Showing posts with label site 2 site. Show all posts
Showing posts with label site 2 site. Show all posts

Site to Site vpn config example ASA 8.4 or newer.

Just copy paste.
Mirror this config on the other side.

crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
!
object network OBJ-SiteA
subnet 10.0.0.0 255.255.255.0
object network OBJ-SiteB
subnet 10.0.3.0 255.255.255.0
!
access-list VPN-TRAFIC extended permit ip object OBJ-SiteA object OBJ-SiteB
nat (inside,outside) source static OBJ-SiteA OBJ-SiteA destination static OBJ-SiteB OBJ-SiteB no-proxy-arp route-lookup
!
tunnel-group 200.200.200.200 type ipsec-l2l
tunnel-group 200.200.200.200 ipsec-attributes
pre-shared-key cisco123
isakmp keepalive threshold 10 retry 2 (Optional)
!
crypto ipsec ikev1 transform-set VPN-TRANSFORM esp-3des esp-md5-hmac
!
crypto map CRYPTO-MAP 1 match address VPN-TRAFIC
crypto map CRYPTO-MAP 1 set pfs group2 (Optional)
crypto map CRYPTO-MAP 1 set peer 200.200.200.200
crypto map CRYPTO-MAP 1 set ikev1 transform-set VPN-TRANSFORM
crypto map CRYPTO-MAP interface outside



Related Article :

http://www.petenetlive.com/KB/Article/0000050.htm

Cisco site to site VPN Configuration Cheatsheet

Cisco
VPN

Please find enclosed the cisco site to site VPN configuration in a nutshell. These basic commands would help in configuring a site to site VPN setup. This can also assist in troubleshooting vpn issues.

VPN Configuration Steps:

sysopt connection permit-ipsec
Phase I
isakmp enable outside
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
iaskmp policy 10 authentication pre-share or rsa-sig
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

isakmp key abc123 address 192.168.1.2 netmask 255.255.255.255
isakmp identity address

show isakmp policy
show isakmp

Phase 2
access-list 101 permit ip 10.0.1.0 255.255.255.0 172.16.1.0 255.255.255.0
nat (inside) 0 access-list 101
crypto ipsec transform-set customer1 esp-des esp-sha-hmac

crypto map PIX1MAP 10 ipsec-isakmp
crypto map PIX1MAP 10 match address 101
crypto map PIX1MAP 10 set peer 192.168.2.1
crypto map PIX1MAP 10 set transform-set customer1
crypto map PIX1MAP 10 set security-association lifetime seconds 28800
crypto map PIX1MAP 10 set pfs group1
crypto map PIX1MAP interface outside

crypto dynamic-map dynamic-map-name dynamic-seq-num

show crypto map
show isakmp
show isakmp policy
show access-list
show crypto ipsec transform-set
show crypto map

clear crypto ipsec sa
clear crypto isakmp sa
debug crypto ipsec
debug crypto isakmp

Steps to configure a simple site-to-site IKE/IPSec connection with examples:

ciscoasa(config)# vpnsetup site-to-site steps

Steps to configure a simple site-to-site IKE/IPSec connection with examples:

1. Configure Interfaces

interface GigabitEthernet0/0
ip address 10.10.4.200 255.255.255.0
nameif outside
no shutdown

interface GigabitEthernet0/1
ip address 192.168.0.20 255.255.255.0
nameif inside
no shutdown

2. Configure ISAKMP policy

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha

3. Configure transform-set

crypto ipsec transform-set myset esp-3des esp-sha-hmac

4. Configure ACL

access-list L2LAccessList extended permit ip 192.168.0.0 255.255.255.0 192.168.50.0 255.255.255.0

5. Configure Tunnel group

tunnel-group 10.20.20.1 type ipsec-l2l
tunnel-group 10.20.20.1 ipsec-attributes
pre-shared-key P@rtn3rNetw0rk

6. Configure crypto map and attach to interface

crypto map mymap 10 match address L2LAccessList
crypto map mymap 10 set peer 10.10.4.108
crypto map mymap 10 set transform-set myset
crypto map mymap 10 set reverse-route
crypto map mymap interface outside

7. Enable isakmp on interface

crypto isakmp enable outside

Configure a Site 2 Site VPN on a ASA

In this article I will be showing you how to configure a Site 2 Site VPN on a ASA.
Also included within this example is a group-policy (named "Example_Policy") which we restrict access between the 2 endpoints to just tcp/80 traffic.

Please Note : This example presumes that you have already created the object groups for Local_LAN and Remote_LAN.
Access-Lists

Add the ACLs which we will need to NAT, the encryption domain and the group policy.

        access-list Example_Policy_ACL extended permit tcp object-group Local_LAN object-group Remote_LAN eq 80
        access-list Example_Policy_ACL extended deny ip any any
        access-list Example_VPN_ACL permit ip object-group Local_LAN object-group Remote_LAN

Group Policy
Create your group policy which will restrict traffic between hosts within your encryption domain.
        group-policy Example_Policy internal
        group-policy Example_Policy attributes
              vpn-filter value Example_Policy_ACL
              default-group-policy Example_Policy

NAT
Add your No NAT for traffic within the encryption domain
        nat (outside) 0 access-list Example_VPN_ACL
Tunnel Group
Create your tunnel group which will include your pre-shared key.
       tunnel-group [Peer IP] type ipsec-l2l
       tunnel-group [Peer IP] general-attributes
            default-group-policy Example_Policy
       tunnel-group [Peer IP] ipsec-attributes
            pre-shared-key [pre-share key] 

Phase 1
        crypto isakmp identity address
        crypto isakmp enable outside

        crypto isakmp policy 10
           authentication pre-share
           encryption [?]
           hash [?]
           group [?]
           lifetime [secs]

Phase 2
        crypto ipsec transform-set [transform set name] esp-3des esp-sha-hmac
        crypto map outside interface outside
        crypto map outside set transform-set [transform set]
        crypto map outside 20 match address Example_VPN_ACL
        crypto map outside 20 set peer [Peer IP]
        crypto map outside 20 set security-association lifetime seconds [secs]