ASA 5510 VPN Tunnel and VLAN Access

drikilbride · ‎03-29-2010

Hi

I hope someone can point me in the right direction on this.

I have a vlan (say VLAN 20) set up on a 3950 Switch and have assigned numerous ports to this VLAN.

On my ASA 5510 I have a site to site VPN tunnel to an external company where there are resources that will need to be accessed my users in VLAN 20.

How to I assign the ports in VLAN 20 to use the VPN tunnel created on te ASA 5510 or is this even possible?

Thank you in advance!

Jennifer Halim · ‎03-29-2010

1) You would need to add crypto ACL between VLAN 20 to the remote VLAN subnets on your ASA, and a mirror image crypto ACL on the remote VPN end.

2) You would need to configure NAT exemption between VLAN 20 and remote VLAN subnet.

3) If you have ACL assign to the interface where VLAN 20 is connected to, you would need to allow traffic from VLAN 20 towards the remote VLAN too.

4) How is this VLAN 20 connected to your ASA? directly connected, or route to one of your ASA other interfaces?

Jon Marshall · ‎03-29-2010

drikilbride wrote:

Hi

I hope someone can point me in the right direction on this.

I have a vlan (say VLAN 20) set up on a 3950 Switch and have assigned numerous ports to this VLAN.

On my ASA 5510 I have a site to site VPN tunnel to an external company where there are resources that will need to be accessed my users in VLAN 20.

How to I assign the ports in VLAN 20 to use the VPN tunnel created on te ASA 5510 or is this even possible?

Thank you in advance!

Yes it's possible. When you set up a site-to-site VPN you use the IP subnet range for that vlan. Have a look at this doc which covers the configuration for an ASA which shows how you would set it up and come back if you have further questions -

http://www.cisco.com/en/US/customer/products/ps6120/products_configuration_example09186a00805e8c80.shtml

Jon

Cisco are currently donating money to the Haiti earthquake appeal for every rating so please consider rating all helpful posts.