Topology/:
Configuration :
ASA0 |
ASA1 |
|
|
crypto ikev1 enable outside |
crypto ikev1 enable outside |
crypto ikev1 policy 1 |
crypto ikev1 policy 1 |
authentication pre-share |
authentication pre-share |
encryption 3des |
encryption 3des |
hash sha |
hash sha |
group 2 |
group 2 |
lifetime 43200 |
lifetime 43200 |
! |
! |
crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac |
crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac |
! |
! |
access-list L2L extended permit ip 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0 |
access-list L2L extended permit ip 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0 |
! |
! |
tunnel-group 172.16.2.2 type ipsec-l2l |
Tunnel-group 172.16.1.2 type ipsec-l2l |
tunnel-group 172.16.2.2 ipsec-attributes |
Tunnel-group 172.16.1.2 ipsec-attributes |
ikev1 pre-shared-key cisco01 |
ikev1 pre-shared-key cisco01 |
! |
! |
crypto map IPSECMAP 1 match address L2L |
crypto map IPSECMAP 1 match address L2L |
crypto map IPSECMAP 1 set connection-type bi-directional |
crypto map IPSECMAP 1 set connection-type bi-directional |
crypto map IPSECMAP 1 set peer 172.16.2.2 |
crypto map IPSECMAP 1 set peer 172.16.1.2 |
crypto map IPSECMAP 1 set ikev1 phase1-mode main |
crypto map IPSECMAP 1 set ikev1 phase1-mode main |
crypto map IPSECMAP 1 set ikev1 transform-set FirstSet |
crypto map IPSECMAP 1 set ikev1 transform-set FirstSet |
crypto map IPSECMAP interface outside |
crypto map IPSECMAP interface outside |
|
|
interface |
interface |
ASA0# sh ip |
ASA1# sh ip |
System IP Addresses: |
System IP Addresses: |
Interface Name IP address Subnet mask Method |
Interface Name IP address Subnet mask Method |
GigabitEthernet0/1 inside 10.0.1.1 255.255.255.0 manual |
GigabitEthernet0/1 inside 10.0.2.1 255.255.255.0 manual |
GigabitEthernet0/2 outside 172.16.0.2 255.255.255.252 manual |
GigabitEthernet0/2 outside 172.16.2.2 255.255.255.252 manual |
Current IP Addresses: |
Current IP Addresses: |
Interface Name IP address Subnet mask Method |
Interface Name IP address Subnet mask Method |
GigabitEthernet0/1 inside 10.0.1.1 255.255.255.0 manual |
GigabitEthernet0/1 inside 10.0.2.1 255.255.255.0 manual |
GigabitEthernet0/2 outside 172.16.0.2 255.255.255.252 manual |
GigabitEthernet0/2 outside 172.16.2.2 255.255.255.252 manual |
Verification:
ping from PC1 to PC1 whicah diffrent subnet
PC1> ping 10.0.2.10
84 bytes from 10.0.2.10 icmp_seq=1 ttl=64 time=8.256 ms
84 bytes from 10.0.2.10 icmp_seq=2 ttl=64 time=11.365 ms
84 bytes from 10.0.2.10 icmp_seq=3 ttl=64 time=7.692 ms
84 bytes from 10.0.2.10 icmp_seq=4 ttl=64 time=10.106 ms
84 bytes from 10.0.2.10 icmp_seq=5 ttl=64 time=12.254 ms
ISAKMP Status :
SA0# sh crypto isakmp sa
IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 172.16.2.2
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
we can see the status currently MM_ACTIVE , mean Phase 1 negotiate successfull
now we verified IPSEC does it build the tunnel up?
ASA0# sh ipsec sa
interface: outside
Crypto map tag: abcmap, seq num: 1, local addr: 172.16.0.2
access-list L2L extended permit ip 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0
local ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.0.2.0/255.255.255.0/0/0)
current_peer: 172.16.2.2
#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 14, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 172.16.0.2/0, remote crypto endpt.: 172.16.2.2/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 1FFEC8F1
current inbound spi : E2BB0BFB
inbound esp sas:
spi: 0xE2BB0BFB (3803909115)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 8192, crypto-map: abcmap
sa timing: remaining key lifetime (kB/sec): (3914998/27797)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00007FFF
outbound esp sas:
spi: 0x1FFEC8F1 (536791281)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 8192, crypto-map: abcmap
sa timing: remaining key lifetime (kB/sec): (3914998/27797)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Yes it does, since we see the show command below :
local crypto endpt.: 172.16.0.2/0, remote crypto endpt.: 172.16.2.2/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 1FFEC8F1
current inbound spi : E2BB0BFB
mean the both WAN already hanshaking and tunneled m SPI ( Security Parameter Index) is unique id does it build to identify both firewall to communicate and identify its traffict as incomming and outgoing. next we would see ehat setting are use to encrypt and Access-list use to map the traffict and IKE version been used.
spi: 0xE2BB0BFB (3803909115)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }