7 Easy steps to Configure site-to-site IPsec VPN using IKEV1 on Cisco ASA – Zindagi technologies (2024)

What is IPsec?

IPsec VPN (internet protocol security) is a protocol or method to encrypt the traffic between two branches or sites. It is used to secure the traffic over an untrusted network, and we can understand by its name that it provides security of INSIDE network IPs.

It provides Confidentiality, Integrity, and Authentication over the network.

What is VPN?

It stands for Virtual Private Network. it is used to connect two private networks of different locations or sites over in a public network. It implements by IPsec for connecting two sites.

What is IKE (IKEV1 and IKEV2)?

It stands for Internet Key Exchange. IKE is a protocol that is used to set up the keys for negotiating the IPsec VPN. IPsec uses IKE for creating a virtual tunnel between two sites

IKE has 2 versions. We will use IKEV1 for IPSEC VPN.

The Process to Configure site-to-site IPsec VPN

We have two branches (Branch 1 and Branch 2) and we have to protect traffic over the ISP of branches.

Configuration on Branch1 ASA (firewall):-

Step 1:- Create Crypto Ikev1 Policy

• In this step, we will configure the HAGLE information.
• Hash, authentication, group, encryption must be the same on both sides.

ASA1(config)# crypto ikev1 policy 10

ASA1(config-ikev1-policy)# hash sha

ASA1(config-ikev1-policy)# authentication pre-share

ASA1(config-ikev1-policy)# group 2

ASA1(config-ikev1-policy)# lifetime 86400

ASA1(config-ikev1-policy)# encryption 3des

Step 2:- Create A Tunnel-Group To Specify A Pre-Shared Key For Peer.

• The pre-shared key should be the same on both sides
• To create a tunnel group, there are two steps :
• Create tunnel-group

ASA1(config)# tunnel-group 102.1.1.10 type IPsec-l2l

• Specify pre-shared key in tunnel-group

ASA1(config)# tunnel-group 102.1.1.10 IPsec-attributes

ASA1(config-tunnel-ipsec)# ikev1 pre-shared-key cisco

Step 3:- Create IPsec Transform-Set

ASA1(config)# crypto ipsec ikev1 transform-set TSET esp-3des esp-sha-hmac

Step 4:- Define Interesting Traffic ACCESS-LIST

• Traffic which we want to secure via VPN that is Interesting traffic (192.168.1.1 and 192.168.2.1)

ASA1(config)# access-list VPN-ACL permit Ip host 192.168.1.1 host 192.168.2.1

Step 5:- Create A Crypto Map

• It is used to create a particular list of VPN ACCESS-LIST, TRANSFORM-SET, and PEER IP.

ASA1(config)# crypto map CMAP 10 set peer 102.1.1.10

ASA1(config)# crypto map CMAP 10 set ikev1 transform-set TSET

ASA1(config)# crypto map CMAP 10 match address VPN-ACL

Step 6:- Enable IKEV1 And Apply Crypto Map On The Interface

ASA1(config)# crypto map CMAP interface outside

ASA1(config)# crypto ikev1 enable outside

Step 7:- Apply Same Steps For Branch 2 ASA Device

• Ip addresses will not same. Make sure to use the correct IP addresses for Branch2 ASA.

The complete configuration of Branch2 ASA is here.