I have two /28 subnets A & B.

My main vpn peer ip is in subnet A, it is also my outside interface address.

I have free IP's in subnets A and B and id like to use one of them to host lan to lan my vpn connections.

How do I configure one of my free IP's as the vpn peer? I cannot find any options using ASDM or the CLI and I've been googling for hours!

  • 5
    Show us the relevant configs for the ASAs... sanitize addresses if you like, but understanding this question is currently close to mindreading without a diagram and configs. Jun 11 '13 at 7:00
  • 2
    Don't forget to also post the version of ASA you are running. Different code versions can have different syntax or or features.
    – JelmerS
    Jun 11 '13 at 8:30
  • I thought with ASAs, if you have a subnet routed to your ASA it will proxy arp by default so you can make configurations with those extra addresses?
    – jwbensley
    Jun 11 '13 at 9:01
  • 1
    For nat, yes. For vpn termination, NO. And it's not technically "proxy arp", as it's only answering for the addresses it's handling.
    – Ricky
    Jun 11 '13 at 19:11
  • @RickyBeam You learn something new everyday. That's today covered! Cheers ;)
    – jwbensley
    Jun 12 '13 at 16:24

As Inga alluded, you cannot setup the ASA do this. It does not support "ip aliases"; it has one, and only one address. There are no options to configure isakmp / ikev(1|2) on it's own address. (it's either enabled on an interface or not.)

(And if you get the bright idea to put a free address on a second interface, it won't allow subnets to overlap. However, you could assign "B" to it's own interface, but you'd still be terminating traffic to the ASA's interface address.)

  • The problem is I've shifted the rest of the vpns already to the new device but both firewalls have external IP's in the same subnet!! /cry Thanks anyway though. Great help.
    – moodah
    Jun 12 '13 at 1:15

Either you configure your asa as the vpn peer itself ( and therefore use the ip address already assigned to the ASA) or you configure a static nat and therefore map 1 "external" ip to 1 "internal" Ip permanently. You are then able to terminate the vpn tunnel on the device "behind" the firewall ( given that you have adapted the access-lists accordingly).

I think you probaly want a) but it all really depends on your setup , so i'll highly opt for your configuration and diagram of your setup too :-)

  • Actually he doesn't want a or b. He wants the ASA to terminate VPN traffic on an address that isn't the outside address.
    – Ricky
    Jun 11 '13 at 19:14
  • This is actually a good idea as a work around. Might just create a new security context on the asa though.. Thanks for the comments.
    – moodah
    Jun 12 '13 at 1:16
  • moodah - context are not equiped for vpn... and anyway this is probably really not the way to go...
    – Inga Mewes
    Jun 13 '13 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.