About cft14server

cft14server wrote: Basically the remote IKE gateways's IP address is the same as the IP address for the GRE tunnel endpoint making me thing the GRE tunnel terminates on the peer's ASA. I'm guessing this is the problem because the PA will have two routes for the same public IP address, one using the internet and one using the VPN tunnel interface? I don't believe you can make this work for the reason you outline.  If we route correctly for the tunnel end point then the tunnel traffic will not work and vice versa.  I've seen that checkpoint firewalls have a built in feature to allow the same address be used for both the endpoint and tunnel traffic and can manage this on the firewall.  But I am pretty sure neither the ASA or the PA will be able to do so. Is there any chance the ASA can separate these into two addresses?  ... View more

Thanks for providing clarity of your purpose, and yes, what you've described sounds like it would be a good deployment. Regards, tasonibare ... View more