Small branch office network

We have a small branch office (7 users) that will be moving to a building that has a Wireless Residential Gateway (Model: DPC3829). This device provides wifi for 2 other tenants on the same floor. Can we connect another wireless router to this wireless residential gateway device and create our own SSID so that we don't have to use the wifi settings that the other 2 tenants connect to?
I've attached a picture of what the back of the DPC3829 currently looks like. I am thinking I can plug that yellow network cable into another wireless router and create our own wireless network (obviously off of their internet connection) for our 7 users.
Thank you for your help.

u may but any plane wireless device and run it in bridge mode (shouldd run by default i beleive). Then connect one of its lan port to any one of the lan ports available on the DPC3829 thing.
you are correct in what you want to do, and it can be done no problem.
Regards
Please mark answer as correct if it helps.

Similar Messages

Simulating small branch office in lab network

Hi,
I have to setup what seems to be a very basic configuration, but it doesn't work.
In our lab there is a cluster of switches with a 3550 that does all the routing for vlans.
I need to simulate a sort of a small branch office that has one connection
to the outside world (the lab network).
Here is my design:
Vlan 230 (the internet)
A port on 3550 is in vlan 230 and is connected to e0/0 (172.26.230.150) on 2611 router.
e0/1 interface on a 2611 is (192.168.1.1).
A PC is connected to e0/1 (192.168.1.12).
From the router I can ping any host on vlan 230 and other vlans,
I can also ping the pc connected to e0/1.
However from the PC I can only ping 192.168.1.1(e0/1) and 172.26.230.150 (e0/0)
Below is my configuration
Thanks for your help.
R2611-1#sh run
Building configuration...
Current configuration:
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
hostname R2611-1
ip subnet-zero
ip dhcp excluded-address 192.168.1.1 192.168.1.9
ip dhcp pool 192.168.1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
interface Ethernet0/0
ip address 172.26.230.150 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
no mop enabled
interface Ethernet0/1
ip address 192.168.1.1 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
ip classless
ip route 0.0.0.0 0.0.0.0 172.26.230.1
ip http server
no scheduler allocate
end

You are not performing nat on the router.
This is typically required on a box which provides internet connectivity.
Probably the other hosts on vlan 230 have no route back to the pc on 192.168.1.1
Configuring nat on the router will resolve this problem.
regards,
Leo

SPA8800 and SRST for small branch office?

Hi All,
Need some help. I have a central site that will be running Cisco BE 5000. I have a small branch office I would like to place IP phones in so we can just dial an extension to call each other. The branch will have its own connection to the PSTN with a couple of POTS lines from the phone company.
So I am wondering how I can connect branch and HQ for intra-office calling and let the branch office use their PSTN connection for their local calls. I would think I could place a gateway such as the SPA8800 in the branch and connect the PSTN lines to it.
My concern is, what happens if I lose the WAN connection between HQ and branch? Then the branch could not make any calls right? I know a little about SRST and how that solves the issue of losing WAN connection with the central Call Manager site, but I what I don't understand is SRST something that can run on a device like the SPA8800 or do I need an ISR router in the branch that can run SRST if I want the branch to be able to make phone calls without a connection to HQ?
Thanks for any help!

u may but any plane wireless device and run it in bridge mode (shouldd run by default i beleive). Then connect one of its lan port to any one of the lan ports available on the DPC3829 thing.
you are correct in what you want to do, and it can be done no problem.
Regards
Please mark answer as correct if it helps.

Advice on creating small Mac office network

Hello there!
I am setting up a small network for a non-profit organization, and came up with a few problems.
The main one being that I cannot send anything to print from Mac Minis on groud floor, to printer.
In order to make myself clear I have produced a graphic scheme of the network set up.
Everything runs on DHCP, excepto for printer that has a set IP.
I also wonder if I should change any IP on this network to fixed instead of DHCP...
Any help: much appreciated!

It looks like you have set up a basic roaming network. Please double check the following Apple Support article on the details on how these types of networks are configured to make sure nothing was missed when you setup yours.

