CISCO VPN SETUP USING IKEV2 MANUAL

You can configure a different local and different remote pre-shared key. NOTE: For ikev2 you can have asymmetric pre-shared keys. IKEv2 preshared key is configured as 32fjsk0392fg.

The name of the tunnel is the IP address of the peer. вЂ“ Authentication method for the IP вЂ“ in this scenario we will use preshared key for IKEv2. To establish a LAN-to-LAN connection, two attributes must be set: There are two default tunnel groups in the ASA: DefaultRAGroup is the default IPsec remote-access tunnel group and DefaultL2Lgroup is the default IPsec LAN-to-LAN tunnel group. The next step is to define a tunnel group. The same configuration is applied to ASA2.ДЄSA2(config)# crypto ipsec ikev2 ipsec-proposal P1ДЄSA2(config-ipsec-proposal)# protocol esp encryption 3des aes desДЄSA2(config-ipsec-proposal)# protocol esp integrity sha-1 As opposed to IKEv1, where we configured a transform set that combines the encryption and authentication method, with IKEv2 we can configure multiple encryption and authentication types, and multiple integrity algorithms for a single policy.ДЇor this scenario, we will first enter ipsec proposal configuration mode and there set the parameters.ДЄSA1(config)#crypto ipsec ikev2 ipsec-proposal P1ДЄSA1(config-ipsec-proposal)#protocol esp encryption 3des aes desДЄSA1(config-ipsec-proposal)#protocol esp integrity sha-1 In this scenario, we used 3DES encryption with Diffie-Hellman group 2, hash function SHA-1 and an encryption key lifetime of 43200 seconds (12 hours).ДЄSA1(config-ikev2-policy)# encryption 3desДЄSA1(config-ikev2-policy)# lifetime seconds 43200ДЇinally, after the parameters have been set, we will enable IKEv2 on the outside interfaceДЄSA1(config-ikev2-policy)# crypto ikev2 enable outsideДЄSA2(config-ikev2-policy)# encryption 3desДЄSA2(config-ikev2-policy)# lifetime seconds 43200ДЄSA2(config-ikev2-policy)# crypto ikev2 enable outside We will first use the crypto ikev2 policy command to enter IKEv2 policy configuration mode, where we will configure the IKEv2 parameters. Next, we will configure the ISAKMP policies with IKEv2.

CISCO VPN SETUP USING IKEV2 MANUAL

GigabitEthernet1 10.10.10.2 YES manual up up

GigabitEthernet0 192.168.2.2 YES manual up up GigabitEthernet0 192.168.1.2 YES manual up up Interface IP-Address OK? Method Status Protocol INFO: Security level for вЂњinsideвЂќ set to 100 by default.ДЄSA1(config-if)# ip address 192.168.1.2 255.255.255.0ДЄSA1(config-if)# interface GigabitEthernet1 Here we will use 10.10.10.0/24 for the outside network just for making things easier. In real world networks, the outside interfaces will be on a different subnet and use public IP addressing. On ASA1 and ASA2, we will configure the inside interfaces as connected to LAN and the outside interfaces facing the VPN tunnel.

We will start by configuring IP addressing. We will refer to the diagram below for this configuration tutorial. After configuring the VPN tunnel, the private LAN networks in HQ and Branch1 (two geographically dispersed locations) will be able to communicate over the internet and share resources. Behind each security appliance there is a private LAN network.

Cisco vpn setup using ikev2