Separate Ipsec Tunnels for Inbound and Outbound traffic

[danieltudares84]

Hi, I need to establish an Ipsec connection between two sites but they need to have different IPs for the inbound and outbound traffic, so we have to get out using an external IP address and the other site have to establish the VPN pointing out to a different IP address to which we are using to connect with them... It is possible to make this connection and assign two external IP to the outside interface? How? I have an ASA 5506-X. 

Thank you. 

Daniel

[Karsten Iwen]

That can't be done with the ASA. You could do it with an IOS-router. But: Why do you want to do that? When the tunnel is established, you can communicate in both directions.

[danieltudares84]

Well, the costumer requested this configuration, they want two separate tunnel for in and out traffic. How it could be done with IOS? Can I configure in the ASA a nat pool overloaded with my two external IPs and then make the tunnel to go out using one of the two IPs and the other side use the other IP?

[Karsten Iwen]

> Well, the costumer requested this configuration, they want two separate tunnel for in and out traffic.

What benefit do they see in that config?

> How it could be done with IOS? Can I configure in the ASA a nat pool overloaded with my two external IPs and then make the tunnel to go out using one of the two IPs and the other side use the other IP?

On the router, VPNs can be terminated on different IPs. That's not the case with the ASA where VPNs are only terminated on the interface IP.

[danieltudares84]

Is it possible to just assign one external IP in my outside interface to get out with my tunnel using that IP and create a DMZ with the other IP to internally reroute the traffic to my internal network? of course with the proper ACLs to avoid security breaches from others sources aside of the opposite peer....

I know this it's kind of messy, I'm just trying to figure out some possibilities.

[danieltudares84]

I