Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to extend a VPN further into an organisation:

At the main location I have a private network (call it 192.168.0.0/24) which is connected via a Cisco ASA 5510 to a Draytek ADSL router. The remote location also has a private network (call it 192.168.1.0/24) connected directly to their Draytek ADSL router.

The Cisco ASA and remote Draytek have a site-to-site IPSec VPN configured so that we can talk securely to their internal network devices. This setup is replicated a few times (192.168.2.0/24, etc.).

Is there a way to bring the remote private networks onto ours via VLANs on the ASA, so that I could have a VLAN-capable switch with port 1 on 192.168.1.0, port 2 on 192.168.2.0, etc. for testing and configuration purposes?

share|improve this question

migrated from superuser.com Apr 10 '13 at 0:08

This question came from our site for computer enthusiasts and power users.

    
What kind of access you need to allow? I mean what is the final goal of this connection. You have so many options depending on your budget, manageability and performance. –  Mircea Vutcovici Apr 10 '13 at 0:22
    
The aim is to be able to bring up new servers at the central location and work on them while they're being configured for use at the intended remote site, and to be able to demonstrate these machines before they physically have to be removed. –  Iain Hallam Apr 10 '13 at 4:19
    
There's no budget for further hardware, though all our switches are VLAN-capable. Performance isn't a major issue, as this is not a production scenario, and I'm thinking that these connections will be live all the time so they just have to come back OK if the connection is interrupted. –  Iain Hallam Apr 10 '13 at 4:21
    
Ipsec will not encapsulate Layer2 traffic, if that's what you are trying to do –  Olivier S May 16 '13 at 19:32

2 Answers 2

up vote 0 down vote accepted
+50

Cisco (IOS running) routers or Juniper's SRX line (among many others) can do this bridging a layer 2 segment over GRE, L2TP (or for more complex cases MPLS as CCC or VPLS).

For cheaper options Mikrotik's hardware should also be able to do this.

If you have a spare Linux machine at each end OpenVPN has a bridge mode which should work.

This can get fairly complex quite quickly (for example handling the MTU correctly takes quite a bit of care).

share|improve this answer
    
Essentially, I want the ASA to connect VPN 1 to VLAN 10, VPN 2 to VLAN 20, etc., then trunk those VLANs to another switch in our network, so that if I plug something into port 2 of the switch, I'm in the same broadcast domain as the devices on the remote network. –  Iain Hallam May 21 '13 at 9:22

The ASAs act as routers, aka Layer3 / Ip device. Through them you have a route from your local networks ( 192.168.0.0/24 ) to remote networks ( 192.168.1.0/24 ) .

Vlan is Layer2, there is no IP address.

If you want to propagate a vlan across routers you need to encapsulate layer2 traffic into ip traffic. vtun might do the trick but it will certainly be very disappointing in terms of performance, and the setup will be ugly ( you need to install it on two linux/bsd servers at each point, and bridge the vtap interfaces to your lans .. ). Anyway the ASAs will have no role in this.

share|improve this answer
    
Essentially, I want the ASA to connect VPN 1 to VLAN 10, VPN 2 to VLAN 20, etc., then trunk those VLANs to another switch in our network, so that if I plug something into port 2 of the switch, I'm in the same broadcast domain as the devices on the remote network. –  Iain Hallam May 21 '13 at 9:21
1  
You will not do this with ASA, look at @LapTop006 for suggested solutions. –  Olivier S May 21 '13 at 18:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.