IPsec tunnel without a private network

Question

I'm trying to achieve a site-to-site ipsec tunnel to a Cisco ASA 5520.  Most examples feature the ASA with a public interface that terminates the tuennel and a private network on another interface that the tunnel interacts with.  Where my scenario differs is that the interface that accepts the tunnel is part of a public /29 network where I want the remaining hosts on that subnet to be able to route thrugh to the other end of the tunnel.  My tunnel gets established, but any attempts to route via the IP assigned to that one interface result in the ASA rejecting traffic.  Is this scenario even possible?  If so, what configuration options should I consider?
Thanks!

Answer 1

I got to say I have never tried this or had any situation where I would want to use the ASA like this.
This would be something I would have to test as I can't say for sure if its possible or not.
For one I would atleast make sure the following things
Make sure you have the configuration "same-security-traffic permit intra-interfaceThis will permit the traffic to enter and leave the same interface which in this case is "outside"
That the host default route points to the ASA
Consider configuring NAT0 for the "outside" /29 network on the "outside" interface when the destination network is the remote site network
Use the command "packet-tracer" command to simulate a packet coming from the "outside" host towards the remote site and see what the output ispacket-tracer input outside tcp
How do you confirm the ASA is rejecting the traffic? Do you see some log message?
Have you seen any traffic get encapsulated/encrypted at this site OR is there only traffic incoming from the remote site?
- Jouni