I'd like to setup a site-to-site IPSec VPN tunnel between a head office and a branch office, and for political/security reasons, with the sole purpose of being able to access a "Management" subnet at the branch office, not their main LAN.

None of the NICs on this "management" VLAN/subnet have a default gateway: these devices that need to be managed are multi-homed and "straddle" both networks, and because they require Internet access out through the LAN VLAN/subnet, the NIC that's on the LAN VLAN/subnet has a default gateway set as; the MGMT NICs do not have a default gateway.

Because there's no default gateway on those NICs, I'm assuming I'll have to setup a bridged VPN vs. a routed VPN, so that my HQ LAN machines will have a VPN IP on the MGMT network (say I'm assuming these devices don't support static routes (some of them are appliances with limited network configuration).

I'm pretty sure this is how your typical Microsoft RRAS PPTP setup works when you dial in through an XP workstation's VPN client, but can this work for multiple machines on the HQ? I'm assuming each HQ machine would be SNATing behind that VPN IP of Does Cisco ASA 5505 support this? I don't want to allow any traffic back through the tunnel to the HQ LAN either.

EDIT I'll likely setup a small broadcast domain in an isolated MGMT VLAN on the HQ side to minimize all that ARP/broadcast traffic going over the tunnel.



GW (Cisco ASA 5505):


"LAN" VLAN/subnet: GW (fe0

"MGMT" VLAN/subnet: (fe1

  • Bridging is dividing a subnet into multiple parts. All devices need to be in the same subnet to talk, so all machines in HQ that need to access the branch will have to be in the subnet. – Clint Aug 5 '10 at 19:58
  • Couldn't you do a combination of one bridged VPN IP that the rest of the office is NAT'ed behind? – WuckaChucka Aug 5 '10 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.