ASA IKEv1 IPsec site-to-site VPN cli

ASA IKEv1 IPsec site-to-site VPN cli

Configure Site B for ASA Versions 8.4 and Later

in ASA Versions 8.4 and later, support for both IKEv1 and Internet Key Exchange version 2 (IKEv2) was introduced

Phase 1 (IKEv1)

1. Enter this command into the CLI in order to enable IKEv1 on the outside interface:
   

   crypto ikev1 enable outside

2. Create an IKEv1 policy that defines the algorithms/methods to be used for hashing, authentication, Diffie-Hellman group, lifetime, and encryption:
   

   crypto ikev1 policy 1
   !The 1 in the above command refers to the Policy suite priority
    (1 highest, 65535 lowest)
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400

3. Create a tunnel group under the IPsec attributes and configure the peer IP address and the tunnel pre-shared key:
   

   tunnel-group 192.168.1.1 type ipsec-l2l
   tunnel-group 192.168.1.1 ipsec-attributes
    ikev1 pre-shared-key cisco
    ! Note the IKEv1 keyword at the beginning of the pre-shared-key command.

Phase 2 (IPsec)

1. Create an access list that defines the traffic to be encrypted and tunneled. In this example, the traffic of interest is the traffic from the tunnel that is sourced from the 10.2.2.0 subnet to the 10.1.1.0. It can contain multiple entries if there are multiple subnets involved between the sites.
   
   In Versions 8.4 and later, objects or object groups can be created that serve as containers for the networks, subnets, host IP addresses, or multiple objects. Create two objects that have the local and remote subnets and use them for both the crypto Access Control List (ACL) and the NAT statements.
   

   object network 10.2.2.0_24
    subnet 10.2.2.0 255.255.255.0
   object network 10.1.1.0_24
    subnet 10.1.1.0 255.255.255.0
   
   access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24

2. Configure the Transform Set (TS), which must involve the keyword IKEv1. An identical TS must be created on the remote end as well.
   

   crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac

3. Configure the crypto map, which contains these components:
   
   
   • The peer IP address
   • The defined access list that contains the traffic of interest
   • The TS
   • An optional Perfect Forward Secrecy (PFS) setting, which creates a new pair of Diffie-Hellman keys that are used in order to protect the data (both sides must be PFS-enabled before Phase 2 comes up)
4. Apply the crypto map on the outside interface:
   

   crypto map outside_map 20 match address 100
   crypto map outside_map 20 set peer 192.168.1.1
   crypto map outside_map 20 set ikev1 transform-set myset
   crypto map outside_map 20 set pfs
   crypto map outside_map interface outside

NAT Exemption

nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static 10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

object-group  network 10.x.x.x_SOURCE
 network-object  10.4.4.0 255.255.255.0
 network-object  10.2.2.0 255.255.255.0

object network 10.x.x.x_DESTINATION
 network-object  10.3.3.0 255.255.255.0
 network-object  10.1.1.0 255.255.255.0

nat (inside,outside) 1 source static 10.x.x.x_SOURCE 10.x.x.x_SOURCE destination
 static 10.x.x.x_DESTINATION  10.x.x.x_DESTINATION no-proxy-arp route-lookup