IPSec tunnel Cisco ASA itself

[Roger Base]

hi, I want to get TACACS traffic which is coming from ASA1 itself going through the IPSEC tunnel to the ISE. But how do I put the traffic coming from ASA1 itself to the IPSEC tunnel?

[Rahul Govindan]

Tacacs traffic is going to be initiated from the outside interface of the ASA1. This is because the ISE server is relatively located on the outside with regards to the ASA1. You would have to add the ASA1's outside ip address to the crypto ACL on both sides.

So on ASA1

access-list <existing-crypto-acl> permit ip host <ASA1 outside ip address> host <ise ip address>

on ASA2

access-list <existing-crypto-acl> permit ip host <ise ip address> host <ASA1 outside ip address>

[Roger Base]

Yes i see that. But what if I only wants tacacs traffic through the ipsec and not all traffic coming from asa1 outside interface ?

Thx 

[Rahul Govindan]

In that case, change your crypto ACL to have only the TACAC's port.  As long as the ACL's are mirrored on both sides, this should work.

Alternatively you can leave the crypto ACL as above and use a VPN filter in the ASA group-policy to restrict what traffic you need to go over. An example below:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html#anc7

[Roger Base]

Thanks for quick reply. ASA1 Outside interface is external IP address. Will it be possible to NAT to RFC1918 address and put that into the tunnel?

Lets says. If ASA1 wants to communicate with ISE. It should source from: 100.100.100.100 and not from its own Outside interface IP address. 

Will this be possible?

nat (outside,outside) source static ASA_OUTSIDE NAT_ADDRESS destination static ISE ISE no-proxy-arp

ASA_OUTSIDE = ASA Outside IP address

NAT_ADDRESS = 100.100.100.100

ISE = ISE IP

(100.100.100.100 is just random IP address)