Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have tried convincing my opposite office of the tunnel in question to get site-2-site ipsec up and running.

However they are not really into that and run everything via SSL VPN..

Is it possible to create a site to site tunnel via SSL VPN?

How i would setup the ipsec on our Cisco ASA 5505

local net 192.168.0.0/18
remote net 10.50.0.0/18
IKE proposal pre-share-3des-sha, pre-share-aes-256-sha
IPSec proposal ESP-AES-128-SHA, ESP-AES-128-MD5, ESP-AES-192-SHA, ESP-AES-192-MD5, ESP-AES-256-SHA, ESP-AES-256-MD5, ESP-3DES-SHA, ESP-3DES-MD5, ESP-DES-SHA, ESP-DES-MD5
share|improve this question
    
This question is too vague, what did u try to do? which model of router do you have? how the network are set? –  0wn3r Jan 11 '13 at 8:49
    
using the anyconnect via VPN SSL works fine.. But once connected, i have no internet (WAN) access besides the remote vpn point. Nor do I have access to our own domain (LAN). Its a cisco asa 5505, i actually have 3 local subnets but using a general one as shown in edit would suffice –  user152954 Jan 11 '13 at 9:02
1  
I suggest to read this link searchsecurity.techtarget.com/definition/SSL-VPN –  0wn3r Jan 11 '13 at 10:44
    
i know what the SSL VPN is brother :) –  user152954 Jan 11 '13 at 12:03
    
Are you asking how to do site-to-site VPNs with CISCO IOS, or are you asking if it can be done at all? –  MadHatter Jan 12 '13 at 9:50

1 Answer 1

up vote 1 down vote accepted

cisco asa doesn't support ssl site to site vpn. so if you use cisco asa it is not possible to create a site to site tunnel via ssl vpn because ssl vpn is used for remote access user vpns. you can configure ipsec lan to lan or if you don't have a fixed ip address on the other peer you can configure easy vpn.

have a look at the good cisco docs for asdm and cli:

http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/wizard_vpn.html#wp1053062

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/site2sit.html

if you are not familiar with the cisco cli you better use the asdm vpn wizard. it's a fast and easy way do build vpns.

share|improve this answer
    
I don't normally downvote answers, but this is patently not so. There is no technical reason whatsoever that an SSL VPN cannot be used for site-to-site connectivity. I agree that it's not the best solution (IMHO, IPSec would be much better), and it may well be that CISCO IOS does not support it, but SSL VPNs can and are used for site-to-site hookups; see eg smallnetbuilder.com/security/security-howto/… and sophos.com/en-us/support/knowledgebase/115306.aspx . –  MadHatter Jan 12 '13 at 9:44
1  
you are right but in his case it is not possible. the question is about cisco asa (in my understanding). –  user1008764 Jan 12 '13 at 9:57
    
I would agree the question's highly ambiguous, which is why I've asked the OP to clarify it. When he does, I may ask you (trivially) edit your answer so i can remove the downvote (editing unlocks all locked-in votes). –  MadHatter Jan 12 '13 at 10:28
1  
edited my answer specific for cisco asa devices –  user1008764 Jan 12 '13 at 11:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.