I have two ASAs that have publicly routable ipv6 addresses, and a /56 at each site. Since we're going to be rolling out ipv6 internally at some point for all users, I'd really like to prevent packets from going out of the ASA unencrypted if the traffic matches a cryptomap.
I have not actually tested this scenario, but in the event that the IPSec SA is not nailed up, would the packets route out the outside interface without being encrypted?
I know on ScreenOS there was a way to ensure this didn't happen by null-routing the opposing side subnet on the outbound interface, but I've not tried this on an ASA yet and am curious if anyone else has input. In ScreenOS, the vpn becomes an interface, so it was easier to say "Null route the subnet on the outside", but I'm wondering if doing that would cause the ASA to route the packets to Null0 before it hits the ipsec engine.
Note: the reason why I cannot yet test this is due to a bug that I need to upgrade our ASA versions to resolve (CSCuj23318)