Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Hub/Spoke Forcing Spoke Internet Traffic thru Tunnel?

I am having some trouble getting this tested in the lab. Essentially I have two PIX 506e setup, one pretending to be the hub, and the other a spoke (outside interfaces on the same network) with a working tunnel between them. I could ping across them without problem (to hosts on each of their internal networks). So I then wanted to tackle the forcing of all traffic from the spoke to the hub, where I'll eventually integrate some traffic monitoring which we don't want to replicate at the spoke site. To do this I changed up the access-list for the tunnel to essentially say src spoke_net to any (and the reverse on the other side). Trouble is it isn't working. I have a feeling traffic from the spoke is going across the tunnel as I can capture IP ESP traffic on the outside interface when pinging IPs on the outside network. Could this be a nat issue, routing issue, or impossible? Any help is appreciated. I've attached configs for both the Hub and Spoke.

4 REPLIES
Anonymous
N/A

Re: Hub/Spoke Forcing Spoke Internet Traffic thru Tunnel?

I wish I could upload the attachments... but I keep getting a servlet error from the forums.

Anonymous
N/A

Re: Hub/Spoke Forcing Spoke Internet Traffic thru Tunnel?

New Member

Re: Hub/Spoke Forcing Spoke Internet Traffic thru Tunnel?

The trouble you will have is the firewall needs a default-route and it will want to send internet requests to its DG. I know for sure this setup can be done using routers running VRF (Policy-Based Routing should also work). See my attached diagram & configs. Can you get your hands on a pair of ASAs? I believe PBR was added or will be in a future release.

New Member

Re: Hub/Spoke Forcing Spoke Internet Traffic thru Tunnel?

actually the diagram shows PBR... but you get the idea. Let me know if you have any questions on the VRF & GRE setup

110
Views
0
Helpful
4
Replies