Asa 5510 Os 8.03 change Ipsec tunnel ip endpoint in CLI

[dmooreami]

I have an ipsec tunnel  IP is changing from mythical 200.200.200.182 to 200.200.200.254. 

Is it possible to change the .182 ip in  below config via the CLI to .254 and have the site-to-site vpn continue to work?

crypto map asafw 6 match address outside_6_cryptomap_1

crypto map asafw 6 set pfs

crypto map asafw 6 set peer 200.200.200.182

crypto map asafw 6 set transform-set ESP-AES-128-MD5

crypto map asafw 6 set security-association lifetime seconds 28800

crypto map asafw 6 set security-association lifetime kilobytes 4608000

tunnel-group 200.200.200.182 type ipsec-l2l

tunnel-group 200.200.200.182 ipsec-attributes

pre-shared-key dummyPresharekey

Will doing a :

no crypto map asafw 6 set peer 200.200.200.182

crypto map asafw 6 set peer 200.200.200.254

and

no tunnel-group 200.200.200.182 type ipsec-l2l

tunnel-group 200.200.200.254 type ipsec-l2l

tunnel-group 200.200.200.254 ipsec-attributes

pre-shared-key dummyPresharekey

achive what I am looking to accomplish?

[Jouni Forss]

Hi,

To my understanding you have to use the following commands

no crypto map asafw 6 set peer 200.200.200.182

no tunnel-group 200.200.200.182 ipsec-attributes

no tunnel-group 200.200.200.182

crypto map asafw 6 set peer 200.200.200.254

tunnel-group 200.200.200.254 type ipsec-l2l

tunne-group 200.200.200.254 ipsec-attributes

pre-shared-key dummyPresharedkey

Also if you have other attributes set to the original L2L VPN you have to remove them first before the actual tunnel-group and remember to configure them to the new VPN tunnel-group

There shouldnt be more to this to my knowledge.

Always good to take backups of your ASA configurations when you're not absolutely sure.

- Jouni