Changing A Remote Gateway IP

Problem

You have an ASA running 8.2(something). You have a l2l VPN with a remote peer. That remote peer is changing its IP address.

Solution

Here's what I did:

• create a new name object for the new peer IP
• create a new tunnel-group definition with the new IP, duplicating the information in the definition for the old IP
• at switchover time, change the crypto map $MAP $NUMBER peer statement to the new peer object name

eventually yielded

This message appears when the IKE peer address is not configured for a L2L tunnel. This error can be resolved by changing the sequence number of crypto map, then removing and reapplying the crypto map.

conf t
no crypto map outside_map 1 match address outside_1_cryptomap
no crypto map outside_map 1 set peer REMOTEPEER
no crypto map outside_map 1 set transform-set ESP-3DES-SHA
no crypto map outside_map interface outside
exit
conf t
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer REMOTEPEER
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
exit