IPSec VPN between C.2811 and Firepower with only Real IP addresses

[Ditter]

Hi to all,

i am facing an issue with the following scenario:

A cisco 2811 successfully starts IPSec VPN with an FTD.

Behind cisco 2811 exists a real subnet and i am able to ping between this real subnet and all other Real IP subnets that are routed from the FTD.

I have no need of using RFC1918 IP addressing, therefore no NAT exists in the 2811 side and no NAT exists in the FTD side. 

The problem is that i can not ping anything else that is outside the FTD routing domain , that is other subnets that are routed by another router with which the FTD has ospf connectivity. 

In addition, from the real subnet behind the 2811 i can not get to Internet (for example ping 8.8.8.8).

FTD has full connectivity with other routers within our domain as well as to the internet through default route (last resort) that it receives from our upstream router.

I am sure i miss something but i do not know what it is.

I wouldn't believe that the FTD translates everything by default to its outside interface , because according to whatismyip.com i can see my real IP address and not the real outside IP address of the FTD.

Any ideas on this?

Thanks,

Ditter.

[MHM Cisco World]

First policy based vpn is not good here use route based vpn vti.

Then make ftd push defualt route to Cisco router' hence router will use vti to access internet.

In ftd config NAT out'out cisco router lan will nating to ftd out interface IP.

""The problem is that i can not ping anything else that is outside the FTD routing domain , that is other subnets that are routed by another router with which the FTD has ospf connectivity. ""

This part I dont get it 

MHM

[Ditter]

Thank you @MHM, but in my case the cisco router 2811 is Metro Ethernet based and with a dynamic IP provided by the ISP.   As i recall (and checked it again) VTI can not be applied to my case as VTI currently is supported only with static WAN ip addresses.

What i did was to apply a dynamic crypto map with "any" as subnets protected and it also works, therefore i will stick to this. 

But my problem remains, that is , although i can successfully connect from the remote site to every subnet that is routed by the FTD , i do not have  Internet connectivity.  

What i do not know is if the FTD tries by default to do NAT for all networks that are not routed internally from the FTD and have to go through the outside interface.

So far i have not created any NAT route and the only rules a see in NAT section are the identity NAT rules created automatically by this version of the FMC (7.4.2-172), nice addition to the previous version i had 7.2.8-25.

Any advise of how i can have connectivity to Internet without being NATed from the FTD, as i use Internet IP Addresses (no RFC1918).

Thanks,

Ditter

[MHM Cisco World]

this your netwrok

MHM

[Ditter]

Hi @MHM Cisco World 

please refer to the attached drawing.

As mentioned i can ping all networks routed from the FTD , but none outside the Firewall , no NAT is present in the Firewall except from the Identity NAT rules that were automatically inserted in the NAT table  (that happened due to my upgrade to 7.4.2-172).

In the Access Control Policy i have a rule permitting traffic coming from outside going to outside and the source is real IP address space behind the 2811 and going everywhere  but no matches in hit counters therefore i do not hit this ACL entry.

Nowhere in my network i do NAT for the real subnets.

But still not able to go anywhere except from inside the firewall.

Thanks

Ditter.

[MHM Cisco World · Accepted solution]

Did you check topolgy I shared 

R2 In my topolgy is same as router ftd behind it in your topogly.

R2 need to have NAT of LAN client router.

Also you need to make R2 have route for client router LAN toward FTD for retrun back traffic' you can use static route.

MHM

[ahollifield]

Why are we using a 2811 in 2024?

[Ditter]

Thanks @MHM Cisco World updated our routers with the appropriate routes and now everything worked.