Branch office setup with L3 switch and router with IOS security

Hello,
I am in the process of putting together a small branch office network and I am in need of some design advise. The network will support about 10-15 workstations/phones, 3-4 printers, and 4-5 servers. In addition we will eventually have up to 25-30 remote users connecting to the servers via remote access VPN, and there will also be 2-3 site-to-site IPSec tunnels to reach other branches.
I have a 2911 (security bundle) router and 3560 IP Base L3 switch to work with. I have attached a basic diagram of my topology. My initial design plan for the network was to setup separate VLANs for workstation, phone, printer, and server traffic. The 3560 would then be setup with SVIs to perform routing between VLANs. The port between the router and switch would be setup as a routed port, and static routes would be applied on the switch and router as necessary. The thought behind this was that I'd be utilizing the switch backplane for VLAN routing instead instead of doing router-on-a-stick.
Since there is no firewall between the switch and router my plan was to setup IOS firewalling on the router. From what I am reading ZBF is my best option for this. What I was hoping for was a way to set custom policies for each VLAN, but it seems that zones are applied per interface. Since the interface between the router and switch is a routed interface, not a trunk/subinterface(s), it doesn't seem like there would be a way for me to use ZBF to control traffic on different VLANs. From what I am gathering I would have to group all of my internal network into one zone, or I would have to scrap L3 switching all together and do router-on-a-stick if I want to be able to set separate policies for each VLAN. Am I correct in my thinking here?
I guess what I am getting at is that I really don't want to do router-on-a-stick if I have a nice switch backplane to do all of the internal routing. At the same time I obviously need some kind of firewalling done on the router, and since different VLANs have different security requirements the firewalling needs to be fairly granular.
If I am indeed correct in the above thinking what would be the best solution for my scenario? That is, how can I setup this network so that I am utilizing the switch to do L3 routing while also leveraging the firewall capabilities of IOS security?
Any input would be appreciated.
Thanks,
Austin

Thanks for the input.
1. I agree, since I have only three to four printers, they need not be in a separate VLAN. I simply was compartmentalizing VLANs by function when I initially came up with the design.
2. Here's a little more info on the phone situation. The phones are VoIP. The IP PBX is on premise, but they are currently on a completely separate ISP/network. The goal in the future is to converge the data and voice networks and setup PBR/route maps to route voice traffic out the voice ISP and data traffic out the other ISP. This leads up to #3.
3. The reason a router was purchased over a firewall was that ASA's cannot handle routing and dual ISPs very well. PBR is not supported at all on an ASA, and dual ISPs can only be setup in an active/standby state. Also, an ASA Sec+ does not have near the VPN capabilities that the 2911 security does. The ASA Sec+ would support only 25 concurrent IPSec connections while the 2911 security is capable of doing an upwards of 200 IPSec connections.
Your point about moving the SVI's to a firewall to perform filtering between VLANs makes sense, however, wouldn't this be the same thing as creating subinterfaces on a router? In both cases you are moving routing from the switch backplane to the firewall/routing device, which is what I am trying to avoid.

Branch Office Access

I use TMG as our companies Proxy as well as default gateway. I have recently installed 2 sonicwall tz105 devices, one located at our branch office and one located in our main office where the TMG server is located. The branch office uses this device for
internet access and a vpn tunnel to our main office. (At one time I had a ISA server at the branch location and it was the vpn tunnel to our main but this is a small 2 man office and keeping the isa server up to date was becoming a pain.) The branch office
has no problems accessing the main office. My problem is getting the main office to access the branch office. Right now if a client computer on the main network wants to access a server on the branch office the only way to accomplish this is to change the
client computers gateway from the tmg server ip to the sonicwall ip. This was not a problem in the past when I had 2 isa or tmg servers at both locations because the rules would pass the traffic to the branch office. I have tried putting rules in the TMG server
for traffic bound to the branch office network but nothing seems to work.
Should I be using tmg rules to accomplish this or do I need to go a different route such as dns or routing.
Thanks,

HI Gray,
Belwo are my suggestations.
Ensure all the client Default gateway is pointing to TMG, If you have any L3 Switch Devices before TMG Internal Interface then on L3 point Default gateway to TMG Internal Interface and on all client make Gateway as L3 Switch.
Create a network Subnet Set of Branch Office in TMG
In TMG Networking, You need to have a route relationship
Go to Networking, Create a new network Rule, From Branch Office Subnet to Internal as Route ( Not NAT). As route is bidirectional it will automatically route Internal to Branch Office
On Access Rule, Create Two Rules, Internal to Office Subnet and Office to Internal and allow all outbound Ports
Ensure, Your SonicWALL is Routing Traffic to Internal network to TMG External interface.

Branch office dial backup design

I'm having more trouble with this than I think I should.
I have 10 small branch offices connected to the home office via frame-relay -- it's purely hub-and-spoke, with no PVC's between branch offices, everything goes to the central office. I'm trying to set up a POTS dial scenario to replicate this. Each branch has a 26xx with a two-port serial card, two analog modems and two POTS lines. The central office has an ISDN PRI terminating in a 3725 with MICA modems.
I can get a branch router to dial on one or both lines (multilink ppp), and the 3725 receives the call. CHAP negotiation works. Where I'm having trouble is in the IP routing. I've tried countless combinations of numbered and unnumbered interfaces, dialer-based ip pool on the 3725, EIGRP and/or floating static routes, etc., etc. Nevertheless, I can't get correct ip routes established, and I feel like I'm banging my head against the wall now. None of the edsign docs I can find on the Web site directly address my scenario in a way I can understand. Any suggestions?

