topic ASA VTI tunnel and regular ipsec tunnel in VPN

ASA VTI tunnel and regular ipsec tunnel

Britto Vimalraj Anthonysamy — Sat, 22 Feb 2020 05:28:26 GMT

hi, i have ASA and there is site to site vpn configured with SITE-A. now additional requirement , i want to create one more tunnel using VTI (GRE) also , i have to translated two of my local subnets as there is IP address conflict on the other side SITE-B.

Now my question is , can regular site to site VPN and GRE tunnel co-exist?

Can i do nat translation for two subnets via VTI (GRE) tunnel? let's say 10.10.10.0/24, 10.10.20.0/24, i want to translate to 192.168.10.0/24, 192.168.20.0/24VPN and AnyConnect, VPN

Can anyone guide me. Thanks

Re: ASA VTI tunnel and regular ipsec tunnel

Rob Ingram — Sat, 29 Sep 2018 20:38:06 GMT

Hi,
ASA does not support GRE only an ipsec encapsulated VTI, more info here.

A Crypto Map and a VTI (ipsec encapsulated) can co-exist on an ASA.

VTI eliminates the need to use NAT exemption rules.

HTH

Re: ASA VTI tunnel and regular ipsec tunnel

Britto Vimalraj Anthonysamy — Sun, 30 Sep 2018 01:53:25 GMT

Hi Thanks for your support.

So how can i do nat translation , over VTI?? is there any way?

yes crytomap and VTI can co-exist, i have a simulated this one.

so only problem , i want to do nat translation over VTI interface