How to create a site-to-site VPN with a SA520w and an ASA5510

Answered Question
Mar 1st, 2010

I am looking for some direction or a specific examples of setting up a site to site VPN using the Sa520w and an ASA5510. the 520 is at the remote location and the ASA is at the main office. Traffic needs to flow in both directions. I have done some test using the wizards on both devices and have had success creating the VPN but have not been able to get traffic to route through the tunnel. any help would be greatly appreciated. 

I have this problem too.
0 votes
Correct Answer by Steven Smith about 6 years 9 months ago

Actually, you can have different subnets on a single IPSEC tunnel with the SA500.

To do this, Create 1 IKE Policy.

Then, create several VPN Policies with the different IP address ranges.  On each of these VPN Policies, select the same IKE profile. 

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
William Childs Tue, 03/02/2010 - 03:01

The basic idea is to make sure the whole subnet is allowed through the VPN tunnel. The ASA is an enterprise device and is considerably more robust in capabilites, however the SA is slightly more limited in the fact that you cannot route multiple subnets through the vpn tunnel.

Make sure you have the SA set to allow the remote subnet access to the local network.

One thing I have not tried is setting up a "supernet" if you will.

For example....

Site A has 5 networks with the 192.168.x.x prefix and a subnet mask of /24.

Site B has 5 networks with the 10.2.x.x prefix and the subnet mask of /24.

Site A will advertise 192.168.0.0 /16 through the VPN tunnel and Site B will advertise 10.2.0.0 /16 the opposite way.

Therefore, if Site A has the SA you could set the remote lan ip for 10.2.0.0//// 255.255.0.0

I have not personally tested this but I think it could be done and actually work. If you do try this, please let us know how it goes.

Bill

P.S. Does the tunnel actually connect, or does the status stay as IPSec not established.

Correct Answer
Steven Smith Tue, 03/02/2010 - 10:21

Actually, you can have different subnets on a single IPSEC tunnel with the SA500.

To do this, Create 1 IKE Policy.

Then, create several VPN Policies with the different IP address ranges.  On each of these VPN Policies, select the same IKE profile. 

csco10634145 Thu, 03/18/2010 - 05:39

Thanks for the help, as it turned out we ended up using a 5505 to connect to the 5510 this ended up being a better solution then the SW 520. 

Actions

This Discussion

Related Content