We have a number of tunnels needing to be configured for encryption of traffic destined for an internet range of addresses. These tunnels are "internal" in the sense that they traverse our MPLS network. Do we have any issue with terminating the tunnels on internal interfaces as opposed to external public MPLS facing interfaces? To add to it, the far end terminating IPsec device is an ASA which actually sits behind one of the MPLS routers.
For example: Router A internal network 192.168.1.0 needs to access internet address 3.2.2.2. IPsec configuration tells the router to run it through the tunnel which terminates on a remote head end ASA with an external facing interface to network 3.2.2.0 and an internal interface of 192.168.2.1. This ASA is behind Router B. Am I able to terminate tunnels on the internal interfaces of Router A and the ASA? Would NAT be an issue?
Internal 192.168.1.1<--RouterA-->MPLS Cloud<--Router B-->Internal 192.168.2.1<--ASA--> 3.2.2.0
Hope this makes some sense and I appreciate any help,
-Mike
