DMVPN - Spoke behind ASA FW Can't ping tunnel interface

[lagapidis (Lazarus Agapidis)]

Hello Roman

Implementing a DMVPN scenario with an ASA firewall and NATting in the mix can become somewhat complicated. Take a look at this post which deals with the various alternative scenarios, and which also provides a link to relevant Cisco documentation that will shed some light on your issue…

DMVPN Phase 3 Basic Configuration

Hello Roman Typically, when running DMVPN behind an ASA firewall, there are several options, two of which suit your situation. The first involves placing the DMVPN router in the DMZ of your ASA, and assigning it a public address, which means you can filter traffic, but you don’t actually have to open specific ports. The other involves having the DMVPN router behind the firewall, in which case you will need to open/forward some ports. From my understanding, it is the second scenario that you …

I hope this has been helpful!

Laz