We are planning to use a Cisco ASA 5505 as a router in our company. So far we used opnvpn to connect our mobile clients to the company network.

Our question is if Cisco ASA 5505 and openvpn work together? And does anyone have a link to an authoritative source which answers this question?

Our ISP told us that this combination does not work. I only found this entry in a discussion forum which indicates that this combination does not work (http://www.linuxquestions.org/questions/linux-networking-3/trying-to-connect-to-cisco-vpn-using-openvpn-567007/).

Any help appreciated.

  • I assume that you are not asking whatever the router can route OpenVPN traffic, but whatever you can use an OpenVPN client to connect to the VPN provided by the ASA 5505? Do you have any actual indication that it would work?
    – andol
    Aug 8 '10 at 17:17
  • My understanding so far is that i cannot use an openvpn client to connect to the cisco asa 5505 because openvpn and the cisco asa 5505 use different implementations of vpn. Is there a way to just route the openvpn traffic and to keep the openvpn configuration we already we use? Thanks a lot.
    – user36461
    Aug 8 '10 at 18:09

ASA VPNs support two primary methods of establishing VPNs: IPSec and SSL WebVPN. Typically, the IPSec tunnels are used to establish static point-to-point VPNs (bridging two networks, for example) and the WebVPN is intended for client remote access.

OpenVPN uses its own setup to establish a VPN using SSL, and while OpenVPN and WebVPN use SSL, they're not compatible with other. This doesn't mean that you can't run both - you could setup an OpenVPN server inside for firewall or on a DMZ, and the OpenVPN traffic would be just another TCP stream running over a specific port to the ASA. However, you'll need additional hardware beyond the ASA5505 to accomplish it.

  • Thanks for your answer. Could you elaborate what kind of additional hardware would be necessary to set up the second configuration?
    – user36461
    Aug 9 '10 at 9:22
  • You'll need whatever hardware runs OpenVPN - a commodity PC or server will generally suffice. Setup OpenVPN as usual, and on the ASA, you'll just want to forward the appropriate port from your outside firewall address to your internal OpenVPN server IP address. Configuring an ASA to forward ports is best left as a separate question, so I won't detail it here.
    – natacado
    Aug 10 '10 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy