its possible have the same ip on proxy id on ipsectunnel and interface

[D.Silva102984]

good afternon

for example my ISP give me data link with ip address 192.168.20.2/28 this interface i connect to my interface 1/1 ok this work like my WAN, when i create ipsec tunnel i put same ip address on proxy ID 192.168.20/2/28 peer 10.10.10.10 this its possible ? work o have some issues with routing because en static route i have 0.0.0.0/0 next hop 192.168.20.2/28

[reaper · Accepted solution]

the proxyID is only used to negotiate tunnel SAs so doesn't impact routing

you can put anything you like in there, if it makes sense to put it there in the first place

will connections go into the ipsec tunnel that originate from the 192.168.20.0/28 subnet ?

ProxyID is set to negotiate which source subnet (clients) is allowed to communicate over the tunnel with a destination subnet (servers), so typically your local 'trust' and the remote 'trust' subnets are in the proxyID, while the untrust IP is only used in the IKE Gateway object to negotiate the tunnel itself

[D.Silva102984]

thanks for ask my question