Can I terminate and then rebuild, an IPsec Tunnel inside an ASA

My user to Reno wants to send data to Vermont, but must go through the ASA of Kansas.

The Reno to the jump of Kansas must be AES - 128.

The Vermont jump Kansas must be AES - 256.

Can the firewall in Kansas terminate a tunnel, and then build a second tunnel, without having to leave the ASA?

In other words, I have not bent-pipe to a server via the inside address.

Thank you

JC

Hello

So if I understand you correctly, you want to build 2 connections VPN L2L of Kansas. One in Reno and other to Vermont? And you want users to Reno to be able to connect to Vermont through these relationships?

There should be no problem to do that. There is no need for traffic of Reno through the local network in Kansas. It will simply a tower to the interface 'outside' of the Kansas and go to Vermont through the other connection VPN L2L.

Some things you need to take into account during Setup are

  • Reno must define only the traffic to Kansas and Vermont LANs is set to VPN L2L connection to Kansas
  • Reno must define NAT0 configurations for the traffic mentioned above of Kansas Reno and Reno, in Vermont
  • Kansas will have 2 VPN L2L configurations.
  • Kansas will have to define that the traffic between the networks of Reno and Vermont is defined both of above VPN L2L configurations
  • Kansas should have NAT0 configurations on its 'outside' interface, for networks of Reno and Vermont so that traffic between them runs
  • Kansas will also set up "permit same-security-traffic intra-interface". This will allow the movement of the Reno head in Vermont, the same interface, he entered in to. It's because traffic is going to come from "outside" and it will also leave from the "outside".
  • Vermont will naturally have the same kind of needs than Reno as he is also a RADIUS in the topology.

Also, I assume that you always have the option to configure a VPN L2L directly between Reno and Vermont without Kansas having something to do with this configuration.

I hope that the information was useful, I don't know if it is only in the planning stages or if you already tried to set it up and had some problems?

-Jouni

Tags: Cisco Security

Similar Questions

  • A screen as the workflow editor where the components can be dragged and then wired to form a logical flow. ??

    Hi all

    My requirement is to develop a screen as editor of workflow where the components can be dragged and then wired to form a logical flow using versions 11 g/12 c Adf (jdev).
    A table of components from which you can select and drag items to a place where you can drop and form a logical journey with other components.

    Thank you

    r0unak.

    When you use 12 c, you should look in the diagram pane, which is really very powerful. Check out the series in 10 parts of Duncan Mills at https://blogs.oracle.com/data-visualizations/entry/a_guide_to_diagram_part1

    Timo

  • How can I stop and then resume when you use the magnetic Lasso tool?

    CS4 on Mac. I have some fairly complicated selections to make and the magnetic lasso tool seems a good choice. However: How can I stop and then resume when in use? For example, I would like to zoom, start by dragging along the edge, then stop, move the image to a different area of it is in the middle of my screen, then pick up again where I left.

    Hi MarieMeyer,

    You can press the SPACEBAR shortcut to activate the hand tool temporarily once you are finished with the selection on a part of the image.

    Then, move the image with the key space key and let it continue with the selection by using the magnetic lasso tool.

    You can use the SHIFT key to add to the selection by using the magnetic lasso tool.

    Kind regards

    Claes

  • Can drop us and then re-create the index when the database is opened.

    Can drop us and then re-create the index when the database is opened.

    Yes, you can.

    Concerning
    Asif Kabir

  • CC applications can be downloaded and then installed in the different location?

    My computer has a slow internet connection.  I have access to other computers (work, parents, home, etc.) which have much faster Internet connections.  For most applications, I download a faster connection installation package, copy the files to be installed on a flash/jump/thumb drive, and then copy the files on my home computer and perform the actual installation.  If registration is required, the home Internet connection is suitable for this fast.  The main problem I encounter is large installation download files (PS, Lightroom, etc..).

    Can I download applications CC, copy the installation files to a portable device (USB flash/jump/key), and then run the installation of this drive?  Or will I be connected to the machine that will be actually installed on the apps?

    Thank you

    For now, you can download the installation of the CS6 trial programs and install that way.  When you install, you want to enter the Adobe ID linked to your creative cloud subscription.

  • If I move an item in "Junk," can I have and then view it in the preview screen without the risk of any smart malware being released?

    I understand that malware can access my computer simply by displaying an e-mail in the "Snapshot" of my Thunderbird Inbox window. If this is true can I actually to quarantine the message by moving it to "junk"? I read somewhere that once a message has been identified as 'Junk' it is prevented from free malicious software may be incorporated. I ask this question because sometimes I'm not quite sure if the email is really undesirable, or if I'm too cautious and would like to read the message to be sure. I want to emphasize that I don't know to click on an attachment or a link, but just look one e-mail.

    re: I understand that malware can access my computer simply by posting a mail in the window 'Preview' of my Thunderbird Inbox. -you don't know where you reading, but this is not correct.

    First of all, I'll clarify that there is no "Preview" window
    'Preview' implies that the email has not been open.
    A simple click on the email in the list opens the email in the "Message pane" poster under the email list.
    A double click will open the email in a new tab or window.

