Cisco Anyconnect with loopback interface

[kamesh_peri]

Hi,

I wanted to configure Anyconnect on my ASAs (A/P cluster 5585, 9.2) (i have 2 ISPs for link fail-over) is there any option to reduce public IP usage? ( example introducing loop-back interface)

Thanks,

Sankar

[Aditya Ganjoo]

Hi Kamesh,

We cannot create a loopback IP on ASA as it is not supported.

Regards,

Aditya

Please rate helpful posts.

[kamesh_peri]

Ok, thank you Aditya

[Dinesh Moudgil]

Kamesh,

If you have 2 active internet connections on the ASA, then you can use one interface to terminate IPSec and another to terminate Anyconnect.

This will work due to the way the ASA's routing table is currently designed. ASA maintains not only global routing table but per-interface routing table as well.

In case of Anyconnect VPN or SSH/Telnet, ASA creates a connection for forward flow and reverse flow for initial request and does not go through route look-up mechanism and just uses egress interface (where the request was received) to send the reply out. Anyconnect session will follow per-interface routing table.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[kamesh_peri]

Thanks so much, is there any way to reduce usage of public IP

[Aditya Ganjoo]

Hi Kamesh,

Could you please elaborate the requirement ?

What is the need for reducing usage of Public IP ?

Are we having mutiple application servers on the inside and for them we need different NAT statements ?

Let us know what is the public IP subnet you are using.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[kamesh_peri]

HI Aditya,

As per below, i have to setup Anyconnect / Site-to-Site on one cluster, in other hand DMVPN setup with individual links, in this scenario how can i reduce Public IP usage ?

[Aditya Ganjoo]

Hi Kamesh,

Anyconnect/S2S will only use one public IP.

Also what is the role of ASA's in the DMVPN setup ?

Are they just passthrough devices ?

Regards,

Aditya