ASA IKEv1 Dynamic-to-Static S2S VPN

-

 


Remote 1 uses main mode with default tunnel-group, Remote 2 uses aggressive mode with named tunnel-group.


Central ASA
! Create objects
object network obj-10.1.2.0_24
 subnet 10.1.2.0 255.255.255.0
object network obj-10.1.1.0_24
 subnet 10.1.1.0 255.255.255.0
object network obj-10.1.3.0_24
 subnet 10.1.3.0 255.255.255.0

!Create NAT exemption for L2L VPN and dynamic NAT for Internet access.
nat (inside,outside) source static obj-10.1.2.0_24 obj-10.1.2.0_24 destination static obj-10.1.1.0_24 obj-10.1.1.0_24 no-proxy-arp route-lookup
nat (inside,outside) source static obj-10.1.2.0_24 obj-10.1.2.0_24 destination static obj-10.1.3.0_24 obj-10.1.3.0_24 no-proxy-arp route-lookup
!
object network obj-10.1.2.0_24
 nat (inside,outside) dynamic interface

! Define IKEv1 policy
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2

! Enable ikev1 on outside interface 
crypto ikev1 enable outside

! Define transform-set
crypto ipsec ikev1 transform-set T-SET esp-aes-256 esp-sha-hmac

! Configure dynamic map with:
  • Requires transform-set
  • (Optional) Enable Reverse Route Injection (RRI), which allows ASA to learn routing information for connected clients, dynamic keyword will delete the learned static route when VPN is down.
crypto dynamic-map outside_dyn_map 1 set ikev1 transform-set T-SET
crypto dynamic-map outside_dyn_map 1 set reverse-route (dynamic)

! Bind the dynamic map to crypto map
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

! Enable crypto map  on outside interface 
crypto map outside_map interface outside

! Solution1:Remote1 has dynamic public IP, will use default tunnel-group since can’t specify tunnel-group with IP address.
tunnel-group DefaultL2LGroup ipsec-attributes
 ikev1 pre-shared-key cisco123

! Solution2:Remote2 has dynamic public IP, but it specified isakmp identity, create tunnel-group to match Remote2 identity
tunnel-group SPOKE1 type ipsec-l2l
tunnel-group SPOKE1 ipsec-attributes
 ikev1 pre-shared-key cisco123

Remote 1 ASA

! Create objects:
object network obj-10.1.1.0_24
 subnet 10.1.1.0 255.255.255.0
object network obj-10.1.2.0_24
 subnet 10.1.2.0 255.255.255.0

!Create NAT exemption for L2L VPN and dynamic NAT for Internet access.
nat (inside,outside) source static obj-10.1.1.0_24 obj-10.1.1.0_24 destination static obj-10.1.2.0_24 obj-10.1.2.0_24 no-proxy-arp route-lookup
!
object network obj-10.1.1.0_24
 nat (inside,outside) dynamic interface

! Define ikev1 policy:
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2

! Enable ikev1 on outside interface
crypto ikev1 enable outside

! Define transform-set
crypto ipsec ikev1 transform-set T-SET esp-aes-256 esp-sha-hmac

! Create VPN-ACL
access-list outside_cryptomap extended permit ip object obj-10.1.1.0_24 object obj-10.1.2.0_24

! Configure crypto map
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 172.16.2.1
crypto map outside_map 1 set ikev1 transform-set T-SET

! Enable crypto map  on outside interface
crypto map outside_map interface outside

!Creat tunnel-group
tunnel-group 172.16.2.1 type ipsec-l2l
tunnel-group 172.16.2.1 ipsec-attributes
 ikev1 pre-shared-key cisco123


Remote 2 ASA

! Create objects:
object network obj-10.1.3.0_24
 subnet 10.1.3.0 255.255.255.0
object network obj-10.1.2.0_24
 subnet 10.1.2.0 255.255.255.0

!Create NAT exemption for L2L VPN and dynamic NAT for Internet access.
nat (inside,outside) source static obj-10.1.3.0_24 obj-10.1.3.0_24 destination static obj-10.1.2.0_24 obj-10.1.2.0_24  no-proxy-arp route-lookup
!
object network obj-10.1.3.0_24
 nat (inside,outside) dynamic interface

! Define ikev1 policy:
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2

! Enable ikev1 on outside interface
crypto ikev1 enable outside

! Define transform-set
crypto ipsec ikev1 transform-set T-SET esp-aes-256 esp-sha-hmac

! Create VPN-ACL
access-list VPN-ACL extended permit ip object obj-10.1.3.0_24 object obj-10.1.2.0_24

! Configure static crypto map, aggressive mode let HUB ASA use non-default tunnel-group.
! In aggressive Mode, the initiator and responder ID pass in the clear. 
crypto map MyMap 10 match address VPN-ACL
crypto map MyMap 10 set peer 172.16.2.1
crypto map MyMap 10 set ikev1 phase1-mode aggressive
crypto map MyMap 10 set ikev1 transform-set T-SET

! Set ike identity so it will use specified tunnel-group instead of default tunnel-group
crypto isakmp identity key-id SPOKE1

! Enable crypto map on outside interface
crypto map MyMap  interface outside

!Creat tunnel-group
tunnel-group 172.16.2.1 type ipsec-l2l
tunnel-group 172.16.2.1 ipsec-attributes
 ikev1 pre-shared-key cisco123


=============================
Reference:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119007-config-asa9x-ike-ipsec-00.html

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more