Home/Support/Support Forum/Digi TransPort WR11 and Cisco ASA EasyVPN with NEM (Network Extension Mode)
Welcome to Digi Forum, where you can ask questions and receive answers from other members of the community.

Digi TransPort WR11 and Cisco ASA EasyVPN with NEM (Network Extension Mode)

0 votes
I'm trying to configure both Cisco ASA and Digi WR11 in a situation, where Digi is coming from dynamic public address towards Cisco ASA, utilizing Easy VPN with Network Extension Mode. Document AN36 is closest to what I want, but only gives example configuration regarding EasyVPN Client Mode, not NEM mode enabled.

I fairly familiar with ASA configuration, but I keep banding my head towards Phase2, where error from the ASA says: "Group = digieas-ezvpn-group, Username = digieas-ezvpn-user, IP = 85.76.47.253, Aborting Connection: IKEv1 RA client which did not request an assigned IP is attempting to establish a phase 2 SA for 192.168.243.0."

Sure the client (Digi) does not get a virtual IP as the Digi is configured not to request that (Virtual IP request: Off), and because in ASA side the tunnel-group is configured to be 'nem enable' without any ip local pool. The network 192.168.253.0/24 is the LAN network in Digi router side.

The document AN36 only refers that NEM is supported by Digi, but I cannot find any related documentation on example configuration, so ASA is configured the best of my knowledge with NEM enabled, but still the error remains.

Any chance anyone here have configured similar to this?
asked Oct 17, 2016 in Digi TransPort Cellular by eas New to the Community (0 points)

Please log in or register to answer this question.

1 Answer

0 votes
Hi

I have not tried this before in AN36 where you setup NAT i think you have to set it to

Virtual IP "ON with no NAT" insted of "OFF"

regards

James
answered Nov 1, 2016 by James.Wilson Veteran of the Digi Community (1,225 points)
No Virtual IP is needed
...