It's been "a while" since I've been near an ASA for VPN configuration purposes, indeed I think it was running 6.something and still called a Pix :-)
Anyhow, I (vaguely) remember it used to be the case that when you had an/some existing L2L ipsec VPN config and you wanted to change/add/whatever to it, planning in things like removing the crypto map from the outside interface first was A Good Idea if one wanted to avoid days of headscratching as to why a perfectly reasonable modification screwed the whole thing over - does that still apply, or is it all a bit more stable/forgiving nowadays?
If you have a scenario say, similar to "L2L with overlapping networks", is it possible to have a many-to-few policy NAT? For instance, instead of the example given in the config docs:
access-list policy-nat extended permit ip 172.18.1.0 255.255.255.0 192.168.1.0 255.255.255.0
is it possible in any way to run your internal network of 192.168.1.0 into a smaller range? If not everything in the internal network will be going via VPN, could something like
access-list policy-nat extended permit ip 172.18.1.0 255.255.255.240 192.168.1.0 255.255.255.0
work? Would that NAT... ...the first x addresses of the subnet, 1-to-1 (i.e. 192.168.1.1-14 > 172.18.1.1-14) or ...the first addresses 'seen' to traverse the tunnel (which is what I'd like to happen) like maybe 192.168.1.212 -> 172.18.1.1 192.168.1.34 -> 172.18.1.2 etc... (and presumably tough luck if you're internal host #15) or, as i suspect, is such a thing not even possible?
Yes ASA is much stable to the problem that you referred. To answere your second question you may pat the tunnel traffic to even a single ip address with policy nat statement, but then this will be a uni-directional tunnnel.
What is SecureX?
Cisco SecureX is included with all Secure Endpoint (formerly AMP for Endpoints) subscriptions. SecureX is a cloud-native platform that aggregates capabilities across your security environment. It’s designed to simplify your environment, ...
Cisco ISE Secure Wired Access Prescriptive Deployment Guide
Authors: Hariprasad Holla (until June 2018), Mahesh Nagireddy (until Dec 2018)
For an offline or printed copy of this document, simply choose ⋮ Options > Printer ...
Meet the Authors Slides- SecureX and the Evolution of Security Orchestration Automation and Response
(Live event – Wednesday, 20th, 2021 at 10:00 a.m. Pacific / 1:00 p.m. Eastern / 6:00 p.m. Paris)
This event had place on Wednesday 20th, January 202...
The following guide goes over the in and out of the Cisco Endpoints Security Analytics Dashboard as an overview and faq page
For more information on the product offering, licensing, support, and how to solution (TAC) guide links and more please visit the...
Join us live on Tuesday, January 19 at 10:00 am PT (and on demand after) as we discuss the latest version of ATT&CK and the expansion of TTPs in v8.
As a security expert, you are tasked with protecting your environment. You see the value of...