ASA phase 2 - encryption domain

christiancruz88 — Fri, 21 Feb 2020 15:48:55 GMT

hi,

I have a cisco ASA 5525, and I need to establish a vpn site to site.
It establishes phase 1 without problems, but for phase 2 they ask me to use a Public IP for the encryption domain, however that ASA does not have a direct connection to the Internet.
Is there any way to "cheat", with loopback or nat?
The internal server has an internal IP (belongs to an ASA interface -> dmz_3)

Interface Name Security
GigabitEthernet0 / 0 Outside 0
GigabitEthernet0 / 1 Inside 100
GigabitEthernet0 / 2 dmz 50
GigabitEthernet0 / 3 dmz_2 55
GigabitEthernet0 / 4 dmz_3 55

TNKs!

Re: ASA phase 2 - encryption domain

Florin Barhala — Wed, 30 May 2018 11:17:13 GMT

Just add the required routing info for that public IP and you ll make it.
Obviously you will use as next hop and outbound interface the interface that gets VPN packets out.

topic Re: ASA phase 2 - encryption domain in Network Security

ASA phase 2 - encryption domain

Re: ASA phase 2 - encryption domain