Change Home Router by ASA in FTTH failed

sertorivs · ‎03-08-2017

Hi team

I want change a Soho-Home Router from FTTH line for a classic ASA5506 but I have a problem, I support several ipsec tunnels to a third party firewall and crossing the soho router.

This router is configured by redirect internet traffic to a dmz server (fw ip address), the provider uses a FTTH line with pppoe on vlan 6 tag.

When I change the Sohjo Router for an ASA5506 firewall and configured as below on image, the ipsec tunnels don´t function properly. I´m desesperated because a SOHO router functions but asa can´t do it. What´s the issue? Is a NAT question? how´s the way to redirecting internet traffic to dmz server in ASA config?.

The rest of traffic is correct, Think that vlan6 pppoe and vpdn functions properly

Regards

Marius Gunnerud · ‎03-08-2017

You have only posted your ppoe configuration and NAT. Just an FYI the any to outside dynamic NAT statement is not used and can be removed. You can check this by using the command show nat object obj_any details and see if there are any hits.

If you are able to get to the internet via the ASA5506 then, assuming your VPN configuration is correct, it is possible that you have not allowed port UDP/500 and UDP/4500 from the outside interface to the inside interface.

--

Please remember to select a correct answer and rate helpful posts

--
Please remember to select a correct answer and rate helpful posts

sertorivs · ‎03-17-2017

Sorry, problem follows, not function properly, in this case we have changed the asa configuration as below linmes but problem follows...What can we do?

object network thirdparty
host 192.168.200.2
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list ASA extended permit udp any object thirdparty eq isakmp log
access-list ASA extended permit udp any object thirdparty eq 4500 log

access-group ASA in interface global

object network thirdparty
nat (inside,global) static <public IP address>
!
nat (inside,global) after-auto source dynamic any interface

Marius Gunnerud · ‎03-29-2017

Have you checked what the syslog is saying? It is also possible that you need to open for ESP protocol and AH protocol.

--

Please remember to select a correct answer and rate helpful posts

--
Please remember to select a correct answer and rate helpful posts