This is my config for our 3640.
interface Group-Async1
ip unnumbered Serial1/0:23
encapsulation ppp
no ip mroute-cache
dialer in-band
dialer idle-timeout 1200
dialer map ip 170.1.1.16 name bri01rt01ec
dialer-group 1
async mode interactive
peer default ip address pool default
ppp authentication pap chap ca
ip route 192.168.16.0 255.255.255.0 172.17.1.6-----our PIX
ip route 192.168.16.0 255.255.255.0 170.1.1.16 200---Ip address of modem that dials in from 1750.
This config looks fine to me..what does everyone think?

Windows 2008 R2 RODC + Branch Office

I'm looking at utilising a new RODC in a small branch office but I have a copuple of queries that hopefully someone can point in the right direction.
Is it possible to move a RODC to a new Site / Subnet like you can with a normal DC. I plan to build the rodc and then move it to the new office once the sites / subnets have been created.
I think I need to run ADPREP / rodcprep to install this server. I currently have 2 windows 2008 rc domain controllers and 1 windows 2003 (soon to be retired).
Plan:
Adprep the domain
Build Windows server and promote to RODC
Create new site and subnet
POwer down RODC
Move RODC to the new site within AD and physcially move to site
Does this sound feasible?
Many thanks

I'm looking at utilising a new RODC in a small branch office but I have a copuple of queries that hopefully someone can point in the right direction.
Is it possible to move a RODC to a new Site / Subnet like you can with a normal DC. I plan to build the rodc and then move it to the new office once the sites / subnets have been created.
I think I need to run ADPREP / rodcprep to install this server. I currently have 2 windows 2008 rc domain controllers and 1 windows 2003 (soon to be retired).
Greetings!
Promote your RODC and let it replicate the content from RWDC, after that move RODC within new site and then move the server to new location with yourself.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Clients Not seeing DHCP server at branch office or not accepting ip offers (NO LOG REPORTS KIND OF IN THE DARK)

Hi there i am having an issue that has popped up recently i have a DC at a branch office that is connected to the main office DC via a Persistent Demand Dial connection in RRAS. Everything was working properly according to me until i found out that the Network
Admin who manages the branch office network failed to notify me that client machines weren't getting IP addresses from the DHCP server. This server was recently installed and wasn't fully implemented till about a week ago when i configured the Demand Dial
connection in RRAS up until that point it just had a regular old VPN connection to the main office while we worked out the kinks with a few things. the things ive tried so far to get DHCP working are as followed
1.Rebooted the branch office server (MULTIPLE TIMES)
2. Uninstalled the DHCP Role and re-installed it....To my surprise 1 client managed to get a ip on its lan adapter after DHCP was re-installed but nothing else
3. Disconnected the connection between the main office DC and the Branch office DC as i figured the main office DC DHCP server might be interfering with the branch office DC DHCP Server but nothing happened
4. Unauthorized and Reauthorized the main office DHCP server and the branch office DHCP server nothing changed
5. sifted through multiple log files on both servers and found noting in fact DHCP logs are empty on both servers
6. restored backups of the DHCP servers from when they were working
7. came here cause im out of ideas and im pulling my hair out
here are the current statistics from the problem server
Start Time: 7/12/2014 2:02:10PM
Up Time: 1Hours, 18 Minutes, 41 Seconds
Discovers: 90
Offers: 90
Requests: 2
Acks: 13
Nacks: 0
Declines: 0
Releases: 0
Total Scopes: 1
Total Addresses 253
In Use 2 (0%)
Available: 251 (99%)
Id like to add that RRAS was getting IP addresses from the problem server up until the point i uninstalled the role and re-installed it
heres is a ipconfig /all from the problem server
Windows IP Configuration
Host Name . . . . . . . . . . . . : MNB-DC
Primary Dns Suffix . . . . . . . : VTEACR.LOCAL
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : VTEACR.LOCAL
PPP adapter Remote Router:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Remote Router
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.141.70.25(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 10.141.70.10
NetBIOS over Tcpip. . . . . . . . : Disabled
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-16-35-AB-D3-05
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::d9e:daa4:34dd:db44%10(Preferred)
IPv4 Address. . . . . . . . . . . : 10.141.80.102(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::226:5aff:feb7:5b3c%10
10.141.80.1
DNS Servers . . . . . . . . . . . : ::1
10.141.80.102
NetBIOS over Tcpip. . . . . . . . : Enabled
PPP adapter RAS (Dial In) Interface:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : RAS (Dial In) Interface
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 169.254.238.243(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Disabled
Tunnel adapter Local Area Connection* 8:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{427DF66B-3B30-40B1-B67E-B5587465C
394}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 9:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 11:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.ziricom.com
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 12:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.VTEACR.LOCAL
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 13:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{BE201060-A9B9-404A-8361-F8FFB82F5
6F6}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 14:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #5
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 15:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.VTEACR.LOCAL
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 16:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #7
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 19:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.ziricom.com
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
if anymore information is needed please let me know i have full access to everything on the network so its not a problem and i am able to remotely access the branch office DC and all computer and switches at any time of the day
Viper Technologies Computer Repair Putting The Venomus Bite Back In Your Computer We Are Located In Antigonish ,NS Canada Check Us Out HTTP://WWW.VIPERTECHNOLOGIES.TK

