ASA · SITE-TO-SITE VPN

ASA-style: a site-to-site VPN with IKEv2

Two sites, each behind its own firewall, both translating their inside to the internet. Join 192.168.1.0/24 and 192.168.2.0/24 with an IPsec tunnel over the provider R1, using IKEv2 and a pre-shared key. The provider knows nothing about either LAN, so the only way between them is the tunnel.

Cisco ASA-style track · Cisco ASA-style, Cisco router · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

NAT exemption on both firewalls: objects LOCAL and REMOTE, and a manual rule source static LOCAL LOCAL destination static REMOTE REMOTE, so VPN traffic is not translated.
The crypto ACL VPN on each firewall: permit ip from object LOCAL to object REMOTE.
IKEv2 on both: policy 10 (encryption aes-256, integrity sha256, group 14, prf sha256), crypto ikev2 enable outside, and IPsec proposal PROP (esp aes-256, esp sha-256).
Crypto map CMAP 10 on each: match address VPN, set peer to the other firewall, set ikev2 ipsec-proposal PROP, applied to outside. A tunnel-group for the peer, type ipsec-l2l, with the key IKE2KEY.
PCA reaches PCB, and show crypto ikev2 sa and show crypto ipsec sa show the tunnel with packets both ways.

Start this lab

Before you start

Build both ends the same way, with the addresses swapped. NAT comes before encryption: without the exemption, PCA’s address is translated and no longer matches the crypto ACL, so the packet goes to the internet instead of the tunnel. If a ping fails, its reason names the first thing the two firewalls disagree on.

Concept

Site-to-site IPsec VPN

Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.