Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1798 / 2164

1-2
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring LAN-to-LAN IPsec VPNs
Summary of the Configuration
Summary of the Configuration
This section provides a summary of the example LAN-to-LAN configuration this chapter describes.
Later sections provide step-by-step instructions.
hostname(config)# interface ethernet0/0
hostname(config-if)# ip address 10.10.4.100 255.255.0.0
hostname(config-if)# nameif outside
hostname(config-if)# no shutdown
hostname(config)# crypto ikev1 policy 1
hostname (config-ikev1-policy)# authentication pre-share
hostname (config-ikev1-policy)# encryption 3des
hostname (config-ikev1-policy)# hash sha
hostname (config-ikev1-policy)# group 2
hostname (config-ikev1-policy)# lifetime 43200
hostname(config)# crypto ikev1 enable outside
hostname(config)# crypto ikev2 policy 1
hostname(config-ikev2-policy)# encryption 3des
hostname(config-ikev2-policy)# group 2
hostname(config-ikev12-policy)# prf sha
hostname(config-ikev2-policy)# lifetime 43200
hostname(config)# crypto ikev2 enable outside
hostname(config)# crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac
hostname(config)# crypto ipsec ikev2 ipsec-proposal secure
hostname(config-ipsec-proposal)# protocol esp encryption 3des aes des
hostname(config-ipsec-proposal)# protocol esp integrity sha-1
hostname(config)# access-list l2l_list extended permit ip 192.168.0.0 255.255.0.0
150.150.0.0 255.255.0.0
hostname(config)# tunnel-group 10.10.4.108 type ipsec-l2l
hostname(config)# tunnel-group 10.10.4.108 ipsec-attributes
hostname(config -tunnel- ipsec)# ikev1 pre-shared-key 44kkaol59636jnfx
hostname(config)# crypto map abcmap 1 match address l2l_list
hostname(config)# crypto map abcmap 1 set peer 10.10.4.108
hostname(config)# crypto map abcmap 1 set ikev1 transform-set FirstSet
hostname(config)# crypto map abcmap 1 set ikev2 ipsec-proposal secure
hostname(config)# crypto map abcmap interface outside
hostname(config)# write memory
Configuring Site-to-Site VPN in Multi-Context Mode
Follow these steps to allow site-to-site support in multi-mode for all platforms except the 5505. By
performing these steps, you can see how resource allocation breaks down.
Step 1
To configure the VPN in multi-mode, configure a resource class and choose VPN licenses as part of the
allowed resource. The
“Configuring a Class for Resource Management” section on page 1-17 provides
these configuration steps. The following is an example configuration:
class ctx1
limit-resource VPN Burst Other 100
limit-resource VPN Other 1000
Step 2
Configure a context and make it a member of the configured class that allows VPN licenses. The
“Configuring a Security Context” section on page 1-20 provides these configuration steps. The
following is an example configuration:
context context1
member ctx1
allocate-interface GigabitEthernet3/0.2
allocate-interface GigabitEthernet3/1.2
allocate-interface Management0/0