3
You're creating an asymmetric routing situation. The destination may be different, but the source will be the same, so return traffic will always flow across the same ("default") tunnel.
One way to get around this is to do "twice nat"; rewrite source and destination. This doesn't necessarily have to happen on the same ASA, but often makes ...
3
Proxy-ID is an IKE option for phase 2 of IPsec. The end points either use the source/destination IP addresses or a proxy-ID for identification (especially when one side has a dynamic address). Both sides need to agree on the parameters.
1
Do yourself a favor and don't use NAT where it's not required. You're tunneling between private address areas and there's no address collision, whence no need to complicate things with using NAT.
Once you're routing transparently, you've simply got two paths between the networks. I'd use policy routing with fall back. ECMP requires session tracking and ...
Only top voted, non community-wiki answers of a minimum length are eligible
