ASA 5506 EasyVPN & DMZ ""ERROR: This configuration cannot be modified with Cisco Easy VPN Remote enabled."

[Adam Hudson]

I need to set up a DMZ interface for my ASA 5506 (IOS ver 9.5.2) that's set up as an Easy VPN client. When I try to modify the third interface I get this: "ERROR: This configuration cannot be modified with Cisco Easy VPN Remote enabled."

Googling around I found this thread which says such a thing should be possible but doesn't mention the above error message: https://supportforums.cisco.com/discussion/12460931/dmz-interface-asa-5506-x

Googling around for that error message I can only find the below two posts that don't seem to have anything to do with my issue:

https://supportforums.cisco.com/discussion/11219271/ssl-vpn-not-working
https://supportforums.cisco.com/discussion/11092461/asa5505-vlan1-subnet-change-remotely

I have the sneaking suspicion I can't have Easy VPN (client) and DMZ set up on the same device but I hope I'm wrong. Any help is appreciated.

[Philip D'Ath · Accepted solution]

Change from using EasyVPN remote to a standard site to site VPN.

EasyVPN remote is designed for connecting up small client connections, and there is no concept of a DMZ in this case.

[Florin Barhala]

I think you're right here. I also noticed Easy VPN was not supported on 5506 until recently last year.

Anyone knows if Cisco plans to drop this tech after all?

[Philip D'Ath]

I don't believe there is any intention to drop EasyVPN support.

[Adam Hudson]

Gentlemen, I found an alternate solution as apparently there's no such thing as a DMZ when you have an Easy VPN firewall.