1

I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ASA as the VPN server rather than Azure's built-in VPN capability. I'm able to use Cisco Anyconnect to establish a VPN connection to my virtual ASA. However, when I then pull up Remote Desktop Client to connect to my virtual client at 10.2.0.5, it fails to make a connection. Using wireshark, I can see the port 3389 RDC connection attempts coming in to 10.2.0.5 from 10.2.0.10, which is the virtual IP that ASA assigned when I made the initial VPN connection. However I don't see any traffic from 10.2.0.5 back. It looks like 10.2.0.5 is trying to use ARP to get the MAC address for 10.2.0.10 so it can respond, but it's not getting any ARP reply. If Cisco ASA VPN is distributing 10.2.0.10 as a virtual IP, shouldn't it respond to the ARP request?

enter image description here

Improve this question
4
  • You need to set up a separate subnet for the VPN clients and make sure that the Azure nodes have either a specific route to that subnet or that their default gateway has.
    – Zac67 ♦
    Mar 8, 2021 at 5:41
  • the virtual ASA is deployed with a "management interface" which accepts incomming VPN connections from the internet, and there are 3 additional interfaces, gig0, gig1, and gig2. So you're saying I need to put all the internal network machines on say gig0, then add a rule to allow traffic to pass from management to gig0, then in Azure add a user defined route of type virtual appliance with 0.0.0.0/0 pointing to the "management" interface?
    – public wireless
    Mar 8, 2021 at 6:35
  • great info here docs.microsoft.com/en-us/azure/virtual-network/…
    – public wireless
    Mar 8, 2021 at 23:50
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 23, 2021 at 17:06

1 Answer 1

Reset to default
4

Keep in mind that networking in the cloud works a bit differently than it does in the real world. ARP for instance does not work as you would expect: it's the cloud controller that answers the ARP request, not the device on which the IP address is configured. This means that Azure must know at all times what IP addresses are on what devices.

In order to route traffic to an instance (such as the ASA) on an IP address that is not assigned (by Azure) to the interface, you need to create a User Defined Route in the VNET. So it's best to create a seperate subnet for VPN clients, and add a route to that subnet that points to the ASA appliance.

Also keep in mind you need to enable IP forwarding for the instance, or "transit" traffic will be dropped by Azure anyway.

Improve this answer
1
  • I did create a UDR of type network appliance but that didn't work either. I was able to get the ARP failures to go away but I still couldn't ping or do RDC and on the RDC connections, they were being reset, my theory might be that the ASA was killing them due to a missing static route or ACL on the firewall. After messing with it for about 12 hrs straight, I was finally able to get it to work by trial and error using static NAT to translate the VPN pool address the ASA assigned to the VPN connection to the private interface that Azure sees. I'll post the solution for others
    – public wireless
    Mar 9, 2021 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.