Pass traffic from ASA throught its own VPN tunnel

[SaracenCL]

I have two sites with asa firewalls (ASA5520) at each site with a site to site VPN.

I need to allow traffic initiated from the firewall to travel through the vpn to the second site to a server behind the firewall. I would like to know if the ASA supports this as I have not been able to make it work.

Any comments or feedback welcome.

Thanks.

 

[North323]

you want traffic to traverse your site to site vpn tunnel?

 

[SaracenCL]

Yes.

The reason is that I have enabled netflow on both firewalls. The Netflow Collector is in site A (so no problem there). The firewall in Site B needs to send its netflow data. Ideally if it can send it via the site to site VPN it will be secure.

 

[North323]

so is there some traffic from B that does NOT go through the tunnel and some traffic does go through the tunnel? you can create an policy based route

 

[SaracenCL]

Site B has a site to site VPN with site A. So some traffic will go via the VPN to site A. However some traffic will go out of Site B Firewall as normal.

My real question is whether I should be able to configure the Site B firewall to allow traffic to traverse its own VPN tunnel. If so, how?

 

[North323]

your doc is not shared. yes you should be able to send whatever traffic you want down the tunnel. you can do that by policy based routing see:

http://www.cisco.com/en/US/docs/ios...TSD_Products_Configuration_Guide_Chapter.html

 

[SaracenCL]

https://docs.google.com/present/edit?id=0Aeu9SG2Cng8hZG5tOGY2Zl81NzBjNXM1cDd2Ng&hl=en_GB

Try Now.

 

[North323]

We're sorry, but jas@gmail.com does not have access to this document.

 

[SaracenCL]

It will work now.

https://docs.google.com/present/edit?id=0Aeu9SG2Cng8hZG5tOGY2Zl81NzBjNXM1cDd2Ng&hl=en_GB

 

[North323]

yes you can. see above link i posted

 

[SaracenCL]

I have had a look at the document on PBR. Thanks. Did you get a chance to look at my diagram? At present FW B cannot talk to network B. Therefore, I dont understand how PBR can help at this stage?

I have looked at the logs and the FW itself is dropping packets for the destination... but only the packets taht are generated by the firewall.

 

[North323]

on fwB do you have the correct local addresses? can you post both scrubbed configs?

 

[Supergrrover]

PBR does not work on ASA's.

If you put a PBJ on it and run a lot of inspections it will heat it up nicely though.

What you want is similar to this setup -

http://www.cisco.com/en/US/products...nfiguration_example09186a00805a2e04.shtml#vpn

The trick is the interesting traffic ACL uses the outside IP of the ASA.

Hope this helps.

Brent
Systems Engineer / Consultant
CCNP, CCSP