My company has created a network topology where we have 2 firewalls. The external one is a DrayTek and the internal one is a Cisco ASA. We also have a dmz connected to the ASA.

The DrayTek public IP address is not a private address. The internal is private The ASA external IP is and the internal is

I am new to VPNs so can a VPN be connected directly to the ASA or does it have to be connected to the external firewall (DrayTek).

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 19:52

2 Answers 2


As far as I could understand, in your topology, you're having two firewalls. One is Cisco ASA and the other is DrayTek firewall device. Also, the outside interface IP address of ASA is (Private IP) and the outside interface IP address for DrayTek perimeter firewall is a public IP address.

So, the DrayTek device is the device that keeps you to connect to the internet since it is having a public IP address. The VPN should be established on the DrayTek device.

If you are going to establish a SSL VPN or remote VPN, then you can configure the same in the firewall by configuring a virtual IP pool. Otherwise, if it is to be connected as a site-site or L2L VPN, you will be requiring the IKE/ISAKMP parameters from the adjacent peer as well for connection negotiation and data transfer. I would recommend to check with the DrayTek appliance guides and manuals for configuring the same.


If you are connecting to Azure via a public network (Internet) then add a public facing port on your ASA for the VPN tunnel to Azure. You could do some static NAT shenanigans to the ASA but it's poor engineering as it violates the KISS principle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.