SITE-SITE VPN

[fmugambi]

Hello,

Is it possible to do a site to site VPN between two FTDs managed by same FMC?

if yes, for each do you choose remote device as "Extranet" or its "Real name" under the drop down - say under Node B: - Device Name, - Device :-.

Your assistance will be appreciated.

Thank you in advance.

[MHM Cisco World]

Sure you can'

For device name select device name not extranet 

This from Cisco doc.

""Node B is an ASA. Devices that are not managed by the FMC are considered Extranet."" 

[fmugambi]

I gave the actual names, got "duplicate error". why would this be so?

[fmugambi]

but when i use extranet, deployment goes through, but tunnels dont come up.

[MHM Cisco World]

Ok' 

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/215470-site-to-site-vpn-configuration-on-ftd-ma.html

Follow this guide 

' when you edit endpoint dont select extranet select ftdname of peer.

[fmugambi]

[fmugambi]

[MHM Cisco World]

There are two fields 

Device here you select ftd

Device name here you add ftdname of peer

[fmugambi]

Just have the Device Name, where you either choose devices managed by FMC or extranet devices.

[fmugambi]

Here;

[fmugambi]

Note in my case, my both Nodes are managed by same FMC.

[MHM Cisco World]

 both node mgnt by same FMC that why we must not select extranet.

Now your config is correct but I think fmc see two vpn.

Can you start from zero and add new topolgy name and as we agree both select ftd (name in device field)

[fmugambi]

I deleted one topology, i no longer get the error;

ans surprisingly when i do sh run | i [Both peerIp addresses] am getting entries showing me presence of vpn tunnel configured, with crypto maps and acls well attached. but still one Topology. yet i have devices, i expected to have two topologies each respective of each device, having respective endpoints and protected networks.

[fmugambi]

 should i do enable Access control for VPN traffic, or sysop permit-vpn option) ?

[MHM Cisco World · Accepted solution]

Choose Sysop permit-vpn 

If this op. Not appear then config acl to permit traffic of vpn.