3

I'd like to see if somebody here can help me with an in-principle answer on which direction take.

We have an office LAN (192.168.100.0/24) connected to a production data centre (10.100.0.0/16) via a VPN. The office firewall is an ASA 5505. In addition, we have people connecting to the office firewall from home via IPSec client access.

Home       Production
|          |
|          |
------|-----         
      |
      | outside
------------
| ASA 5505 |
|-----------
      | inside
      |
      | Office LAN

Our problem is that when connecting from home, it's not possible to connect to the production network at all, i.e. can't ping from 192.168.1.2 (my home PC) to 10.100.34.3

I understand that there may be some restrictions here because both the home endpoint and the production endpoint go into the "outer" interfaces.

My questions are:

  1. Is it possible to even set up this topology using a Cisco ASA 5505? If so, what do you do to make traffic flow from one VPN connection to another?
  2. If not possible, how do you make it possible? Put a L3 switch behind the ASA and put routing logic in place there?

This is bugging us a lot because we keep having to go through jump hosts and SSH forwarding in the office when working outside, which is really time consuming and doesn't work for everything.

2 Answers 2

3

Yes, this configuration is possible using a Cisco 5505. It's referred to as a VPN hairpin because traffic from the outside interface is coming inbound and then routing back outbound through the same outside interface.

There are three key components to this configuration.

1) Allow communication in/out of the same interface

same-security-traffic permit intra-interface

2) Add the RAS VPN pool IP space to the interesting traffic for the site to site VPN.

 access-list (vpn-acl-name) extended permit ip object Vpn-Pool ip object Data-Centre-IPs

3) Add a no-nat entry for the relevant traffic from outside to outside

nat (outside,outside) source static Vpn-Pool Vpn-Pool destination static Data-Centre-IPs Data-Centre-IPs

This is assuming you're on a post 8.3 code.

7
  • Thanks for this, I set it up like this but it wasn't quite enough, so now trying alongside this plus the next answer and comment..
    – xcut
    Apr 9, 2014 at 20:24
  • Coincidentally, connecting from home over IPSec VPN in OS/X, which does not by default route everything over the VPN. And no split tunnel is configured as I have no idea how to.
    – xcut
    Apr 9, 2014 at 20:25
  • Can you add a sanitized config file? Did you create the VPN using the wizard? If you're not routing everything through the VPN you most likely have a split tunnel ACL configured. When you run an "netstat -nr" do you see the route for your internal office network? Apr 9, 2014 at 21:16
  • Yes, created using the wizard. Can't get hold of the config file right now, but netstat does have the route: 192.168.20 192.168.20.161 ... utun0 192.168.20.161 192.168.20.161 ... utun0 At the bottom of the route table.
    – xcut
    Apr 9, 2014 at 21:38
  • Taking a look at the configuration would be very beneficial. Updating the split tunnel ACL to permit the 10.100.0.0/16 would add that route to your host table when connected to the VPN. Apr 9, 2014 at 22:00
1

You need a route for the 10/8 network on the VPN client workstations, pointing at the VPN gateway address or interface. (the client probably thinks that 10/8 is over the default gateway)

This may be configurable in the VPN client application, but it can also be done in a simple batch file run after the VPN connection comes up.

Some VPN implementations allow the server side to pass this information to the client. It just depends on what you are using. You don't need active routing to fix this problem.

You should also look at your ACLs on the VPN server private interface, as they may be restricting traffic as well.

3
  • This is a valid point. If the RAS VPN isn't setup to tunnel all networks, then the 10.100/16 should be added the to the split tunnel ACL. This "should" add a host route on the VPN client. Apr 9, 2014 at 16:09
  • Any hints on how I get OSX to route this way after the connection comes up? The VPN we're routing to is 10/8 and the office network is 192.168.20.0/24, where the firewall is at 192.168.20.1 and the VPN reserved range is 192.168.20.160 upwards
    – xcut
    Apr 9, 2014 at 20:41
  • I would consider using a different subnet than your office network for your VPN pool. It's cleaner to segment that so you can have different access policies per subnet. Apr 9, 2014 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.