ASA 5520 V7.2.3
the ASA is connected to Internet via a NAT device
we try to establish a site-to-site VPN tunnel between this ASA
and a remote firewall based on Openswan/Freeswan Linux software,
using the usual preshared key method ;
this remote site supports the NAT-Traversal ;
unfortunately, this firewall does not seem to support the fact
that the ISAKMP packets it received from the ASA have a source
IP address different from the Identity shown inside the ISAKMP
packet itself ;
this difference is due, of course, to the NAT device between
the ASA and the Internet network ;
To try to solve this situation, I have tried to set the ISAKMP
Identity option to "hostname" instead of the default value "address",
in order to force the ASA to shown its identity in ISAKMP packets with
its hostname instead of with its outside IP address,
and so, this should avoid the IP address conflict ;
here is the CLI command :
crypto isakmp identity hostname
unfortunately, this option does not seem to be taken into account
in case of a VPN site-to-site tunnel running in main mode;
this is more or less said in the ASA Config Guide ;
here is an extract :
The security appliance uses the Phase I ID to send to the peer.
This is true for all VPN scenarios except LAN-to-LAN connections
in main mode that authenticate with preshared keys ;
although the Aggressive mode is enabled by default on the ASA, this does not force the 2 boxes to use this mode, and the ASA log shows the main mode is used ;
so, is there a way to force the ASA to use its hostname instead of its IP address as for its identity during the ISAKMP phase ?
any suggestion would be grateful