Hi,
Does this issue occur on one client or multiple?
Please check this article:
http://technet.microsoft.com/en-us/library/cc757164(v=ws.10).aspx#BKMK_5
Regards.
Vivian Wang

TMG 2010 to connect Branch Office

We have TMG 2010 installed for proxy solution. Recently we opened new branch office but they are unable to internet through proxy. I have added the route add command in TMG Server.
route add 10.24.84.0 mask 255.255.255.224 10.24.30.20 -p - Branch 1
route add 10.24.86.0 mask 255.255.255.224 10.24.30.20 -p - Branch 2
10.24.30.20 is our core router IP...
Is there any configuration required in core router and branch office router...Branch office users can access all server service except proxy solution.Please advice

HI
In your branch office,
YOu need to ensure that internal Branch office subnet is able to reach TMG server. Need route to TMG networ from branch office on branch office Router,
TMG should have route to reach Branch office network.
Add branch office subnet as internal in TMG network range

How to setup a small office network

Hello,
I am looking to setup a small office network comprising 6 G4 macs (existing computers) that have been upgraded to the newest OS version. What is the best way to go about networking these computers together in terms of being able to share files, internet connection, access to peripherals and also implementing a firewall.
Any suggestions or help would be greatly appreciated.
Thank you

1, Get a cable internet ISP account; depending on your service you should be able to secure a 5Mbps down and 2Mbps up on the cable e.g. Cox or Comcast.
2. Get a good router. The mass market Linksys and Netgear routers aren't very good in terms of reliability. I use a ZyXEL P-330W router is the best I've ever seen. Its reliable and very efficient in terms of throughout. The Apple Airport Extreme is good.
3. Set up the router to support UPnP. This way all computers will be able to share iChatAV video conferencing. If you enabled "port forwarding" only one Mac would be able to use iChatAV video conferencing.
4. Set up your router for DHCP to dynamically issue Internet address to all your computers.
5. Setup the wireless router for encryption such as WPA. This will encrypt wireless communication.
6. Setup the wireless router for only your computers. You'll have to get the MAC/AirPort ID network addresses as expressed in terms of an xx:xx:xx:xx address. You can get this thru your Systems Preferences -> Network window -> AirPort (in the sidebar) -> Advanced button.
7. If you have Ethernet in your office then skip steps 5 and 6 above.
8. On each computer open up the System Preferences -> Sharing and check-off the File Sharing. Set your user access preferences appropriately.
9. Get a Network enabled All-in-one printer and setup Printer Sharing options. Hook-it up to your network and add your printer by clicking on the "+" sign in your "Print and Fax" Preferences.
10. Don't enable Apple Firewall on each Mac. The router will be the Firewall.
Ok. That's the short-hand.. plug it all in and go!

Randomly monitor small office network

Looking for a user-friendly, dummy-proof article on creating a small office network from a total of four Mac's (3 iMacs, one Air), allowing the administrator to randomly monitor without detection the real-time activities taking place on the other two machines. Triple points for iOS monitoring capabilities, as well

Hello, rjbm_exact.
You definitely need a managed switch and a Cisco Small Business (200 or 300 series) can meet your requirements. You can setup separate VLAN to segregate user access level. Are you also looking at expanding your wireless (guest access)?
Let me know if you need more assistance or e-mail ([email protected]) me directly. Kind regards.

