Cisco ASA 5545 x 9.6 code VPN encryption domain

[Steve Coady]

All

After adding to an existing encryption domain that uses object-groups to define interesting traffic, I have added new ip's/object to the object-group, as did the other side, without having to bounce tunnel. 

Is this behavior normal?

Does using object-groups provide some protection when adding new devices toexisting encryption domain? 

[GioGonza]

Hello @Steve Coady,

This is the normal behavior since you are not changing on the previous configuration of the object-groups and this works because you are just adding subnets/host and it creates new SA on the ASA.

But according to your second question, no they don´t offer some kind of protection for the information within. 

HTH

Gio

[Steve Coady]

Thank you for the response.



The new SA is created automatically? Is there some sort of communication between the encryption domains that verifies they are the same but are different than before?

[GioGonza · Accepted solution]

Hello @Steve Coady, 

No, actually the only way to the SA created is sending traffic or issuing the command for the packet-tracer. Once you trigger the VPN tunnel they will check for its encryption domain and then the other side. 

That´s not done automatically. 

HTH

Gio