1

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router.

i have the static NAT set up to go from the (wifimain,outside) and the corresponding objects and the ACL permitting this traffic on both the ASA to the IOS router. However i am unable to ping from that vlan subinterface to the destination IP.

I am able to ping from the inside interface to the same destination IP. The tunnel comes up fine when i send the interesting traffic from the inside interface.

any thoughts or suggestions?

ASA:

gig1/5.6 
vlan 6 
nameif wifimain 
sec-level 100 
ip address 10.75.4.1 /24

access-list {remote site} extended permit ip object OBJ_10.75.4.0 object OBJ_192.168.10.0

nat (wifimain,outside) source static OBJ_10.75.4.0 OBJ_10.75.4.0 destination static OBJ_192.168.10.0 OBJ_192.168.10.0 no-proxy-arp route-lookup

crypto map mymap 45 set peer {remote site public ip} 
crypto map mymap 45 match address {remote site}
IOS-router

crypto map mymap 45 ipsec-isakmp set peer {peer of ASA outside IP} 
set transform-set myset 
match address {ASA site acl}

ip access-list extended {asa site} permit IP 192.168.10.0 0.0.0.255 10.75.4.0 0.0.0.255

route-map ISP permit 20 match ip address 190 match interface gi0/0 (the outside interface on the IOS route)

access-list 190 deny ip 192.168.10.0 0.0.0.255 10.75.4.0 0.0.0.255 
access-list 190 permit ip 192.168.1.0 0.0.0.255 any 
access-list 190 permit ip 192.168.10.0 0.0.0.255 any

show crypto ipsec sa peer output

5
  • Are object names case sensitive?
    – Ron Trunk
    Feb 17 at 13:30
  • no sorry. they're not case sensitive. they're all caps. i'll edit my post
    – ptabs
    Feb 17 at 13:32
  • i tried to mimic the NAT rules and ACL entries for the working "inside" addresses. I am able to ping from the inside over the tunnel to the destination 192.168.10.0/24
    – ptabs
    Feb 17 at 13:35
  • Have you considered routing that traffic as-is and identifying it on the other side by address range? You should definitely not use NAT between sites.
    – Zac67
    Feb 17 at 13:35
  • it should be identified on the IOS side by the address range as it's included in the interesting traffic for the tunnel. the tunnel comes up and it shows up when doing a "show crypto ipsec sa {peer ip}
    – ptabs
    Feb 17 at 14:11

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.