IPSec Tunnels using Cradlepoint Router as a passthrough

jmyers1973 · ‎04-01-2015

I hope you can help. I have an odd situation that I have been asked to fix after the fact (of course) but am not getting the results that I desire. I have a customer that is utilizing (54) Calamp Vanguard 3000 Cellular Routers connected to its own respective subnet. On each CALAMP are configured (4) IPsec VPN Tunnels, two to each of the Cisco ASA5510's. Here is where it gets a little tricky. Each CALAMP has two tunnels to each customer site, PS1 and ST1, for a total of 4 total tunnels per CALAMP Router, two are DSL and two are cellular. One of the DSL connections is AT&T (99.109.150.XXX) and the other a Comcast DSL(75.148.102.XXX). The two connections have established VPN tunnels and don't seem to be an issue. The issue is on the cellular side.

The cellular IP addresses are both 166.130.XXX.XXX IP addresses provided by AT&T. One is connected to the PS1 site and the other the ST1 site through a Cradlepoint CBA750B Router with an integrated LP2000 Modem, one at each location.

These Cradlepoint Cellular Routers are setup for pass through (bridge mode) for the Cellular IP address assigned by AT&T. The interface on the ASA5510 that it connects to is set to DHCP so that it will capture the IP and configure itself on that port. The issue I am having is that I can get the DSL vpn tunnels to connect just fine but I cannot get the Cellular side to connect whatsoever. I have all of the necessary access list entries, Crypto-maps and tunnel-groups setup correctly in the Firewall but they will not connect. I am assuming that it is some sort of Natting issue or I'm missing a static route somewhere???

I have attached a visio drawing of the layout as well as a PDF Version.

Please let me know if you have any questions regarding this jumble of words.

Thank you,

Jeff M.

syed kazim abbas · ‎04-01-2015

Hi jeff,

I am assuming that it is some sort of Natting issue or I'm missing a static route somewhere???
I think you are missing both:

Nat is sure making problem because your Cardelpoint Lan is using 10.10.10.0/30 subnet which mean its a private network and obviously you are the using the set peer ip 166.130.103.188 & 189 on CalampRouter but your Cradlepoint does't know about the isakamp. So you need to make these seting on Cradlepoint:
ip nat inside source static udp 10.10.10.x 4500 int-outside cardlepoint 4500
ip nat inside source static udp 10.10.10.x 500 int-outside cardlepoint 500

Secondly, static routes on both ends with different Distance metric.

hope you are configuring primary and backup links.

so you need IP SLA as well to monitor the links.

HTH

Kazim Abbas