ASA · SITE-TO-SITE VPN

ASA-style: a site-to-site VPN with IKEv1

Two sites, each behind its own firewall, both translating their inside to the internet. Join 192.168.1.0/24 and 192.168.2.0/24 with an IPsec tunnel over the provider R1, using IKEv1 and a pre-shared key. The provider knows nothing about either LAN, so the only way between them is the tunnel.

Cisco ASA-style track · Cisco ASA-style, Cisco router · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

NAT exemption on both firewalls: objects LOCAL and REMOTE, and a manual rule source static LOCAL LOCAL destination static REMOTE REMOTE, so VPN traffic is not translated.
The crypto ACL VPN on each firewall: permit ip from object LOCAL to object REMOTE.
IKEv1 on both: policy 10 (authentication pre-share, encryption aes-256, hash sha, group 14), crypto ikev1 enable outside, and transform set TS (esp-aes-256 esp-sha-hmac).
Crypto map CMAP 10 on each: match address VPN, set peer to the other firewall, set ikev1 transform-set TS, applied to outside. A tunnel-group for the peer, type ipsec-l2l, with the key IKE1KEY.
PCA reaches PCB, and show crypto ikev1 sa and show crypto ipsec sa show the tunnel with packets both ways.

Start this lab

Before you start

Build both ends the same way, with the addresses swapped. NAT comes before encryption: without the exemption, PCA’s address is translated and no longer matches the crypto ACL, so the packet goes to the internet instead of the tunnel. If a ping fails, its reason names the first thing the two firewalls disagree on.

Concept

Site-to-site IPsec VPN

Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.