    All methods open the email.

    This file the mails is not relevant - a selected e-mail opens any file.

    Default Thunderbird automatically showing not "remote content.
    By default, Thunderbird blocks remote images and other content in messages from people you don't know. This protects your privacy because spammers can verify your email address by detecting if you were displaying a remote image for a message on their behalf. Its also possible to incorporate an executable file (malware) in images.

    When you receive a message with the remote images, Thunderbird displays an alert indicating that remote images have been blocked, and the images in the body of the message will be replaced with simple place-holders

    So if you don't allow remote content and that you do not click on the links or open attachments, then you will be ok.

  • Can I uninstall and then reinstall ff without losing the Favorites and passwords? If so, how?

    I made the mistake of changing permissions in the information page on my site of fantasy football. Was trying to get rid of advertising that covered areas of the page and kept me from my weekly starting eleven.
    Instead, he has made it impossible for me to connect to the web pages of my team. I can connect to CBS Fantasy Football, but not for pages dealing with my League or team.

    Install Adblock more Manager of FF Add-ons. It will remove the ad. It's a work around, but it works.

  • How can I view and then rotate or crop the images duplicate

    My wife has a large photo collection (more than 50,000 images) and created a copy of a hundred photographs to include in a video that I'm trying.

    The problem is that I can't host elements to display these images because they are "double images".

    I had to go to "display" Location of the folder mode"able to find the directory.  When I did, I noticed the 10 subdirectories had not been imported, so I tried to import them and got this error:

    Nothing has been imported.  The files or selected it to import one or more files did not all types of supported files, or the files are already in this catalogue.

    I realize they are duplicates, but I want TO see them I can modify them (rotation, cropping, etc).

    (Q) is there a way to get items to 'jump me' to the original photo so that I can rotate or crop the 'original '.  NOTE: I use the Version value function or save my changes as a "new image" altogether.  I think that if it worked, I could create an "Album" that "duplicate" of the photo that my wife gave me and achieve what I have to do.

    I am brand new to elements (previously, I used ACDSee and it could do without hassle).  I have heard and read that organizing Elements 9 is much improved, so I wanted to give it a try.

    (Q) elements have a simple checkbox to allow me to work with duplicate images?

    (Q) is the solution to create a different catalog?    I did to work around this problem (for now).

    Also

    (Q) Elements 9, have a way to show all the images in all the files under a given folder?  I found that if I have a directory that contains 10 subdirectories, when I'm in the upper level without images directory are displayed.  In ACDSee, it show me all images in a directory given, including all subdirectories.  Is it possible to do it in Adobe Elements 9?

    Thanks for any help.

    The Organizer is not a browser, it's a database: even if he can show the photos in your folder structure, it works only on files that have been 'imported' and listed in the catalogue. It can show your saved photos displayed according to the structure of actual file based on the paths saved with each file present, but you will have problems if a top-level folder is empty.

    However, items saved in a catalog cannot be duplicates, and the Organizer prevents duplicates to be registered. There is no simple way to one click to override this constraint, which would mean another database 'key', that is to rename the duplicates, you wish to register.

    In practice: since you have to rename duplicates before importing them, you could do this directly in Windows or any other freeware like Faststone photoresizer.

    Or you may open these images directly from the Publisher, the navigation in your folder structure.

    Imagine you have duplicates in a folder and rename them and import them using only the PES:

    -To the editor, use the 'treat multiple files' to export the files in this folder and rename them, e.g. "IMG_0012.jpg" + "dupl" indicating the same destination folder

    -Try again "get files and videos ' Organizer.

  • I have a many bookmarks saved over a period of years. Y at - it a program that can view them and then delete these is no longer active? Thank you

    I want to be able to clean hundreds of bookmarks that are no longer active or work.

    The add-on CheckPlaces can help with this - https://addons.mozilla.org/firefox/addon/checkplaces/

  • Problems with WINDOWS EXPLORER, can be removed and then re-installed, if yes how?

    Explorer Windows is funky, I have several questions that are difficult to explain. He has just started acting funny last week, it's almost as if he works on his own! Help, please!

    Hello Donald,.

    Explorer is an integral part of Windows, and you cannot uninstall it. To answer your concerns however, I wonder if you have a malware or virus infection? To check these I recommend the following:

    Malwarebytes' anti-malware: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html.

    SuperAntiSpyware: http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html.

    Most run name you use as an antivirus (I use Avast: http://download.cnet.com/Avast-Free-Antivirus/3000-2239_4-10019223.html).

    Let me know if this solves the problem for you.

    Kind regards

    BearPup

  • Can I remove and then to download Media Player?

    I can't saqve playlists. I get Windows Media Player encountered a problem while creating or saving the playlist.message as follows:

    I didn't any major changes to my computer which is a HP running Windows 7 laptop.

    Hello

    Let us know when this issue began to appear, so we can try a restore to before this issue.

    System restore

    http://Windows.Microsoft.com/en-us/Windows7/products/features/system-restore

    Post back with details

  • Looking for help to find articles or resources to learn more about how to migrate to a new computer and also upgrade CS5 to CC at the same time. Can I migrate and then upgrade?

