I can see that ASA supports VXLAN and IPSec tunnels. Would there be any reason why I couldn't configure AnyConnect WebVPN on the outside and route all the traffic into a tunnel on the inside?
My thinking so far is:
- All static routing with default towards the internet
- VXLAN tunnel with single peer IP (no multicast)
- NX-OS switches at the other end of the tunnel
- Attach a IP SLA to the default route to healthcheck the internal tunnel remote endpoint
- Filter list on the Anyconnect group-policy (I'd expect this to work regardless of the internal interface type)
Has anyone tried Anyconnect with an internal tunnel? I'd really appreciate any feedback on whether this would work.
All the best
James.
