Firepower between ASA and Juniper.

[guna.neo]

Firepower is setup with ASA behind it. Need to setup IPSec between ASA and Outside/internet JuniperFW. I can see IKE and ISAKMP packets, but no ESP. Is this even possible:-

Use FMC to traverse IPSEC for an internal ASA

Any inherent policy in FMC that blocks ESP

[Marvin Rhoads]

If your default action in the Firepower Access Control Policy is to Block then the ESP (protocol 50) will be blocked.

The typical recommendation for such a use case is to put the source and destination of the IPsec tunnel in a prefilter policy rule with action of Fastpath. That way you skip all other ACP rules and Snort altogether.

[marce1000]

 - FYI : https://supportportal.juniper.net/s/article/Example-Configuring-site-to-site-VPN-between-SRX-and-Cisco-ASA-Route-based-VPN?language=en_US

     https://tungdt.net/configure-site2site-vpn-between-juniper-srx-and-cisco-asa-firewalls/

 M.