Cisco ASA (Client VPN) to LAN - through second VPN to second LAN
- by user50855
We have 2 site that is linked by an IPSEC VPN to remote Cisco ASAs:
Site 1 1.5Mb T1 Connection Cisco(1) 2841
Site 2 1.5Mb T1 Connection Cisco 2841
In addition:
Site 1 has a 2nd WAN 3Mb bonded T1 Connection Cisco 5510 that connects to same LAN as Cisco(1) 2841.
Basically, Remote Access (VPN) users connecting through Cisco ASA 5510 needs access to a service at the end of Site 2. This is due to the way the service is sold - Cisco 2841 routers are not under our management and it is setup to allow connection from local LAN VLAN 1 IP address 10.20.0.0/24. My idea is to have all traffic from Remote Users through Cisco ASA destined for Site 2 to go via the VPN between Site 1 and Site 2. The end result being all traffic that hits Site 2 has come via Site 1.
I'm struggling to find a great deal of information on how this is setup. So, firstly, can anyone confirm that what I'm trying to achieve is possible? Secondly, can anyone help me to correct the configuration bellow or point me in the direction of an example of such a configuration?
Many Thanks.
interface Ethernet0/0
nameif outside
security-level 0
ip address 7.7.7.19 255.255.255.240
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.20.0.249 255.255.255.0
object-group network group-inside-vpnclient
description All inside networks accessible to vpn clients
network-object 10.20.0.0 255.255.255.0
network-object 10.20.1.0 255.255.255.0
object-group network group-adp-network
description ADP IP Address or network accessible to vpn clients
network-object 207.207.207.173 255.255.255.255
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended permit icmp any any source-quench
access-list outside_access_in extended permit icmp any any unreachable
access-list outside_access_in extended permit icmp any any time-exceeded
access-list outside_access_in extended permit tcp any host 7.7.7.20 eq smtp
access-list outside_access_in extended permit tcp any host 7.7.7.20 eq https
access-list outside_access_in extended permit tcp any host 7.7.7.20 eq pop3
access-list outside_access_in extended permit tcp any host 7.7.7.20 eq www
access-list outside_access_in extended permit tcp any host 7.7.7.21 eq www
access-list outside_access_in extended permit tcp any host 7.7.7.21 eq https
access-list outside_access_in extended permit tcp any host 7.7.7.21 eq 5721
access-list acl-vpnclient extended permit ip object-group group-inside-vpnclient any
access-list acl-vpnclient extended permit ip object-group group-inside-vpnclient object-group group-adp-network
access-list acl-vpnclient extended permit ip object-group group-adp-network object-group group-inside-vpnclient
access-list PinesFLVPNTunnel_splitTunnelAcl standard permit 10.20.0.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 10.20.0.0 255.255.255.0 10.20.1.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 10.20.0.0 255.255.255.0 host 207.207.207.173
access-list inside_nat0_outbound_1 extended permit ip 10.20.1.0 255.255.255.0 host 207.207.207.173
ip local pool VPNPool 10.20.1.100-10.20.1.200 mask 255.255.255.0
route outside 0.0.0.0 0.0.0.0 7.7.7.17 1
route inside 207.207.207.173 255.255.255.255 10.20.0.3 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 288000
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto map outside_dyn_map 20 match address acl-vpnclient
crypto map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
group-policy YeahRightflVPNTunnel internal
group-policy YeahRightflVPNTunnel attributes
wins-server value 10.20.0.9
dns-server value 10.20.0.9
vpn-tunnel-protocol IPSec
password-storage disable
pfs disable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value acl-vpnclient
default-domain value YeahRight.com
group-policy YeahRightFLVPNTunnel internal
group-policy YeahRightFLVPNTunnel attributes
wins-server value 10.20.0.9
dns-server value 10.20.0.9 10.20.0.7
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value YeahRightFLVPNTunnel_splitTunnelAcl
default-domain value yeahright.com
tunnel-group YeahRightFLVPN type remote-access
tunnel-group YeahRightFLVPN general-attributes
address-pool VPNPool
tunnel-group YeahRightFLVPNTunnel type remote-access
tunnel-group YeahRightFLVPNTunnel general-attributes
address-pool VPNPool
authentication-server-group WinRadius
default-group-policy YeahRightFLVPNTunnel
tunnel-group YeahRightFLVPNTunnel ipsec-attributes
pre-shared-key *
