VPN question --> site-to-site-to-site

[Endwigast]

Hi,

I was wondering if the attached diagram is possible? Can hosts on network A connect to hosts on network B? Thanks

endwi

[Danilo Dy]

Hi,

Sure, as long as there is no overlapping network/host in SiteA and SiteB and also those network/host in SiteA and SiteB is not present in the middle firewall internal security segment and internal routing.

There is a solution for overlapping network/host though but for a newbie in VPN, try to avoid it.

Regards,

Dandy

[vpoon87]

Hi,

I'm trying to do the same thing but can't get data to go out of my ASA5520. How is this accomplished? I've tried putting the remote network in the SA to the hub but the data gets denied. Also just tried routing but no go.

Thanks

Victor

[acomiskey]

Victor,

You need to define the interesting traffic on all three firewalls.

Also, on the Main firewall you need to add same-security-traffic permit intra-interface.

Here's a good doc...

http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml

Please rate helpful posts.

[vpoon87]

Hi acomiskey,

I got it to work! The link you sent helped out. I noticed the SA was not allowing the far remote network and I thought it was on my side. I had to include the far side network on the hub VPN server and it allowed it out of my ASA after renegotiating.

Thanks for getting me started in the right direction!

Victor