DMVPN Router Placing in DMZ Zone ( Behind Firewall ) has been created

[kamesh_peri]

Is it possible to place a DMVPN Hub router in DMZ Zone of Firewall ( ASA 5585 ) ASA Version 9.3(3)7 ?

If it is possible to place DMVPN router in DMZ zone , so could you let us know what ports needs to be allowed in Firewall and please share what configuration changes need to be applied in firewall ?

Have you observed any issues while DMVPN router in DMZ zone ?

If you are having any reference document or link , please share it with me .

Thanks

[Karsten Iwen]

Yes, that's supported. Some time ago I had exactly this scenario (well, 5520 instead of 5585).

On the ASA you need to forward the Ports UDP/500 and UDP/4500 to your DMVPN Hub.

[kamesh_peri]

Thanks Karsten,

Is it possible to share steps had been deployed in firewall for DMVPn purpose ?

[Karsten Iwen]

As with any internal service, you just need a NAT-config and an access-list allowing the traffic. It could look like the following:

object network DMVPN-HUB
 host 10.10.10.10
 nat (DMZ,outside) static 192.0.2.100
!
access-list OUTSIDE-IN permit udp any host DMVPN-HUB eq 500
access-list OUTSIDE-IN permit udp any host DMVPN-HUB eq 4500