topic Re: FTD Site to Site VPN Question in Network Security

FTD Site to Site VPN Question

benolyndav — Tue, 16 Sep 2025 08:59:14 GMT

Quick question, Is it possible to Configure a RB VPN on an FTD using a Loopback Interface.??

I ask because I have been requested to set up one but the thing is the peer IP I have to use my side is not one of the FTD Interface IP Addresses, Also is this the best way to achieve this or is there another way. ??

Thankyou

Re: FTD Site to Site VPN Question

Rob Ingram — Tue, 16 Sep 2025 09:03:05 GMT

@benolyndav yes you can use a loopback on a route based VPN (VTI or DVTI) https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/770/management-center-device-config-77/vpn-s2s.html

Loopback feature was introduced in version 7.3 - https://secure.cisco.com/secure-firewall/v7.3/docs/loopback-interface

Re: FTD Site to Site VPN Question

MHM Cisco World — Tue, 16 Sep 2025 09:01:56 GMT

https://www.cisco.com/c/en/us/support/docs/security-vpn/internet-security-association-key-management-protocol-isakmp/222055-configure-route-based-site-to-site-vpn-b.html

Yes you can

Check above link

MHM

Re: FTD Site to Site VPN Question

benolyndav — Wed, 17 Sep 2025 08:34:56 GMT

@Rob Ingram
So excuse my ignorance but when creating a RB VPN its suggested to use the 169.x.x.x IP Addresses I have done these before without any issues, not sure how this works or needs configuring if I am to use a loopback address for the local RB VPN address.??

Thanks

Re: FTD Site to Site VPN Question

MHM Cisco World — Wed, 17 Sep 2025 08:43:23 GMT

Now give any IP to LO (unused IP) like 1.1.1.1

Then check vti tunnel source can you select Lo as tunnel source?

If Yes then it OK what you need is static route for Remote LO toward WAN interface

If NOT then FMC/FTD not support LO as tunnel source

MHM

Re: FTD Site to Site VPN Question

benolyndav — Wed, 17 Sep 2025 09:37:26 GMT

@MHM Cisco World

Thanks for that and yes I do see the Loopback available for the VTI, So because the IP Address I am using and the 3rd party will be peering with is not an Interface IP Address is this the only way I can do it ??

Thanks

Re: FTD Site to Site VPN Question

Rob Ingram — Wed, 17 Sep 2025 09:41:29 GMT

@benolyndav sounds like you need to use the loopback as the tunnel source rather than the interface IP address. You obviously have the correct IP address defined on the loopback.

Re: FTD Site to Site VPN Question

MHM Cisco World — Wed, 17 Sep 2025 09:53:27 GMT

Let summary

VTI use WAN (public IP) as tunnel source' vti will be UP since public IP is reachable

Vti using LO (as tunnel srouce) with any IP' if remote peer can not reach this IP vti will be down

Note:- you can ONLY use LO as tunnel source.

Re: FTD Site to Site VPN Question

benolyndav — Wed, 01 Oct 2025 10:44:28 GMT

@Rob Ingram Yes I have selected that but what about the below what do I need to select for this please
P.s sorry about the delayed response

Re: FTD Site to Site VPN Question

Rob Ingram — Wed, 01 Oct 2025 10:54:38 GMT

@benolyndav the loopback interface can be used as either a tunnel source or a borrow source, but not both. So if you want to terminate the VPN on the loopback, select tunnel source only.

Re: FTD Site to Site VPN Question

benolyndav — Wed, 01 Oct 2025 11:26:35 GMT

@Rob Ingram So I need to use something from the below range for the VTI IP

Re: FTD Site to Site VPN Question

Rob Ingram — Wed, 01 Oct 2025 11:30:02 GMT

@benolyndav for the VTI tunnel IP address, I would typically personally use an IP address from the internal LAN network space. Personal choice though. It needs to be routed over the tunnel and unique.

Re: FTD Site to Site VPN Question

benolyndav — Fri, 03 Oct 2025 13:41:28 GMT

@Rob Ingram
So if I use a 169.254.7.X/30 address for my vti and the loopback for the tunnel source, what do I point my static routes to for traffic going over the tunnel ??

Re: FTD Site to Site VPN Question

Rob Ingram — Fri, 03 Oct 2025 13:54:07 GMT

Hi @benolyndav You'd point the route to the peer's tunnel IP address in the 169.254.7.X/30 network.

Re: FTD Site to Site VPN Question

benolyndav — Fri, 03 Oct 2025 14:00:57 GMT

@Rob Ingram They aren't using one in that range that's the thing .??

Re: FTD Site to Site VPN Question

Rob Ingram — Fri, 03 Oct 2025 14:07:01 GMT

@benolyndav configure both tunnel interfaces (yours and the peers) in the same network, so they can communicate. Then create static routes (or use dynamic) for the local networks.

Re: FTD Site to Site VPN Question

benolyndav — Wed, 15 Oct 2025 09:22:03 GMT

@Rob Ingram Is it possible to use a NAT address has the peer IP address for RB/PB Site to Site VPNs at all on FTD??
Thanks

Re: FTD Site to Site VPN Question

Rob Ingram — Wed, 15 Oct 2025 09:28:21 GMT

@benolyndav do you mean you want to setup your VPN to peer with an IP address that's actually a NAT on the remote side? If so yes, assuming the NAT is configured correctly on the remote side to translate the NAT IP to the IP address of the firewall/router you wish to establish a tunnel to. You will need to ensure NAT Traversal is configured on both ends to detect that NAT.

Re: FTD Site to Site VPN Question

benolyndav — Wed, 15 Oct 2025 14:07:40 GMT

@Rob Ingram Hi so say I wanted the remote peer end to peer with an NAT IP Address of 192.175.125.23 on my side
how would I need my NAT setting up out and in
so the remote peer is IP 205.190.190.1

and myside local peer that they need to peer with is NAT IP Address 192.175.125.23

Re: FTD Site to Site VPN Question

Rob Ingram — Wed, 15 Oct 2025 14:13:00 GMT

@benolyndav the tunnel source should be a physical or loopback interface IP, so not I don't think that will work. Can you not assign that NAT IP as a loopback, and use that as the tunnel source?