ASA terminate LAN2LAN VPN's on unique addresses

[jjaques]

I currently have an ASA5550 terminating 10 LAN2LAN tunnels on one public IP address on the outside interface. Is it possible to terminate each LAN2LAN tunnel with a unique local address? This way if a tunnel needed to be moved to a new ASA the remote LAN2LAN peer would not need to be reconfigured.

[Ivan Martinon]

Unless you terminate them on a different interface, and configure the routing accordingly your answer would be no.

[jjaques]

Hello, thanks for your feedback. I have interfaces that I can use on the ASA. My question is can I configure the additional Gig interfaces as outside interfaces and place them in the SAME subnet/vlan as the current outside interface (bridge them together). I think I have read that the interfaces must EACH be in a separate VLAN and subnet. thanks

[mkkeyan]

same subnet not possible , only option you can use static nat, permitting Ipsec ports.

[jjaques]

Hi mkkeyan,

can you explain that configuration in a bit more detail? I understand static NAT and can permit ESP and IKE, but what am I natting?