1

I have two ASAs that have publicly routable ipv6 addresses, and a /56 at each site. Since we're going to be rolling out ipv6 internally at some point for all users, I'd really like to prevent packets from going out of the ASA unencrypted if the traffic matches a cryptomap.

I have not actually tested this scenario, but in the event that the IPSec SA is not nailed up, would the packets route out the outside interface without being encrypted?

I know on ScreenOS there was a way to ensure this didn't happen by null-routing the opposing side subnet on the outbound interface, but I've not tried this on an ASA yet and am curious if anyone else has input. In ScreenOS, the vpn becomes an interface, so it was easier to say "Null route the subnet on the outside", but I'm wondering if doing that would cause the ASA to route the packets to Null0 before it hits the ipsec engine.

Note: the reason why I cannot yet test this is due to a bug that I need to upgrade our ASA versions to resolve (CSCuj23318)

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 9, 2017 at 17:06

1 Answer 1

Reset to default
4

If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.