IPSEC VPN Routing

[Mokhalil82]

Hi

We have an ASA with multiple IPSEC VPNs to 3rd parties. We have now had a new public IP range presented on a new circuit which I have plugged into another interface on the ASA and configured this as Outside2. 

Now I am looking to migrate the VPNs over to the new range one by one as I don't have access to the other end and will have to get the 3rd parties involved.

So in terms of routing, as I reconfigure the VPN for the new range which will use the new interface, do I need a static route for the peer IP out of the new gateway, and do I also need to point the internal IPs for the encryption domain out of the new interface?

ie if the remote ip range is 10.10.10.0/24, do I need a static route for that also with the next hop of the new gateway?

TIA

[Rob Ingram · Accepted solution]

Hi,
Yes you would need a more specific static route out of the new interface in order to establish a tunnel with the peer. You can either define a static route to the remote private IP network via the new interface or potentially use RRI to learn the route.

HTH

[Marius Gunnerud · Accepted solution]

You will need a static route for both the public IP and the private IP.  These can ofcourse be removed once all VPNs are moved over to the new interface and the old interface is ready to be taken down.