Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Order of VPN

Hi,

I've been wondering how the VPN process works on a Cisco asa. the main part I'm struggling with is after I put a static route in for the destination pointing to the outside interface. How does the ASA then know that it needs to send any traffic to the destination through the VPN rather than into the internet?

Thanks

Dan

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: Order of VPN

dan_track wrote:

Hi,

I've been wondering how the VPN process works on a Cisco asa. the main part I'm struggling with is after I put a static route in for the destination pointing to the outside interface. How does the ASA then know that it needs to send any traffic to the destination through the VPN rather than into the internet?

Thanks

Dan

Dan

The ASA knows because of the crypto map access-list you have to define. This access-list defines what is termed "interesting traffic" for the VPN. So the packet comes in and the ASA consults the routing table and see that the destination is reached via the outside interface. It then sees that there is a crypto map applied to the outside interface. So it looks at all the crypto map entries configured and checks the src/dst IPs of the packet against all the access-lists defined in the crypto map. If it finds a match it knows it has to encrypt the traffic and send it down the VPN tunnel.

Jon

2 REPLIES
Hall of Fame Super Blue

Re: Order of VPN

dan_track wrote:

Hi,

I've been wondering how the VPN process works on a Cisco asa. the main part I'm struggling with is after I put a static route in for the destination pointing to the outside interface. How does the ASA then know that it needs to send any traffic to the destination through the VPN rather than into the internet?

Thanks

Dan

Dan

The ASA knows because of the crypto map access-list you have to define. This access-list defines what is termed "interesting traffic" for the VPN. So the packet comes in and the ASA consults the routing table and see that the destination is reached via the outside interface. It then sees that there is a crypto map applied to the outside interface. So it looks at all the crypto map entries configured and checks the src/dst IPs of the packet against all the access-lists defined in the crypto map. If it finds a match it knows it has to encrypt the traffic and send it down the VPN tunnel.

Jon

Community Member

Re: Order of VPN

Thanks Jon,

Is there some documentation you can link to learn about this process?

Thanks

314
Views
0
Helpful
2
Replies
CreatePlease to create content