1

I have a VPN with a gateway to connect to another network (a local mobile operator) which are using CISCO ASA 5550 Version 8.0(3), on azure side i would like advertise the public ip instead of the local azure network since the mobile operator security policy does not accept private ips on their configurations.

The tunnel phase 1 is coming up and the second phase fails with an error saying that the ip is not allowed which is the azure local network.

From the server (with public ip allowed in the network operator) i can ping the mobile operator network gateway but i cannot ping any server in their network.

I am not sure what can be done but am guessing a NAT (Not sure how to do this either) can do it or something i dont know?

NOTE: All resources have been setup using Azure resource manager

Erick
  • 177
  • 2
  • 10
  • The local mobie operator does not accept private ips on their configurations, you can't create object-group with azure virtual network subnet, maybe you should contact the mobile operator for help. If not, you can deploy RRAS in you local network. – Jason Ye Jan 20 '17 at 03:08

1 Answers1

1

I have been able to achieve this by setting up a VPN with public IP address, Azure allows using public ip addresses in the VNet (Note that these a treated as private ip addresses inside the VPN).

The same public addresses was configured on CISCO router instead of private ip addresses.

See resources below 

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-public-ip-within-vnet

https://github.com/Azure/Azure-vpn-config-samples/blob/master/Cisco/Current/ASA/Site-to-Site_VPN_using_Cisco_ASA.md

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal#values

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices
Erick
  • 177
  • 2
  • 10
  • I have the exact same problem, but I can't determine from the links you provided how to configure this. Did you allocate public IP addresses in the portal to reserve them for use in the VNet? Can you post (anonymized) what your VNet subnets look like? – Paul Mar 30 '17 at 20:34