@ColForbin wrote:
So now all the traffic from R3 to R1 needs to be encrypted. What’s the best approach?
@ColForbin use FlexVPN static VTI between R1 and R3, this is natively encrypted and you can use GRE over IPSec.
https://www.cisco.com/c/en/us/...
@aprasad11 configure a control plane ACL on the ASA to restrict udp/500, udp/4500 (if NAT) and ESP traffic.
Example configuration for an ASA - https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221457-configure-contro...