Thanks @Rob Ingram !
The tunnel's IP address 169.254.0.5/32 is just a dummy address, the same concept as "ip unnumbered X" and it not set on the remote site. I've been using the same concept for a while, and it hasn't been an issue at all. This IP isn't advertised out.
The difference here as stated is the remote Peer IP address and the remote LAN are in the same subnet. First I don't know if this is a problem as I have never configured a VPN peer with similar IP senario before and I've never seen it anywhere. I've looked at many configuration on the internet last couple days and none has something similar
Then if you know for sure that this isn't a problem, then does my typical config work or do I have to change something?
The VPN tunnel is up and here's the output of IPsec sa
Router#sh crypto ipsec sa peer 20.20.20.55
interface: Tunnel5
Crypto map tag: Tunnel5-head-0, local addr 10.10.10.1
protected vrf: Customer_X
local ident (addr/mask/prot/port): (10.10.0.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (20.20.20.0/255.255.255.0/0/0)
current_peer 20.20.20.55 port 500
PERMIT, flags={}
#pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 10.10.10.1, remote crypto endpt.: 20.20.20.55
plaintext mtu 9150, path mtu 9216, ip mtu 9216, ip mtu idb GigabitEthernet0/5
current outbound spi: 0xC1B526A6(3249874598)
PFS (Y/N): Y, DH group: group14
inbound esp sas:
spi: 0xEA15D2D7(3927298775)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 9638, flow_id: HW:7638, sibling_flags FFFFFFFF80000048, crypto map: Tunnel5-head-0
sa timing: remaining key lifetime (k/sec): (4608000/195)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xC1B526A6(3249874598)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 9637, flow_id: HW:7637, sibling_flags FFFFFFFF80000048, crypto map: Tunnel5-head-0
sa timing: remaining key lifetime (k/sec): (4608000/195)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
protected vrf: Customer_X
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 20.20.20.55 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 10, #recv errors 0
local crypto endpt.: 10.10.10.1, remote crypto endpt.: 20.20.20.55
plaintext mtu 9216, path mtu 9216, ip mtu 9216, ip mtu idb GigabitEthernet0/5
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
Router#
