FTD Site to Site VPN Question

[benolyndav]

Hi

Quick question, Is it possible to Configure a RB VPN on an FTD using a Loopback Interface.??

I ask because I have been requested to set up one but the thing is the peer IP I have to use my side is not one of the FTD Interface IP Addresses, Also is this the best way to achieve this or is there another way. ??

Thankyou

[Rob Ingram]

@benolyndav do you mean you want to setup your VPN to peer with an IP address that's actually a NAT on the remote side? If so yes, assuming the NAT is configured correctly on the remote side to translate the NAT IP to the IP address of the firewall/router you wish to establish a tunnel to. You will need to ensure NAT Traversal is configured on both ends to detect that NAT.

[benolyndav]

@Rob Ingram Hi so say I wanted the remote peer end to peer with an NAT IP Address of 192.175.125.23  on my side 
how would I need my NAT setting up out and in 
so the remote peer is IP 205.190.190.1

and myside local peer that they need to peer with is NAT IP Address 192.175.125.23 

[Rob Ingram]

@benolyndav the tunnel source should be a physical or loopback interface IP, so not I don't think that will work. Can you not assign that NAT IP as a loopback, and use that as the tunnel source?

[benolyndav]

@Rob Ingram Just found this where it says tunnel source has to be physical Interface 

[Rob Ingram]

Hi @benolyndav https://secure.cisco.com/secure-firewall/v7.3/docs/loopback-interface

[benolyndav]

@Rob Ingram Thanks for that, So i have used the borrow IP and selected the Loopback Interface I created, the tunnel source is now the physical Interface should the 3rd party be pointing to the Loopback Interface or the physical Interface IP address as their peer.??

Thanks

[Rob Ingram]

@benolyndav when you borrow the IP address from the loopback, that borrowed IP address is used on the tunnel interface. In your scenario now, the tunnel source is the phsyical IP address of the FTD's outside interface, that is the IP address the peer will attempt to establish a VPN tunnel to, not the loopback IP.

[benolyndav]

@Rob Ingram Ah ok understood, Just had a thought would I need an ACL if using a Loopback as the source .??

[Rob Ingram]

@benolyndav what do you mean exactly? what did you envisage the ACL is used for?

[MHM Cisco World]

Let summary 

VTI use WAN (public IP) as tunnel source' vti will be UP since public IP is reachable 

Vti using LO  (as tunnel srouce) with any IP' if remote peer can not reach this IP vti will be down

Note:-  you can ONLY use LO as tunnel source.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security-vpn/internet-security-association-key-management-protocol-isakmp/222055-configure-route-based-site-to-site-vpn-b.html

Yes you can 

Check above link 

MHM