AWS ASAv - Site to Site VPN Tunnel using Public IP as encryption domain

[enriquecaballero]

Hello,

I am trying to figure it out the way to handle it for a client requesting this:

IPSec Peer IP Address ASAv-AWS: 53.1.2.3

IPSec Peer IP Address ASA-Client: 107.1.2.3

Encryption Domain ASAv-AWS: NAT PUBLIC (?)

Encryption Domain ASA-Client: 107.4.5.6

In my end I have 3 ENI (Inside / Outside / Management), but i am not sure how to handle the 2nd Public IP (Encryption Domain) in my end since i have some limitations on # of ENI attached on AWS ASAv, anyone did something similar on AWS ASAv?

Any help / clarification will be really appreciate it.

Thanks!

[enriquecaballero]

Can the Peer Public IP be the same as the Encryption Domain Public IP and handle it by NAT? Maybe that is the way to go?

[Dennis Mink]

the way I read it is that you set up an IPsec tunnel using the remote peer address of 107.1.2.3 on the non-AWS end, then add 107.4.5.6  as interesting traffic. But essentially you would get to go back to them, and clarify.

[enriquecaballero]

On the AWS ASAv I will point the VPN to Peer 107.1.2.3 with 107.4.5.6 as interesting traffic and they will NAT to the proper destination ( i.e 107.4.5.6 ----> 10.1.1.10)

On the Non-AWS they are asking me for the Peer address which is my Public outside and the encryption domain Public IP so they could setup their side.

[enriquecaballero]

I have setup a VPN from:

- my home ASA 50.2.2.8 --> to AWS ASAv 53.1.2.3 with the same Public Peer and Encryption Public Domain in both sides configurations (each its own ;) ). When i am generating interesting traffic from ASA 50.2.2.8, i am getting this debug on AWS ASAv:

Jan 11 03:58:40 [IKEv1]Group = 50.2.2.8, IP = 50.2.2.8, QM FSM error (P2 struct &0x00007f06301bc5f0, mess id 0xe72052b4)!
Jan 11 03:58:40 [IKEv1]Group = 50.2.2.8, IP = 50.2.2.8, Removing peer from correlator table failed, no match!
Jan 11 03:58:40 [IKEv1]Group = 50.2.2.8, IP = 50.2.2.8, Session is being torn down. Reason: crypto map policy not found

Now i have to figure it out how to solve that :)