Let me preface my question with the fact that I realize what I want to do may not be possible … but I'm hoping I'm just not looking at it correctly, and someone here can point me in the right direction.
I run several ASAs to connect a ton of l2l VPNs, and I am now having to readdress all of the VPNs due to a change in up stream connectivity. In my current configurations, I have many remote VPNs pointed to the primary outside address of each peer on my side, which was initially done because of a shortage of public addresses and because generally it works that way. As I periodically need to shuffle my end of the tunnels from one ASA to another, however, this requires getting customers involved and that makes the process very complicated even when it's just for our own internal maintenance. The VPNs themselves share no common routing, and are all completely isolated on each side; since they're totally independent, maintenance on one should never need to impact another, however, they always share a peer - so one tunnel can't be easily separated, or temporarily shifted to/from alternate/dedicated hardware without involving the remote side to make configuration changes.
With the new upstream connection, I'm no longer constrained for IPs, and, if possible, I'd like to migrate all of the VPNs to dedicated IPs on my side for use as their peers; but this requires me to be able to host multiple addresses from the same /25 on each ASA … on separate logical outside interfaces to link them to each VPN (since I only have one asa per ~10 VPNs). I've seen configurations like this on other platforms, but haven't yet had any success finding a parallel on the ASAs. That said, I'd be grateful to anyone that can shed some light on how I need to approach it, or why they know it can't be done.
I'm running 5516X hardware with ASA 9.10(1) software.
Thanks for any insight.
