Hi
I am trying to configure a VPN to AWS from a Cisco ASA which is doing the VPN termination.
The agreed setting are:
IKEv1 / 2 AES-256
SHA256
DH-24
PSK
Our ASA is running 9.8.4(26). I don't know about AWS as they are a vendor rather than our own instance.
We are getting phase 1 but failing on phase 2.
Our ASA is behind a Checkpoint firewall (vendor not relevant in my view) which is just literally passing traffic and doing NAT.
AWS connect to a dedicated address on the Checkpoint that NAT's to the Internet facing IP address of the ASA. The ASA targets the publicly routable address given to us by our vendor for their AWS VPN Gateway. Interesting traffic is identical on both side but the inverse of each other.
We have NAT-T enabled and all ports are allowed out and back (udp 500 and 4500, IP50). I see no drops.
Assuming NAT-T is the right thing to do here, can anyone think of anything to be checking?
I don't have logs right now, waiting for them to be provided but any insight into whether NAT-T in this situation is the right thing to do, or, anyone who knows of AWS gotchas, would be appreciated!
Thanks in advance.
