BIG-IP to Azure Dynamic IPsec Tunneling
In one of my previous posts we took a look at configuring the BIG-IP to act as a site-to-site VPN tunnel endpoint for connecting on-premises environments with Azure. At the time the BIG-IP only supp...
Published Dec 17, 2015
Version 1.0
Greg_Coward
Employee
EmployeeGreg_CowardEmployee
Employee
Per Reddy's question, in this specific example the IP address "10.23.54.2" is more of a placeholder IP because without some kind of IP on the tunnel interface you cannot add a route using that tunnel interface. The IP doesn't play any part in subsequent traffic-selector decisions.
"We do not have Public IP segment on the F5" - That's normal of course for cloud deployments. That's why NAT-D (NAT detection) needs to be enabled for IKEv1 tunnels (it's native to IKEv2). Both peers have to have this enabled. You may wish to forward traffic inbound to the cloud bearing UDP destination ports 500 and 4500 to the (10.x.x.x) self IP configured on the VLAN (not tunnel interface).
Per Ricardo Raza's question: You must use a cloud routeable private IP on the VLAN. The correct IP depends on the network(s) you're using inside your cloud environment.