Scribd
Upload
23 views

ASA IPSec VPN

Uploaded by

pravin
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
23 views

ASA IPSec VPN

Uploaded by

pravin
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

Configuring Site-to-Site IKEv1 IPSec VPN

STEP 1: Configure Interesting Traffic


ASA 1:
ASA-1(config)# object network obj-local
ASA-1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA-1(config-network-object)# exit
ASA-1(config)# object network obj-remote
ASA-1(config-network-object)# subnet 192.168.2.0 255.255.255.0
ASA-1(config-network-object)# exit
ASA-1(config)# nat (inside,outside) 1 source static obj-local obj-local destination
static objremote
obj-remote

STEP 2: Configure Phase 1 (IKEv1 or ISAKMP)


ASA 1:
ASA-1(config)# crypto ikev1 policy 10
ASA-1(config-ikev1-policy)# authentication pre-share Use pre-shared key for auth
ASA-1(config-ikev1-policy)# encryption aes  Use AES 128 bit encryption
ASA-1(config-ikev1-policy)# hash sha  Use SHA for hashing
ASA-1(config-ikev1-policy)# group 2  Diffie-Hellman Group 2
ASA-1(config-ikev1-policy)# lifetime 3600  Lifetime of SA is 3600 seconds
ASA-1(config-ikev1-policy)# exit
ASA-1(config)# crypto ikev1 enable outside  Enable the policy on "outside"
interface
ASA-1(config)# crypto isakmp identity address
ASA-1(config)# tunnel-group 200.200.200.1 type ipsec-l2l  Configure a tunnel with
peer IP
200.200.200.1 which will be of type Lan-to-Lan
ASA-1(config)# tunnel-group 200.200.200.1 ipsec-attributes
ASA-1(config-tunnel-ipsec)# ikev1 pre-shared-key somestrongkey  pre-shared key

STEP 3: Configure Phase 2 (IPSEc)


ASA-1(config)# crypto ipsec ikev1 transform-set ASA1TS esp-aes-192 esp-sha-hmac
ASA-1(config)# crypto map ASA1VPN 10 match address LAN1-to-LAN2
ASA-1(config)# crypto map ASA1VPN 10 set peer 200.200.200.1
ASA-1(config)# crypto map ASA1VPN 10 set ikev1 transform-set ASA1TS
ASA-1(config)# crypto map ASA1VPN 10 set security-association lifetime seconds 3600
ASA-1(config)# crypto map ASA1VPN interface outside

STEP 4: Verify Encrypted Data Transfer


ASA-1# show crypto isakmp sa -------- Verify that tunnel is established
ASA-1# show crypto ipsec sa -------- Verify that data is bi-directionally
encrypted

You might also like