Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are planning to use a Cisco ASA 5505 as a router in our company. So far we used opnvpn to connect our mobile clients to the company network.

Our question is if Cisco ASA 5505 and openvpn work together? And does anyone have a link to an authoritative source which answers this question?

Our ISP told us that this combination does not work. I only found this entry in a discussion forum which indicates that this combination does not work (

Any help appreciated.

share|improve this question
I assume that you are not asking whatever the router can route OpenVPN traffic, but whatever you can use an OpenVPN client to connect to the VPN provided by the ASA 5505? Do you have any actual indication that it would work? – andol Aug 8 '10 at 17:17
My understanding so far is that i cannot use an openvpn client to connect to the cisco asa 5505 because openvpn and the cisco asa 5505 use different implementations of vpn. Is there a way to just route the openvpn traffic and to keep the openvpn configuration we already we use? Thanks a lot. – Dawit Ghebrehiwet Aug 8 '10 at 18:09
up vote 5 down vote accepted

ASA VPNs support two primary methods of establishing VPNs: IPSec and SSL WebVPN. Typically, the IPSec tunnels are used to establish static point-to-point VPNs (bridging two networks, for example) and the WebVPN is intended for client remote access.

OpenVPN uses its own setup to establish a VPN using SSL, and while OpenVPN and WebVPN use SSL, they're not compatible with other. This doesn't mean that you can't run both - you could setup an OpenVPN server inside for firewall or on a DMZ, and the OpenVPN traffic would be just another TCP stream running over a specific port to the ASA. However, you'll need additional hardware beyond the ASA5505 to accomplish it.

share|improve this answer
Thanks for your answer. Could you elaborate what kind of additional hardware would be necessary to set up the second configuration? – Dawit Ghebrehiwet Aug 9 '10 at 9:22
You'll need whatever hardware runs OpenVPN - a commodity PC or server will generally suffice. Setup OpenVPN as usual, and on the ASA, you'll just want to forward the appropriate port from your outside firewall address to your internal OpenVPN server IP address. Configuring an ASA to forward ports is best left as a separate question, so I won't detail it here. – natacado Aug 10 '10 at 15:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.