Route-based VPN site-to-site on ASA.

[Ahmad Saad4]

Hi there!

I need to run OSPF over site-to-site IPsec tunnel on ASA.

basically I have HQ, and 3 branches that need to be connected to the HQ via site-to-site and most importantly to run OSPF over the IPsec tunnel instead of default route.

HQ :ASA5525 Version 9.6(3)1 

BR1: ASA5515  Version 9.9(2)

BR2: ASA5525 Version 9.2(2)4

BR3: ASA5516 Version 9.8(2)

I've read some article that only BGP is supported over VTI for ASA v9.8.

I will appreciate if someone can help me out.

Thanks!

[Rob Ingram]

Hi,

Even in the latest ASA version 9.10 only BGP is supported on VTI's, reference here.

HTH

[Ahmad Saad4]

Thanks for the reply, if I don't use VTI (just Poily-based VPN) and configure OSPF on ASA (on HQ and all branches), will the branches be part of HQ's OSPF domain?

[Rob Ingram]

See this link, you can define ospf as non-broadcast and statically define the neighbor.

HTH