This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Using a Public IP as a remote IPSec Subnet XG v18

I have been racking my brain thinking of how to make this work. What would you do in this scenario? How would you make this work?

I'm trying to setup an IPsec tunnel for a client. We have a pretty simple setup on our end but the vendor, not so much. I can receive ICMP from the vendors remote subnet(which is a public IP) but it doesn't make it to the internal host. I think this is because its Public IP.

on our end we have 108.x.x.x as the listening interface and 172.x.x.x/32 as the internal host

On the vendors end(Cisco ASA) they have 204.x.x.x GW Address and 205.x.x.x Remote subnet that they are NATing to a 10.x.x.x/32 address.

so in the Tunnel General Settings (I have this setup as a site to site)

Local gateway:

Listening interface = Port1 - 108.x.x.x

Local ID type = IP address

Local ID = 108.x.x.x

Local Subnet = 172.x.x.x/32

Remote gateway:

Gateway Address = Port1 - 204.x.x.x

Remote ID type = IP address

Remote ID = 204.x.x.x

Remote Subnet = 205.x.x.x/32

Many Thanks for your time...

This thread was automatically locked due to age.

0 rfcat_vk over 5 years ago

Hi,

have you created a firewall rule to allow the traffic into the local network?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 5 years ago in reply to rfcat_vk

Yes, for testing I have any/any allowed without restrictions.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to Anthony Anderson

Hi Anthony,

what traffic does log viewer show for that firewall rule?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 5 years ago in reply to rfcat_vk

I see a bunch of allowed traffic from the current vendor being passed, it's source is a private IP. This is the old vendor we're replacing but it proves the current IPSec config and policy work.

When using the packet sniffer I see a bunch of ICMP request traffic from the 205.x.x.x address enter from the tunnel interface with dst 172.x.x.250(the server) but that's where it dies.

For the new vendor, I'm thinking I need a way to NAT the remote 205.x.x.x public IP to a private IP that can be routed internally but how?

I'm dealing with 3 IP's on this tunnel just from the vendor's side.

204.x.x.x (Gateway handles phase1)

205.x.x.x(remote subnet handles phase2)

10.x.x.x(is what 205.x.x.x NATs to)

but all I see is traffic from 205.x.x.x entering my VPN interface. I can't route that to my 172.x.x.250 on prem server
Cancel
Vote Up 0 Vote Down

Cancel