5

I have two /28 subnets A & B.

My main vpn peer ip is in subnet A, it is also my outside interface address.

I have free IP's in subnets A and B and id like to use one of them to host lan to lan my vpn connections.

How do I configure one of my free IP's as the vpn peer? I cannot find any options using ASDM or the CLI and I've been googling for hours!

Improve this question
5
  • 5
    Show us the relevant configs for the ASAs... sanitize addresses if you like, but understanding this question is currently close to mindreading without a diagram and configs.
    – Mike Pennington
    Jun 11, 2013 at 7:00
  • 2
    Don't forget to also post the version of ASA you are running. Different code versions can have different syntax or or features.
    – JelmerS
    Jun 11, 2013 at 8:30
  • I thought with ASAs, if you have a subnet routed to your ASA it will proxy arp by default so you can make configurations with those extra addresses?
    – Baldrick
    Jun 11, 2013 at 9:01
  • 1
    For nat, yes. For vpn termination, NO. And it's not technically "proxy arp", as it's only answering for the addresses it's handling.
    – Ricky
    Jun 11, 2013 at 19:11
  • @RickyBeam You learn something new everyday. That's today covered! Cheers ;)
    – Baldrick
    Jun 12, 2013 at 16:24

2 Answers 2

Reset to default
4

As Inga alluded, you cannot setup the ASA do this. It does not support "ip aliases"; it has one, and only one address. There are no options to configure isakmp / ikev(1|2) on it's own address. (it's either enabled on an interface or not.)

(And if you get the bright idea to put a free address on a second interface, it won't allow subnets to overlap. However, you could assign "B" to it's own interface, but you'd still be terminating traffic to the ASA's interface address.)

Improve this answer
1
  • The problem is I've shifted the rest of the vpns already to the new device but both firewalls have external IP's in the same subnet!! /cry Thanks anyway though. Great help.
    – moodah
    Jun 12, 2013 at 1:15
3

Either you configure your asa as the vpn peer itself ( and therefore use the ip address already assigned to the ASA) or you configure a static nat and therefore map 1 "external" ip to 1 "internal" Ip permanently. You are then able to terminate the vpn tunnel on the device "behind" the firewall ( given that you have adapted the access-lists accordingly).

I think you probaly want a) but it all really depends on your setup , so i'll highly opt for your configuration and diagram of your setup too :-)

Improve this answer
3
  • Actually he doesn't want a or b. He wants the ASA to terminate VPN traffic on an address that isn't the outside address.
    – Ricky
    Jun 11, 2013 at 19:14
  • This is actually a good idea as a work around. Might just create a new security context on the asa though.. Thanks for the comments.
    – moodah
    Jun 12, 2013 at 1:16
  • moodah - context are not equiped for vpn... and anyway this is probably really not the way to go...
    – Inga Mewes
    Jun 13, 2013 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.