Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Mixing DMVPN on 2821 with ASA VPN SSL - how?

Hello,

We currently have a DMVPN with 8 spokes and a single hub. All spokes and the hubs are on 2821, which are also the Internet routers and provide a limited Firewall. At the hub we are now considering using an ASA to provide VPN-SSL for off-site staff.

What is the better design strategy:

a) Putting the ASA in front of the 2821 hub and NAT the 2821

or

b) Putting the ASA behind the 2821 and NAT the ASA?

I know (reading the docs) that a NATed DMVPN hub should work with recent IOS. But I couldn't find anywhere whether you can NAT the outside interface of an ASA.

Can anyone report success with either of the two scenarios?

Thank you

Dorothea

1 REPLY

Re: Mixing DMVPN on 2821 with ASA VPN SSL - how?

Placing the router behind the ASA will basically render the firewall useless as it won't be able to filter or understand the encrypted traffic. Placing the ASA at the back or 'in parallel' with the router would be something more appropriate.

You would have to open the SSL port on the router. Another option could be to place the firewall in a DMZ on the router (provided you have a firewall to secure the LAN already).

Pls. rate if helpful.

Regards

Farrukh

149
Views
0
Helpful
1
Replies