ASA · BUDDY SDM

Buddy SDM Manager: VPNs from the wizards

Both firewalls already translate their inside to the internet. Use the wizards on the VPN screen to join the two sites, then let alice and carol in from home. Before each Send, read the preview: one form sends the same long list of commands you would otherwise type. The console on the page is the same session, so you can type any step instead.

Cisco ASA-style track · Cisco ASA-style, Cisco router · 7 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

FWA, VPN screen, Site-to-site wizard: tunnel TO-B, IKEv2, local 192.168.1.0/24, remote 192.168.2.0/24, peer 198.51.100.1, key LABKEY.
FWB, the same wizard with the networks swapped: tunnel TO-A, local 192.168.2.0/24, remote 192.168.1.0/24, peer 203.0.113.1, key LABKEY.
PCA reaches PCB (ping 192.168.2.10). The VPN screen on FWA shows the tunnel Up, with packets both ways.
FWA, AnyConnect wizard: connection RA, inside network 192.168.1.0/24, split tunnel on, pool 10.99.0.10 to 10.99.0.50 /24, user alice with password Lab123.
On LAP1: vpn connect 203.0.113.1 user alice password Lab123 group RA, then ping 192.168.1.10. FWA’s VPN screen lists alice.
FWA, WebVPN wizard: portal PORTAL, user carol with password Web123, bookmark Intranet at http://192.168.1.10. On LAP1: webvpn connect 203.0.113.1 user carol password Web123 group PORTAL, then webvpn open http://192.168.1.10.
On FWA’s Logs screen, the Firewall log under VPN shows the tunnel and both logins, and the Command log hides every password and key.

Start this lab

Before you start

A tunnel comes up only when matching traffic arrives, so it shows Not used yet until you ping across it. If it shows Down, its row gives the reason: the first thing the two firewalls disagree on. Both portals use outside, so name the group when you log in.

Concept

A firewall GUI is the CLI with a form in front

A manager screen does not change the firewall by itself. It turns your form into CLI lines, shows them to you, and sends them through the same session as the console. So the screens and the console always agree, and every change is a command you can read, repeat and type yourself. The logs then show both sides: what you told the firewall, and what it did with traffic.

Concept

Site-to-site IPsec VPN

Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.

Concept

Remote access: AnyConnect and a clientless portal

A user logs in to the firewall from outside. With AnyConnect the firewall gives the user an address from a pool and a tunnel, and split tunnelling decides which traffic goes through it. With the clientless portal the user gets no address, only bookmarks that the firewall fetches. Each login lands in a tunnel-group, and a group policy says what that user may do.