We have a VPN tunnel between two ASA FWs but we're moving one FW off of it's dedicated circuit. We'd like to connect the tunnels with a router in the middle but the tunnels are not coming up. (one FW is MM_WAIT_MSG2 the other MM_WAIT_MSG3).
If the router is doing NAT does it have a static translation for the traffic between ASAs? A dynamic translation is likely to be a problem since a dynamic translation typically allows traffic initiated from inside to outside and responses but does not allow traffic initiated from outside.
I've configured a static NAT on the router and enabled NAT-T on one of the FWs (I have access to this one) but I have to depend on the user to ensure he configured NAT-T on his end.
Sorry for the late post, but I figured out the issue was on the customer side he did not have the same pre-shared key for the FWs, when he changed it the tunnel came up.