    Looking for help to find articles or resources to learn more about how to migrate to a new computer and also upgrade CS5 to CC at the same time. Should I migrate and upgrade?

    You don't want to think in terms of migration when it comes to Adobe software.  You must install using installation files.  There is no need to have installed CS5 unless you plan to use it.  There is no way to upgrade of CS5 at CC, there is a reduced plan should soon be interrupted.  You get the first annual subscription for almost half of the normal price.

    Creative cloud plans

    https://creative.Adobe.com/plans

    Director of the installation:

    Download/install the desktop application, connect and install applications subscription.

    Creative cloud to desktop
    https://helpx.Adobe.com/creative-cloud/help/creative-cloud-desktop.html

    Sign out, sign in | Creative office cloud app
    http://helpx.Adobe.com/creative-cloud/KB/sign-in-out-creative-cloud-desktop-app.html

    Install, update, or uninstall applications
    http://helpx.Adobe.com/creative-cloud/help/install-apps.html

  • How to determine the cause of the ipsec tunnel fall on ASA 5510

    Is there an easy way to determine the cause of tunnel VPN ipsec l2l fall on one asa 5510? I have enabled logging, but the buffer is full so fast, I can't find something when it is 24 hours later. I'm working on obtaining a server/aggregator syslog configuration but... until it is complete I need a temporary measure. Suggestions?

    Hi Jessica.

    For the buffering limit, you can try:

    Increase the maximum buffer size.

    limit the newspapers to the class of vpn:

    Buffered Debug class vpn connection.

    On the other hand, you can try him debugs:

    Debug crypto peer peer_address condition

    debugging cry isa 128

    debugging ipsec 128 cry

    If you lose the ssh session debugging is disabled.  Finally for the vpn tunnels usually it goes down due to:

    Idle time-out

    the dead peer detection

    remove it from the other end.

    HTH.

  • Voice and IPSEC Tunnels

    In which case I use a DMVPN IPSEC technology for branch connectivity, used ISP know what kind of traffic I run because it is encrypted in the end.

    DMVPN package use is first encapsulated in GRE and then encrypted with IPSEC authentication information. Because the ultimate traffic is IPSEC requires ISP/provider leave the port UDP 500 and ESP open. Once the tunnel is created I can pass any type of traffic because it will use ESP.

    Given what I saw a few deployments where we put in place this kind of solution and telephone traffic did not and ip phones were unable to register. Most of the guys have pointed out that it could possibly be because ISP blocks the SCCP traffic, but my concern is that if we have a branch at Headquarters IPSEC tunnel how the ISP can detect this thing and drop it.

    Please provide feedback on this.

    The provider cannot see inside the tunnel. Only, he could assume that it could be the voice traffic:

    The voice parameters the value DSCP-in IP header when they send traffic. These values are copied to the outer IP header when the traffic is encrypted. With this function you can also do QoS on encrypted traffic.

    But I do not think that a provider might filter on this traffic.

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • Filling out forms and then lock up

    I've created a form that has one of my clients can fill out and then send off to a client. Is it possible that once they have completed their form and before it sends out of their client that I can lock the form of editing. They use Adobe Reader X for the form.

    I was wondering if there was like a filled button I have created which would be loock it out before they emailing. The main reason for this is that they are the Bills they send and obviously they don't want their customers to be able to change the figures.

    Thanks in advance

    Toni

    To flatten their appearances fields are converted to standard page content, you can use the following JavaScript utility: http://www.uvsar.com/projects/acrobat/flattener/

    The other options that are available in Pro are optimized PDF and control upstream.

    I was talking about security standard password, which is studied in more Help doc. Acrobat notes that you don't have to set a password to open, just a Permissions password. It is also optional if you flatten it, since there is no interactive field for the user to change.

Maybe you are looking for

  • I can't connect to itunes store

    I can't update my apps because I can't use my apple ID because I can not connect to itunes store What should I do?

  • My MacBook suddenly started working slow

    Hello! I got my MacBook Pro since 2012 and it suddenly started running slow. I rebooted several times. Also, I deleted some files, but it does not work perfectly. I noticed that when I start watching the video in my MacBook, it will stop so many time

  • Vibe P1m takes forever to load!

    In the face of many questions in charge of this phone. This is very probably a battery or Charger problem. the charger provided seems underpowered. It takes more than 10 hours to fully charge the battery! It is unacceptable for any phone... even more

  • No Internet after hard reset.

    I hit the button to reset on my router, and now my computer & other devices cannot access the internet. I can connect to my router but don't have Internet. It was working fine earlier today until it was hard reset. I ran troublshoot windows and I got

  • Loading of the icons in the form of 11g

    Hi allI develop application using Oracle 11 g Forms.I'm loading the icons folder and configured inRegistry.dat file located in%DOMAIN_HOME%\config\fmwconfig\servers\WLS_FORMS\applications\formsapp_11.1.2\config\forms\registry\oracle\forms\registry.da