Can I have two tunneles IPSec with differents security parameters on the same link?

[Zagam]

Hi there!

Currently I have a tunnel IPSec between Router 899/887 and ASA 5545, it's works, but I need create a second tunnel on the same link with different traffic, and differents security parameters.

Can I have two crypto maps in the same outside ASA interface?

[Rob Ingram]

Using the same link and same interfaces, no it's not possible. In order for it to work you'd need to peer with a different IP address to distinguish between them and the ASA does not permit 2 x IP address on an interface.

As per my previous thought, certificates would not help either.

In your example if you added the new network to the existing ACL it would establish a tunnel, however it would still use the same security algorithms/PSK, which is not what you said you want.

[Zagam]

So, I just need other interface on router? Or also on the ASA? 

Regards!!!