Configure Cisco ASA for remote access vpn from VLAN to VLAN

[seepy83]

The scenario is that our office has 1 Internet connection coming into the outside of our ASA, and then 1 port on the inside is split into subinterfaces/VLANs to handle traffic for different networks/DMZs. I want clients on one of the DMZs (guests put on a wirelessguest VLAN by our Cisco 5500 Wireless Controller) to be able to establish a VPN session so they can access the corporate/private side of our network. This will be for a couple of vendors that already have VPN access to our network, but would require the same access (wirelessly) while they are onsite.

I've been told that this scenario would require us to have a second internet connection so that all traffic from the wirelessguest VLAN is routed out that second connection, and they could then establish a VPN connection with the outside interface on the ASA. Is this true? There is no way for us to have devices on a VLAN establish a VPN connection without routing that connection over the internet?

I can provide more details if necessary...

 

[jlazzaro]

if you apply 'crypto isakmp enable <interface>' on the ASA, wireless guests you should be able to establish VPN connectivity with the connecting ASA subinterface. i haven't found a way (even through TAC) to VPN to the outside interface from another interface on the same ASA.

for the connection profile you could have 2 separate profiles (outside and wireless gateway IP), or use DNS in the profile and serve the different gateway addresses.

 

[seepy83]

Thanks for the response...I'll have to try this when I'm in the office tomorrow. The person I spoke to about it earlier today made it sound like the ASA would only accept VPN connections on the outside interface, and that just didn't sound right to me.

I didn't want to start modifying the config because I haven't done VPN configs before, but when I was looking through the config today I saw the "crypto isakmp enable <interface>" for our outside interface, and I also saw options in the ASDM that made me think it could be configured to accept VPN connections from other interfaces.

 

[seepy83]

Got it working. In addition to the crypto isakmp enable, I needed to add crypto maps for the guest wireless subinterface.