Cisco ASA Site-To-Site VPN change peer IP

Surely, you can achieve this scenario. It is called "Hairpinning" . you need the following : - configure the remote-access users POOL to be part of the crypto access-list associated with crypto map - configure NAT-EXEMPT or NO-NAT access-list to include the pool.

most importantly:

• configure this command: "same-security-traffic permit intra-interface" to permit traffic to come in and go out the same interface in Cisco ASA.
• configure the tunnel peer (router) to include the remote-access users pool in the crypto access-list, because the L2L tunnel crypto access-list must be mirrored in both peers.
• if remote access users use split-tunneling, then you need to ensure that the subnets behind the remote peer (router) are included in the split-tunnel access-list

see this: https://supportforums.cisco.com/message/3864922

Hope This Helps.

Mashal

If you can imagine a situation where you might need over 25 tunnels, go for the 5510; no sense in throwing the extra money at a 5505 security plus license if it won't sustain your needs in the long run.

That said, if 15-20 is all you'll ever need, then it's a lot more cost effective to get the license upgrade.

Cisco's limits on the devices are pretty arbitrary; they have very little to do with performance constraints on the ASA, and everything to do with having a lot of false barriers in place to force you to go with a more expensive device. I wouldn't expect any performance issues with the 5505, until you're saturating those 100mb interfaces.