposal OurProposal
 protocol esp encryption aes-256
 protocol esp integrity sha-1
crypto ipsec security-association pmtu-aging infinite
crypto map AeonMap 1 match address s2s-vpn-avv
crypto map AeonMap 1 set peer ***
crypto map AeonMap 1 set ikev2 ipsec-proposal OurProposal
crypto map AeonMap interface outside
crypto ca trustpoint localtrust
 enrollment self
 fqdn CoreRouter.internal
 subject-name CN=CoreRouter.internal
 keypair sslvpnkey
 crl configure
crypto ca trustpool policy
crypto ca certificate chain localtrust
 certificate ***
  quit
crypto isakmp identity address
crypto ikev2 policy 1
 encryption aes-256
 integrity sha384
 group 21
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
telnet timeout 5
ssh stricthostkeycheck
ssh 10.0.0.0 255.0.0.0 management
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group14-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point localtrust outside
webvpn
 enable outside
 anyconnect image disk0:/anyconnect-win-3.1.00495-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
group-policy CorpClient internal
group-policy CorpClient attributes
 wins-server value 10.0.6.2
 dns-server value 10.0.6.2
 dhcp-network-scope 10.0.6.2
 vpn-simultaneous-logins 100
 vpn-idle-timeout 30
 vpn-tunnel-protocol ssl-client
group-policy ItClient internal
group-policy ItClient attributes
 wins-server value 10.0.6.2
 dns-server value 10.0.6.2
 dhcp-network-scope 10.0.6.2
 vpn-simultaneous-logins 100
 vpn-idle-timeout 30
 vpn-tunnel-protocol ssl-client
group-policy NoAccess internal
group-policy NoAccess attributes
 vpn-simultaneous-logins 0
username admin password *** encrypted privilege 15
tunnel-group RemoteAccess type remote-access
tunnel-group RemoteAccess general-attributes
 authentication-server-group LDAP
 default-group-policy NoAccess
 dhcp-server 10.0.6.2
tunnel-group RemoteAccess webvpn-attributes
 group-alias Connect enable
tunnel-group *** type ipsec-l2l
tunnel-group *** ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:6c07d337dc0b47763e4661313febe10c
: end

3560 base config: This is a test switch with little configuration

version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
ip routing
ip domain-name ***
ip name-server 10.0.6.2
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
 description To Router
 ip address 10.0.0.2 255.255.255.0
!
interface GigabitEthernet0/1
!
interface Vlan2
 description Corporate
 ip address 10.0.2.1 255.255.255.0
 ip helper-address 10.0.6.2
!
interface Vlan3
 description IT
 ip address 10.0.3.1 255.255.255.0
 ip helper-address 10.0.6.2
!
interface Vlan4
 description Corporate VPN
 shutdown
!
interface Vlan5
 description Corporate IT VPN
 shutdown
!
interface Vlan6
 description Servers
 ip address 10.0.6.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.1
ip http server
!
!
control-plane
!
!
line con 0
 escape-character 3
line vty 0 4
 login
line vty 5 15
 login
!
end

EDIT 1 - ASA sub-interfaces and switch trunk port - NOT WORKING

I have configured the following in the switch:

interface Port-channel1
  description Core Router trunk
  switchport trunk encapsulation dot1q
  switchport mode trunk
!
interface FastEthernet 0/8
  description to Router
  switchport trunk encapsulation dot1q
  switchport mode trunk
  channel-group 1 mode on
!
int Loopback 0
  ip address 10.0.0.2 255.255.255.0

And in the ASA, I have the following:

interface GigabitEthernet0/1
  nameif inside
  security-level 100
  ip address 10.0.0.1 255.255.255.0
interface GigabitEthernet0/1.12
  nameif inside_12
  security-level 100
  no ip address
  vlan 12
interface GigabitEthernet0/1.13
  nameif inside_13
  security-level 100
  no ip address
  vlan 13

group-policy CorpClient attributes
  wins-server value 10.0.6.2
  dns-server value 10.0.6.2
  dhcp-network-scope 10.0.6.2
  vpn-simultaneous-logins 100
  vpn-idle-timeout 30
  vpn-tunnel-protocol ssl-client
  vlan 12
group-policy ItClient attributes
  wins-server value 10.0.6.2
  dns-server value 10.0.6.2
  dhcp-network-scope 10.0.6.2
  vpn-simultaneous-logins 100
  vpn-idle-timeout 30
  vpn-tunnel-protocol ssl-client
  vlan 13

However the issue I am encountering with this approach is that it doesn't seem to allow communication between the router and switch? I believe this is because the switch port is in a 'trunk' mode, and the router port is in an 'access' mode?

Improve this question
13
  • You need to provide more information. Please edit your question to include the (sanitized) configurations, and use the preformatted text feature ({}).
    – Ron Maupin ♦
    Mar 21, 2018 at 1:25
  • Yes, you can do this. You can create subinterfaces on the ASA and trunk them to the switch. Then you can create two VPN policies that connect the clients to the appropriate VLAN.
    – Ron Trunk
    Mar 21, 2018 at 1:38
  • Hi Ron, I did attempt to do this and didn't seem to have any success. So I need to configure the policies to tag the traffic with the VLAN, I need to create sub-interfaces for each VLAN and then I set up a trunk port in the switch itself, but not in the router - is this correct?
    – Shane
    Mar 21, 2018 at 1:46
  • Are you actually using the switch as a layer-3 switch? If so, you should probably set up a routed link to the firewall, not trunk to the firewall. It would help if you include the full switch configuration, too.
    – Ron Maupin ♦
    Mar 21, 2018 at 2:21
  • 1
    "My understanding is that there are L2 and L3 vlans" That would be incorrect. A VLAN is a layer-2 broadcast domain, and broadcasts do not cross layer 3. Think of a VLAN as breaking a layer-2 switch into multiple separate switches. There are VRFs that are like breaking a layer-3 router into multiple separate routers.
    – Ron Maupin ♦
    Mar 21, 2018 at 14:18

2 Answers 2

Reset to default
1

One real problem right off the bat is that your switch loopback is 10.0.0.2/24, and your statically configured default route is to 10.0.0.1/24, so all you default traffic is sent to the loopback.

You have some serious design problems.

Your switch interface to the ASA is on VLAN 1 (10.0.1.0/24), but the ASA interface is a routed interface on a different network (10.0.0.0/24). That will never work.

You should probably use the no switchport command on the switch interface to the ASA, and configure it as a routed interface. It will need to use an address in the same network as the ASA interface, and that cannot be the same network as your loopback interface (probably should change the loopback).

Improve this answer
1
  • gah! I think that's just something that's happened as I've been trying so many different approaches. The switch interface should be on 10.0.0.2, IP address being assigned to the interface itself as you have described here. I'll get that sorted now.
    – Shane
    Mar 21, 2018 at 2:36
0

After (finally) getting back around to this, I have determined that I do not need to use VLANs nor sub-interfaces.

I did attempt to get it working by configuring a sub-interface on the LAN port of the ASA, and trunking it into my switch, however I was having issues passing traffic between the two sub-interfaces.

I realised that my ACLs did not require traffic to be on certain VLANs, that all I needed to do was assign an IP in the correct DHCP scope, and my ACLs would still apply as intended. (See dhcp-network-scope in group-policy SSLClient).

So my VPN traffic is coming in on VLAN 1 and is being tunneled through to my 3560 and all is working.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.