route inside 10.1.1.0 255.255.255.0 184.108.40.206---route to reach the ASA-SiteA- inside interface
The inside interfaces of the two ASAs can reach each other through MPLS circuit.We want to create a VPN tunnel between the two DMZ networks so that the trafic goes through a tunnel through the LAN.Can you check the below config and suggest if any changes are needed.
1.For the VPN tunnel to work, does the traffic needs to match a route on the ASA or it just needs to match the access-list(interesting traffic) for example after configuring the VPN tunnel between 192.168.0.0 and 192.168.87.0 networks when I ping 192.168.87.1 IP does it bring up the tunnel since it matches the interesting traffic or the packets go to 220.127.116.11 since they match the default route?
2.Under normal Site-to-Site VPN scenarios traffic initiates on the high security interface (DMZ or Inside) and goes to low security interface (Outside) but in the above case traffic intiates on the low security interface (DMZ) and goes to the High security interface (Inside) which usually gets blocked unless there is an access-list entry to allow that traffic. So de we have to have an IP any any( on the access-list applied to the DMZ interface) entry between the two dmz networks
Config on ASA-SiteA---
ASA-SiteA(config)#crypto ikev1 enable inside ----- Does enabling ikev1 on the interface interrupts traffic?
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...