ASA Site to Site VPN peer IP destination IP change

[sreeraj.murali]

Hi,

We have the Site to Site ASA VPN running.

Site-A-IP Address 1.2.3.4

remote Site-B - IP Address 5.6.7.8

The tunnel is up and running currently.

The remote site is getting IP Address changed to 9.10.11.12. Please let me know, the changes requires on the remote end. If you could share the steps for the changing the CLI and ASDM, that would help.

Our site-Site A has ASA 9.1/ASDM 7.1.

I went thru the Cisco online resource, and found that, I would need to create a new tunnel group, with existing Group Policy and new SECRET SHARED KEY(local and remote key same)  share with Site B Security Admin. After that, need to edit the Crypto map adding the new destination peer IP Address 9.10.11.12. I am attaching the screenshot from ASDM, which has to be done for the change.

Also, please suggest the verification and troubleshooting steps/command to check whether the tunnel is up with new peer IP Address.

Please provide expert assistance.

Thanks & Regards

Sreeraj

[Flavio Miranda]

Hi,

 change IP address is very simple, just issue no ip address at interface config level and then ip add and type the new IP address.

 Just keep in mind that this need to be done via console cable or using another interface otherwise you can get in trouble. 

 You dont need to create a new tunnel group if you can let the VPN down for sometime. You just edit the config on the currently VPN to reflect the new IP address.

 Maybe it is easier to create a new one and replace after ready.

Some usefull commands:

show crypto isakmp sa
 show crypto ipsec sa

[sreeraj.murali]

Hi,

Thanks for the response.

I don't need to change my side IP address.

The IP address is getting changed at remote end and I need to make changes on my side to make the tunnel up with the IP changes made on remote peer with new IKE shared secret key.

Please advice.

[Flavio Miranda]

Alright. The idea is the same. 

-If I helped you somehow, please, rate it as useful.-

[sreeraj.murali]

Oh Sorry, I realised now.

Could you please share the config change required to reflect the change in shared key and IP.

[Flavio Miranda]

Send me the show running-configuração and I point you um the right direction. 

 You can hide sensitive information. Only need the overall information.

[sreeraj.murali · Accepted solution]

Thanks for the help
I managed to have the changes made by creating new Tunnel Group-with new Peer IP and Adding the same to exising Cryptomap and it worked.

[sreeraj.murali · Accepted solution]

This link helped.
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113290-add-new-vpn-peer-00.html

[Flavio Miranda]

Glad to hear that.

-If I helped you somehow, please, rate it as useful.-