IKEV2 IPSEC VTI behind NAT - ASA to ASA - L2L

[Prime56]

Hi all,

I've been having really easy success configuring my route based tunnels from ASA to ASA. One of my sites though, has its outside IP as a private IP then gets NATd by the modem etc, and sent out.

I have NAT traversal enabled on both ASAs.

In my configs, do I need to have the peer IP as the internal IP address? I can't seem to get the tunnel to come up.

My private IP address right now on ASA 1 is 192.168.0.69 (outside)

[MHM Cisco World]

...

[Prime56 · Accepted solution]

Why is it that everytime I post I figure the issue out?

I had to contact my carrier to tell me my public IP since I didn't have access to remote machines to go online and figure it out. They gave me it, but turns out it was the wrong one.......

Had a user go and give me the IP from ipchicken.com and all is well.....I put too much trust in people sometimes LOL

[MHM Cisco World]

Good Job Man, Yes sometimes you 100% your step is right but still some wrong info. make you crazy.
good luck man

[Sheraz.Salim]

In order to bring the tunnel up you need to define the public IP address on your firewall both firewall.

I assume the ASA Firewall behind the router. this router an upstream is natting the public IP address to the private IP address of the ASA's outside that will work. if this is correct in that case you need to define the router public ip address on your other end firewall to bring up the tunnel as the router will change the UDP 500 into UDP 4500. plus NAT traversal is on by default on the ASA firewalls