Question to IPSec tunnel endpoints

[jjjwinkler]

we want to establish ipsec tunnels between vpn clients and central internet router (7xxx). Is it possible to use a loopback interface with private ip address as the tunnel endpoint (where we set the 'crypto map' reference)?

happy to hear from you.

jo

[ROBERT WATSON]

why not use a normal interface?

Remember the 1720 is goin to encrypt interesting traffic that matches you access list if the traffic doesnt attempt to move through loopback 0 then your traffic won't be encrypted. Think of the 1720 as a pix you have an untrusted interface and the traffic leaving that interface must be encrypted from prying eyes to your peer.

[rchester]

I think this would lead you into a restriction on the choice of transform set (because of nat) to esp only, and you can not overload the nat.

http://www.cisco.com/warp/public/759/ipj_3-4/ipj_3-4_nat.html

explains the problems of using ipsec and nat concurrently.

I think also that the interface logic for ipsec on IOS is a bit confusing

[huang_ht]

I think this could not be done. How do your client find the tunnel end point (lookback with private IP address) from internet? If you have public IP address assgined to the loopback interface, it should be ok.