Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco ASA on a dynamic WAN IP with a IPsec site-to-site tunnel to a remote linux host in a datacenter with a static WAN IP. All non local traffic is tunneled and the datacenter end is the default gateway for internet traffic. Essentially, the datacenter is the WAN for this location. This meets our requirements, however this has broken Anyconnect remote access to this ASA's inside network.

I'm already looking for options to forward traffic from the datacenter WAN to a host behind the ASA's DMZ interface and proxy it back at the ASA, since inter interface traffic seems to not be possible. I'm also considering replacing the field's anyconnect clients with OpenVPN and using the datacenter host as the destination for VPN connections.

That being said, both are more complex than I would like to deal with, so I'm hoping I'm missing an option in the ASA that will allow me to NAT traffic from a remote client to the outside interfaces dynamic IP while remaining inside the tunnel. I'm aware of the overhead, but since the location is served by a 3g modem, this datacenter tunnel is my way around the dynamic IP.

Here's a diagram of the connection:

{10.0.0.0/24}INSIDE------|___LOCAL___OUTSIDE(dynamic)=======/
{10.254.254.0/24}DMZ-----|

/=========(static)WAN___REMOTE___|---LAN{172.16.2.0/24}

The ASA's Metric 1 route is the datacenter's static IP using the 3g modem as the gateway. Metric 2 route is default (0.0.0.0/0) using 172.16.2.1 as the gateway.

Thank you for any help working with the ASA's features or confirmation I'll have to look at options beyond the ASA if I want to retain remote access inside.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.