Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm wondering what I'd have to do to make the following scenario possible:

 _____________           __________________
|             |         |                  |
|  Network A  |         |  Network B       |
|             |         |     ___________  |
|             ----------====== Network C | |
|             |         |    |___________| |
|_____________|         |__________________|

I.e. I want to tunnel the trafic from Network C to network A through the network and firewall of Network B.

I have
- a Cisco ASA-5510 on Network A
- an unknown setup on Network B
- Requirements of an as small as possible unit on Network C

My current idea is to prime an ASA-5505 and use it as a hardware VPN-client using EZVPN, but I'd like to have a product that's more rugged and industrial, as the unit may work in +40°C areas.

BTW: Never mind my mad ASCII-art skills ;)

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

What you're talking about is certainly possible, but the "Network B" edge firewall is going to determine how easy that is for you.

If the "Network B" firewall won't pass IPSEC then you're going to have to use some other type of VPN protocol or encapsulate the IPSEC into another protocol. (Off the top of my head I can't recall if the ASA's can do site-to-site IPSEC over UDP tunnels or not...)

You're probably going to have a tunnel that can only be initiated in "one direction", too. I'm assuming that the operators of "Network B" aren't going to forward unsolicited inbound traffic from the public Internet to your "Network C" firewall / VPN termination device. If that's the case then the "Network C" firewall will have to be the one that initiates the tunnel with your ASA on "Network A", because unsolicited traffic from "Network A" (i.e. requests to bring up the tunnel) won't ever get to the "Network C" device. As long as you've got something inside "Network C" that can generate traffic and keep the tunnel running this shouldn't be problematic.

share|improve this answer
    
Hi, thanks for your answer. No that's my thought too, that the tunnel will have to come from Network C, but as you too said, it shouldn't be a problem. Because if the tunnel goes down for some reason the trafic from inside Network C would start the tunnel back up again, right? Also, assuming they allow IPSEC-trafic, my Network C-trafic wouldn't differ from an ordinary IPSEC software client, right? –  Niclas Lindqvist Mar 11 '11 at 14:26
    
Do you know of any industrial VPN hardware client? –  Niclas Lindqvist Mar 11 '11 at 15:19
    
ASAs can do IPSEC over UDP, and apparently over TCP as well according to cisco.com/en/US/docs/security/asa/asa70/configuration/guide/… –  Adam Mar 11 '11 at 16:11
    
@Adam: I figured they could but I'd never actually researched it (having never needed it, personally). –  Evan Anderson Mar 11 '11 at 16:31
add comment

Depending on what kind of traffic you're sending and how many clients you have on Network C, one of the ASA's SSL VPN options might work. Network B would only need to allow outbound HTTPS, and you wouldn't require any VPN hardware at all.

They're aimed at a single client PC using them for remote access though, and the most that you'll be able to do will be to forward particular ports for that client PC.

share|improve this answer
    
Yeah, the thing is we're using special hardware inside Network C, and no PCs will be there. The idea is to talk directly to a computer in Network A from the units in Network C. And as we already have a IPSec setup going, I'd like to stick to that for our case, but it seems a valid point for a more general purpose. –  Niclas Lindqvist Mar 11 '11 at 15:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.