Network Access
- When you add a network tunnel, we recommend that you choose the IP address based on the data center located closest to you.
- Open UDP ports 500 and 4500.
Cisco ASA version 9.16 or lower devices require static public routable IPv4 address(es) configured on the interface that connects to the public internet and the Cisco Secure Access data center. This static public routable IPv4 address must not be subject to a NAT. If NAT is present, the tunnel will fail. This is because Cisco ASA IKEv2 PSK authentication automatically uses this directly configured IPv4 address as its IKE ID. This ID in combination with the PSK is used to successfully authenticate the ASA with Secure Access.
ASA 9.17 or above supports per tunnels identity and IKEv2 FQDN identity. Now that the ASA can be behind NAT, configure the tunnel in Secure Access as follows:
- Tunnel type: Other
- Authentication: FQDN
- ASA IPsec profile configuration should include the extra command with tunnel identity (set ikev2 local-identity email-id
xxxxxxx@xxxxxxxxx-xxxxxxx.sse.com)