up vote 0 down vote favorite
share [g+] share [fb]

I'd like to do a route based VPN between two sites. The purpose of this is to get remote site traffic passing through a transparent gateway at the headend, instead of using a proxy.

So currently it is straightforward with the policy based VPN in place currently - remote sites have a proxy defined so any internet destined web traffic matches the interested traffic rules because it goes to the proxy.

In the absence of the proxy server, encryption domains cannot be used - the destination network is "everything".

Route based VPNs use a GRE tunnel ordinarily so the default route can be the tunnel, and everything gets encapsulated in the tunnel which is part of the encryption domain. However, the remote site has an IOS router, and the headend is an ASA. So there does not appear to be any way to create a tunnel between them.

I have explored terminating the GRE tunnel on the core switch at the headend, however it is a 3750 - the feature set does not include gre tunnels, and even if it did, gre is switched on the CPU apparently so can suffer/cause performance issues.

So beyond changing hardware out, can anyone suggest a way to allow remote sites to access the internet over an IPSec VPN without needing a proxy server?

link|improve this question
88% accept rate
I haven't actually tried this, so forgive my ignorance - can it not build an IPSec SA with a remote network of 0.0.0.0/0? – Shane Madden Aug 29 '11 at 4:22
I haven't tried it either, I am assuming you can't do this. – Paul Aug 29 '11 at 4:59
I've got a lab of ASAs in the office, I can check on Tuesday - worth a shot, I think. – Shane Madden Aug 29 '11 at 5:01
I have about the same question, did anyone work it out? – Mick May 24 at 8:51
@Mick I didn't, no, and I am fairly sure it isn't possible. In the end the transparent requirement was removed so I could just use straightforward ipsec. If your question isn't exactly the same, perhaps a new question is warranted? – Paul May 24 at 13:43
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.