Re: device Routing over IPSec VPN

root> show configuration security policies 
from-zone trust to-zone untrust {
    inactive: policy vpn_Tacoma_Seattle {
        match {
            source-address Tacoma;
            destination-address Seattle;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn Seattle-Tacoma_P2P_Tunnel;
                }
            }
        }
    }
    policy trust-to-untrust {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone trust to-zone p2p_VPNs {
    policy Seattle_VPN_out {
        match {
            source-address Tacoma;
            destination-address Seattle;
            application any;
        }
        then {
            permit;
        }                               
    }
}
from-zone p2p_VPNs to-zone trust {
    policy Seattle_VPN_in {
        match {
            source-address Seattle;
            destination-address Tacoma;
            application any;
        }
        then {
            permit;
        }
    }
}

root> show configuration security policies 
from-zone trust to-zone untrust {
    inactive: policy vpn_Tacoma_Seattle {
        match {
            source-address Tacoma;
            destination-address Seattle;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn Seattle-Tacoma_P2P_Tunnel;
                }
            }
        }
    }
    policy trust-to-untrust {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone trust to-zone p2p_VPNs {
    policy Seattle_VPN_out {
        match {
            source-address Tacoma;
            destination-address Seattle;
            application any;
        }
        then {
            permit;
        }                               
    }
}
from-zone p2p_VPNs to-zone trust {
    policy Seattle_VPN_in {
        match {
            source-address Seattle;
            destination-address Tacoma;
            application any;
        }
        then {
            permit;
        }
    }
}

root> show configuration security ipsec  
proposal Seattle-asa-ipsec {
    protocol esp;
    authentication-algorithm hmac-sha1-96;
    encryption-algorithm 3des-cbc;
    lifetime-seconds 28800;
}
policy Seattle-asa-phase2 {
    perfect-forward-secrecy {
        keys group2;
    }
    proposals Seattle-asa-ipsec;
}
vpn Seattle-Tacoma_P2P_Tunnel {
    bind-interface st0.0;
    ike {
        gateway Seattle;
        inactive: proxy-identity {
            local 172.27.2.0/24;
            remote 172.27.1.0/24;
            service any;
        }
        ipsec-policy Seattle-asa-phase2;
    }
    traffic-selector TS_1 {
        local-ip 172.27.2.0/24;
        remote-ip 172.27.1.0/24;
    }
    traffic-selector TS_2 {
        local-ip 172.27.20.0/24;
        remote-ip 172.27.1.0/24;
    }
    traffic-selector TS_3 {
        local-ip 172.27.2.0/24;
        remote-ip 192.168.27.0/24;
    }
    traffic-selector TS_4 {
        local-ip 172.27.20.0/24;
        remote-ip 192.168.27.0/24;
    }
    traffic-selector TS_5 {
        local-ip 172.27.2.0/24;
        remote-ip 10.27.1.0/24;
    }
    traffic-selector TS_6 {
        local-ip 172.27.20.0/24;
        remote-ip 10.27.1.0/24;
    }
    establish-tunnels immediately;
}