Small Office Network Setup Help

Hi folks,
We are renting a small office in a floor which consists of many offices. The way internet is distributed here is, they have a verizon fios router and a couple of unmanaged switch, from which cables are run to offices for internet. One of the port on a switch is dedicated to our office.
In our office we have 6 computers and a network printer. The computers need to share files with each other and be able to print.
We want to isolate our office network from others. When we use an unmanaged switch, the version router dhcp assigns ip addresses to computers and we are able to access the internet. The verizon local ip is: 192.168.1.xxx. But we can also see computers that are of other offices, which means they can see us.
How do we create a separate network? Say we want to use IP 192.168.10.XXX or 10.0.0.xxx. We just bought a 24 port managed (L2) switch.
Thanks

Hello, rjbm_exact.
You definitely need a managed switch and a Cisco Small Business (200 or 300 series) can meet your requirements. You can setup separate VLAN to segregate user access level. Are you also looking at expanding your wireless (guest access)?
Let me know if you need more assistance or e-mail ([email protected]) me directly. Kind regards.

Branch Office without network

Hi!
We have been trying to use a branch office install on a single computer for concurrent access from multiple (local) clients.
This works like a charm as long as the computer is on a network (dial-up up or LAN). When we disconnect from the network, new connections to the BO database tends to take several seconds.
The BO machine OS is Windows NT or 2K
I suspect this delay has something to do with the network connection. We have tried to install Microsft Loopback Adapter to remedy this. The result is that it is a little bit faster than before, but the delay is still there.
Is the Branch Office multiuser listener bound to a specific network interface? If so can it be changed? Or does anyone have any other ideas...

It is possible that a PC responds slowly when connecting to the a MU listener when the PC is not on the network. Check how the DSN is defined. Defining it as a localhost may speed up.
MU Listener uses Windows sockets to open the connection.

ASA5505 I cannot reach to an outside network from a branch office

My customer has a HQ office and many Branch offices. In the HQ there is an ASA5510 configured as a default gateway, From HQ customer must access to internet (everythig works fine), from Inside LAN should reach to anyway including special services like Credit Card service provider and others (it works fine). From Branch offices must reach Inside LAN hosts (it works fine), from Branch Offices must reach DMZ (it works fine), from branch offices should reach CC Service provider and here's the point of this Q, From almost all branch offices they reach CCSP fine but branch offices where an ASA5505 is installed (Offices that reach CCSP have a RV042 installed or a TPlink ER6120 installed) but offices with ASA just can ping to LAN side of CCSP's router.
I think ASA5505 conf is an opened door configuration. Here's the 5505 configuration and also attached the network diagram. Some one can help please

Hi,
Are the branch offices connected to the HQ through some ISP MPLS network since I do not see any L2L VPN configurations on the ASA5505?
I presume this is the case. Since you say that the connections between Branch Office (with ASA5505) and HQ LAN work fine it should tell us that there should be no routing problems between those networks.
The diagram possibly also suggests that all the Branch Office connections come to your HQ network through the same Router at the edge so if other Branc Offices connections CCSP work then there should be no routing problem between the Branch Offices and the CCSP (atleast regarding your part of the network)
Now, some questions.
Does the ISR Router forward traffic destined to CCSP directly to the Router at 192.168.2.249 ?
Does the Router with the connection to the CCSP use the Internet to reach the CCSP or is there somekind of dedicated connection between these networks?
If the Router towards CCSP uses Internet then does it lack some NAT configurations for the source network 192.168.27.0/24? Does it perhaps lack a route towards the network 192.168.27.0/24? Or is there any possible errors in the configurations (wrong gateway IP or network mask somewhere?)
Is there any ACLs configured on the Router that has the connection to the CCSP that might block traffic?
Does the CCSP have all the required routing information to pass traffic towards the network 192.168.27.0/24? (If were talking about a dedicated connection and not traffic through the Internet) Have they allowed traffic from the mentioned network 192.168.27.0/24 to their servers/network?
Have you taken "packet-tracer" output from the ASA5505 to confirm that the ASA configurations allow the traffic and dont drop it for some reason?
For example
packet-tracer input inside tcp 192.168.27.100 12345 193.168.1.100 80
You can modify the IP addresses (source/destination) and the used destination port and protocol to match the connections that are actually attempted.
Have you monitored the connections on the ASA when users attempt them? This should atleast tell you why they are failing or give a hint. You could also configure traffic capture on the ASA5505 if you wanted to make sure if any traffic was coming from the CCSP towards this ASA (return traffic for connection attempt)
Hope this helps :)
Let me know if I missunderstood the situation wrong somehow.
- Jouni

Small branch office network

Similar Messages

Maybe you are looking for