1

I have a resource that we need to connect to on a remote network. I can connect to the network via VPN but cannot connect to the endpoint device.

I discovered that the endpoint has an IP Address 192.168.15.10, netmask 255.255.255.0 but no default gateway. My router (Cisco ASA 5505) is on 192.168.15.1.

Is there anything I can do to the Cisco that would let us access 192.168.15.10 from the VPN (192.168.16.0/24) even though the default gateway is blank on it? Is this a problem we need to send someone to site locally to resolve?

Improve this question
10
  • 1
    the device should not need a default gateway because you are on the same network it is once the VPN connection is established. or is it some other device that lacks the gateway configuration? Is the device assigned an address by DHCP, and the correct default gateway (192.168.16.1) configured for the pool?
    – Frank Thomas
    Oct 19, 2016 at 19:59
  • 1
    I get 192.168.16.200 when connected via VPN, the remote device (192.168.15.10) is statically assigned. I can't ping the device from my computer, but if I VNC to a local host (192.168.15.20) I can ping it from there. Basically I'm hoping there's something I can do within the cisco temporarily that let's me connect to 192.168.15.10 via VPN and give it the default gateway.
    – Grambot
    Oct 19, 2016 at 20:18
  • ok, so your VPN client device does not route traffic to the remote network through the VPN client? what does the routing table say for your remote network after you connect via VPN? it seems less and less likely that its a gateway problem, since you can connect to other devices on the remote lan.
    – Frank Thomas
    Oct 19, 2016 at 20:21
  • 1
    My explanation must not have been clear. The remote device is missing its default gateway. I know this 100%. My route is fine but without the remote device having it's gateway set it can't route traffic outside the LAN it exists on. I'm hoping there's a hack/workaround I can use temporarily to connect to it. The reason is that no PC on the LAN has the software to make this configuration change, but my laptop does. If i can do it from the VPN instead of needing to travel to the site it'd save several hours
    – Grambot
    Oct 19, 2016 at 20:29
  • 1
    Using the old Cisco VPN Client (v5.0.07). Ping works fine to other hosts on the remote network. I can ping the device from within the local network, I can establish a connection to it's webservice locally but nothing remotely (from the VPN). This is 100% an issue with the device not having a default gateway. I can say this with utmost certainty. The more I'm reading though the more I assume there's nothing I can do. The host needs to communicate to a device on a remote subnet without a default gateway. It won't even ARP request the router so I think I'm S.O.L.
    – Grambot
    Oct 19, 2016 at 20:39

2 Answers 2

Reset to default
2

Possibly, as long as you can configure the router next to your device.

Basically, you need to enable (S)NAT on the router – make it masquerade your connections using the router's own IP address, which is on the same subnet as the device.

I don't know how to configure an ASA for this, nor whether it's even possible, but this is how you would do it in Linux iptables:

-t nat -A POSTROUTING -s 192.168.16.200 -d 192.168.15.10 -j MASQUERADE

The same but with the address configured manually:

-t nat -A POSTROUTING -s 192.168.16.200 -d 192.168.15.10 -j SNAT --to-source 192.168.15.1
Improve this answer
2
  • Looks like Cisco ASA does support SNAT. I'll see if that enables me to connect. Thanks.
    – Grambot
    Oct 19, 2016 at 21:05
  • 1
    Update: Looks like this works from the ASA. I'll mark your answer correct but I'm going to update my question with how to do it from the ASA side
    – Grambot
    Oct 23, 2016 at 18:31
1

@grawity's answer below helped me get started. Here's how I accomplished masquerading from the Cisco ASA. This was done with ASA v9.2(3)

In CLI:

object network VPN_HOST
  host 192.168.16.200
object network INTERNAL_HOST
  host 192.168.15.10
nat (any,inside) 1 source static VPN_HOST interface destination static INTERNAL_HOST INTERNAL_HOST

In ASDM (v7.6(2)150):

ASDM Configuration

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .