How to establish site to site vpn - Linux machine and cisco asa? Post: 302763733

Sponsored Content

Special Forums IP Networking How to establish site to site vpn - Linux machine and cisco asa? Post 302763733 by ashokvpp on Wednesday 30th of January 2013 11:45:16 AM

01-30-2013

Registered User

How to establish site to site vpn - Linux machine and cisco asa?

Hi,

I am trying to establish vpn between my linux server and cisco asa at client side.

I installed openswan on my cent os.

Linux Server

Code:

eth0 - 182.2.29.10    [ I have public IP]

Gateway - 182.2.29.1 [ and gw]



eth1 - 192.9.200.75  [ Internal Lan i/f]


I have simple IPtables Like
WAN="eth0"
LAN="eth1"
 iptables -t nat -A POSTROUTING -o $WAN -j SNAT --to 182.2.29.10


iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $LAN -j ACCEPT
iptables -A INPUT -i $WAN -j ACCEPT
 




iptables -A FORWARD -i lo -j ACCEPT
iptables -A FORWARD -i $LAN -j ACCEPT
iptables -A FORWARD -i $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT
 


iptables -A FORWARD -s 192.9.200.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -d 192.9.200.0/255.255.255.0 -j ACCEPT
 


iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

Client side Cisco ASA - Device

Code:

Provided details :

BD gateway ip is 212.2.7.15 [ Public IP]
Source IP :- 192.168.91.224 
ESP-3DES-SHA1
 Lifetime is 86400 seconds (Phase-1) & 3600 seconds (Phase-2)
 Authentication is pre-shared

I need advise on configuring ipsec.conf and ipsec.secrets and what IP tables rules I need to add / modify.

Thanks

Best
Ashok

ashokvpp

View Public Profile for ashokvpp

Find all posts by ashokvpp

7 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Moving machine to other site

Hi, I�d like to have some opinions of waht settings we should take note before power down a server and move it to other facilities. Of course, the first thing is check the backups. Thanks in advance.

2. What is on Your Mind?

New Site/Info for Linux Users

Check out this site. This will be helpful for all. Link removed.

3. IP Networking

port access to site to site VPN

Setup a site to site VPN between two cisco routers. One of the site locations is unable to access ports such as https://example.com:9001 How do I let them go into port 9001? They can ssh, ftp, telnet and everything else. Is this a VPN issue or ACL access issue? I put permit ip host...

4. IP Networking

Does cisco 1921 router support site to site VPNs using IPSec?

Q: "Does Cisco 1921 router support,, act as an endpoint for, site to site VPNs using IPSec? If so, how many? " A: If you get the Cisco 1921/k9 with the security services bundle then it will have built in security features. Cisco, typically includes IP Sec tunnels I believe as part of that...

5. IP Networking

Cisco 3750 Switch ASA VPN Routing

Hi,I want connect my ASA 5510 firewall to a 3750 switch with RIP routing. Unfortunately,I am having issues passing the VPN subnet through rip to the 3750.I don't understand how the routing table is populated on the ASA. Any suggestions?

6. IP Networking

IPSec Openswan Site to Site VPN - Big Pain

Hi @all, I try to connect 2 LANs with IPSec/Openswan LAN 1: 192.168.0.0/24 LAN 2: 192.168.1.0/24 This is my Config: conn HomeVPN # # Left security gateway, subnet behind it, nexthop toward right. left=192.168.1.29 ...

7. IP Networking

Openswan with Cisco ASA

Hi all, I need this as soon as possible to solve it or at least to find out what is the problem. I have configured IPSec tunnels with Openswan and Cisco ASA, i have established a connection and the ping was fine, but after some time there is request time out from both sites. I don't have ASA...

LEARN ABOUT FREEBSD

nos-tun

NOS-TUN(8)						    BSD System Manager's Manual 						NOS-TUN(8)

NAME

     nos-tun -- implement ``nos'' or ``ka9q'' style IP over IP tunnel

SYNOPSIS

     nos-tun -t tunnel -s source -d destination -p protocol_number [source] target

DESCRIPTION

     The nos-tun utility is used to establish an nos style tunnel, (also known as ka9q or IP-IP tunnel) using a tun(4) kernel interface.

     Tunnel is the name of the tunnel device /dev/tun0 for example.

     Source and destination are the addresses used on the tunnel device.  If you configure the tunnel against a cisco router, use a netmask of
     ``255.255.255.252'' on the cisco.	This is because the tunnel is a point-to-point interface in the FreeBSD end, a concept cisco does not
     really implement.

     Protocol number sets tunnel mode.	Original KA9Q NOS uses 94 but many people use 4 on the worldwide backbone of ampr.org.

     Target is the address of the remote tunnel device, this must match the source address set on the remote end.

EXAMPLES

     This end, a FreeBSD box on address 192.168.59.34:

	   nos-tun -t /dev/tun0 -s 192.168.61.1 -d 192.168.61.2 192.168.56.45

     Remote cisco on address 192.168.56.45:

	   interface tunnel 0
	   ip address 192.168.61.2 255.255.255.252
	   tunnel mode nos
	   tunnel destination 192.168.59.34
	   tunnel source 192.168.56.45

AUTHORS

     Nickolay N. Dudorov <nnd@itfs.nsk.su> wrote the program, Poul-Henning Kamp <phk@FreeBSD.org> wrote the man-page.  Isao SEKI
     <iseki@gongon.com> added a new flag, IP protocol number.

BUGS

     We do not allow for setting our source address for multihomed machines.

BSD
								  April 11, 1998							       BSD