0

We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer network with IPSec tunnel. Customer does have Cisco ASA, and it doesn't support in this case VTI. We can access customer networks from SITE2, but we can not access those networks form SITE1 or SITE2. When sending packet to Customer network from SITE1 we can see packet coming to SITE2 but the packet is not continuing to Customer network. Should the packet be automatically routed to ipsec tunnel by PFSense, or would there be some trick we could static route those packages to customer network when we do not have VTI available at the Customer router? 

SITE1 <- ipsec -> SITE2 <- ipsec> SITE3
                  |
                 ipsec (BINAT/NAT)
                  |
                Customer
Improve this question
4
  • Routers get routes in three ways: directly connected networks, statically configured routes, or through a dynamic routing protocol. You will either need to configure static routes or configure a dynamic routing protocol.
    – Ron Maupin ♦
    Jun 9, 2019 at 0:34
  • I have confiured static route from SITE1 to SITE2 but how I create route to Customer network from SITE1?. PFSence seems not allowed to add routes to networks which do not have interface. Can I some how create virtual interface to customer network in PFsence? Updated picture there was missing NAT, customer requres that all trafic to they network need to be come via NAT.
    – taiffu
    Jun 9, 2019 at 7:24
  • Cisco ASAs support VTI as of 9.7 code. You could request that the customer upgrade their ASA to 9.7 or higher if you want to use route-based tunnels (VTI) rather than policy-based.
    – Jesse P.
    Jul 16, 2019 at 20:06
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Nov 19, 2022 at 23:55

1 Answer 1

Reset to default
0

Unless you exchange routes with your customer and your sites with some routing protocol (OSPF, RIP, ...), all routes need to be statically created. Without those, site routers know only the subnets/routes that are connected to them.

You can mix that, e.g. using a routing protocol in between your sites and have SITE2 inject its static route to the customer net into the exchanged routes to propagate the route to SITE1 and SITE3.

However, the customer's router needs to know your subnets as well in order for the backroutes to work. Again, that can be done with static routes or a routing protocol.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.