ipsec - object group

Unanswered Question
Jun 15th, 2012
User Badges:

Hello and thank you in advance

I have a ipsec tunnel setup with the use of object groups. This ipsec tunnel is active and in production.  If I need to add one more IP to that object group will I need to do anything for it to take effect or that will be done automatically?

Sorry for a stupid question.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jennifer Halim Fri, 06/15/2012 - 06:25
User Badges:
  • Cisco Employee,

If you need to add one more IP to the object group for the crypto ACL, you would need to add the same on the remote VPN peer as crypto ACL needs to mirror image between the 2 sites.

Once changes has been done, you would need to clear the tunnel as the SA for the new IP will only be built during the negotiation.

vburshteyn Fri, 06/15/2012 - 06:40
User Badges:

Thank you for responce.

Just to double check (sorry I am a server tech not cisco)

add the IP to that object-group on both ends


clear ipsec sa peer x.x.x.x

and that should be it?  No need to touch NAT?

Jennifer Halim Fri, 06/15/2012 - 06:44
User Badges:
  • Cisco Employee,

Ahh, you got me, yes, you would also need to add that IP to the NONAT (NAT exemption) ACL if you have one configured.

So, it should be:

1) Add IP to both ends of crypto ACL

2) Add IP to NAT exemption on both end

3) Clear tunnel


This Discussion

Related Content