I have two ASAs that have publicly routable ipv6 addresses, and a /56 at each site. Since we're going to be rolling out ipv6 internally at some point for all users, I'd really like to prevent packets from going out of the ASA unencrypted if the traffic matches a cryptomap.

I have not actually tested this scenario, but in the event that the IPSec SA is not nailed up, would the packets route out the outside interface without being encrypted?

I know on ScreenOS there was a way to ensure this didn't happen by null-routing the opposing side subnet on the outbound interface, but I've not tried this on an ASA yet and am curious if anyone else has input. In ScreenOS, the vpn becomes an interface, so it was easier to say "Null route the subnet on the outside", but I'm wondering if doing that would cause the ASA to route the packets to Null0 before it hits the ipsec engine.

Note: the reason why I cannot yet test this is due to a bug that I need to upgrade our ASA versions to resolve (CSCuj23318)

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 9, 2017 at 17:06

1 Answer 1


If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.