Member Avatar for jlego

i have two locations, 1 corporate and 1 remote store. they are connected via site-to-site vpns using 2 cisco asa's

the remote store has a security system, which is accessible via a web browser. from my corporate location you can view the cams no problem.

if you VPN into the corporate location, and try to view the cams you can not..

one of the owners wishes to see the cam when he VPNs.

whenever you are at corporate, your ip addresses resides on the subnet 192.168.1.x whenever you are VPNd you are assigned an ip in the range of

one thing i saw in the NAT Rules is an inside rule, type exempt source inside-network/24 destination interface outbound

if i add a new rule type exempt source inside-network/24 destination interface outbound

will this give the VPN users access to the security CAMs ?

or am i way off point?

thanks

  • 2 Contributors
  • 7 Replies
  • 261 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jlego

Dani AI

Generated

Short summary and the likely fix (building on and ): the remote‑access VPN pool (10.0.1.0/24) is not part of the site‑to‑site “interesting traffic” nor covered by NAT‑exempt rules, so traffic from VPN clients never gets pushed down the ASA↔ASA tunnel. Making the corporate LAN (192.168.1.0/24) visible to the stores doesn’t automatically include the VPN pool. The correct approach is (1) add the VPN pool to the site‑to‑site crypto ACLs on both ASAs, and (2) create NAT‑exemption (identity NAT) for VPN_pool <-> store subnets so traffic is not translated.

Example (mirror on both ends; adapt interfaces and object names to the ASA version in use):

access-list S2S extended permit ip 10.0.1.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list S2S extended permit ip 192.168.3.0 255.255.255.0 10.0.1.0 255.255.255.0

Pre‑8.3 NAT exemption example:

access-list NONAT extended permit ip 10.0.1.0 255.255.255.0 192.168.3.0 255.255.255.0
nat (inside) 0 access-list NONAT

ASA 8.3+ (object NAT) example:

object network VPN_POOL
subnet 10.0.1.0 255.255.255.0
object network STORE_NET
subnet 192.168.3.0 255.255.255.0
nat (inside,outside) source static VPN_POOL VPN_POOL destination static STORE_NET STORE_NET

Notes and troubleshooting checklist:

  • The proposed exempt rule in the thread (inside -> 10.0.1.0) is backward; exemption must be from the VPN pool to the remote store subnet.
  • Both ASAs’ crypto ACLs must be updated (they must match mirror images) so the IPsec SAs will form for 10.0.1.0 <-> 192.168.3.0.
  • If split‑tunnel is used, include the store subnets in the split‑tunnel list pushed to VPN clients so clients route those IPs through the tunnel.
  • Test: connect a VPN client, ping the camera IP; on the ASA check IPsec counters (show crypto ipsec sa), NAT translations (show xlate) and sessiondb/state to confirm packets are matched and encrypted.
  • If ICMP/ping works but the camera web UI still fails, check the camera uses additional ports/RTSP or embeds private IPs in pages (streaming sometimes needs extra ports or special handling).

Applying the crypto ACL + NAT exemption (and split‑tunnel update) will make VPN users behave like hosts on 192.168.1.0 for access to 192.168.3.0, allowing the owner to view the cams while connected via VPN.

Recommended Answers

All 7 Replies

Member Avatar for skipdn

Do you have a static IP address for the security camera server? And right now, could the owner use a web browser to view the cams?

Member Avatar for jlego

yes, the camera server has an internal static, 192.168.3.11.
if the owner is on the network (in that particular store or corporate) he can view the security camera using a web browser.

if the owner is connected via vpn, he cannot view the security camera..

whenever you are VPNd, you can not even ping any ips from the remote stores subnet (any remote store).. the vpn assigns IPs in the range of 10.0.1.x.. at corporate you are assigned 192.168.1.x and can see anything at the remote location 192.168.3.x

the stores are connected via bi-directional site-to-site vpns using the ASAs.

hopefully that answers some questions

Member Avatar for jlego

i can configure an ACL and NAT rule that allow the camera to be viewable using the static outside ip assigned by the ISP. however this isnt the setup i am looking for, i would like it to work whenever the user is connected via vpn.

Member Avatar for skipdn

I have never done that. Not good at sisco routers, but it seems a rule would have to be applied to allow that connection. I have my cam server outside the lan here & can be accessed from any browser, anywhere, but not through our vpn. Did that because I didnt know how to configure the router. Maybe someone here knows what needs to be done. Good luck

Member Avatar for skipdn

Thanks for that info, I printed it out for future ref. Sounds like a big headache though... I'd have have to study our router and configuration for quite a while before I'd attempt it. Have a great day

Member Avatar for jlego

thats what im doing lol. i came to this company and everything was setup with shitty configurations. im now working on learning the ASA configuration and trying to reconfigure it properly. glad that helped though, you too.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.