![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241804.webp)
1-8
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring LAN-to-LAN IPsec VPNs
Defining a Tunnel Group
The ACLs that you configure for this LAN-to-LAN VPN control connections are based on the source
and translated destination IP addresses. Configure ACLs that mirror each other on both sides of the
connection.
An ACL for VPN traffic uses the translated address.
To configure an ACL, perform the following steps:
Step 1
Enter the
access-list extended
command. The following example configures an ACL named l2l_list that
lets traffic from IP addresses in the 192.168.0.0 network travel to the 150.150.0.0 network. The syntax
is
access-list
listname
extended permit ip
source-ipaddress source-netmask destination-ipaddress
destination-netmask.
hostname(config)#
access-list l2l_list extended permit ip 192.168.0.0 255.255.0.0
150.150.0.0 255.255.0.0
hostname(config)#
Step 2
Configure an ACL for the ASA on the other side of the connection that mirrors the ACL. In the following
example, the prompt for the peer is hostname2.
hostname2(config)#
access-list l2l_list extended permit ip 150.150.0.0 255.255.0.0
192.168.0.0 255.255.0.0
hostname(config)#
Defining a Tunnel Group
A tunnel group is a set of records that contain tunnel connection policies. You configure a tunnel group
to identify AAA servers, specify connection parameters, and define a default group policy. The ASA
stores tunnel groups internally.
There are two default tunnel groups in the ASA: DefaultRAGroup, which is the default IPsec
remote-access tunnel group, and DefaultL2Lgroup, which is the default IPsec LAN-to-LAN tunnel
group. You can modify them but not delete them.
The main difference between IKE versions 1 and 2 lies in terms of the authentication method they allow.
IKEv1 allows only one type of authentication at both VPN ends (that is, either pre-shared key or
certificate). However, IKEv2 allows assymetric authentication methods to be configured (that is,
pre-shared key authentication for the originator but certificate authentication for the responder) using
separate local and remote authentication CLIs. Therefore, with IKEv2 you have assymmetric
authentication where one side authenticates with one credential whereas the other side uses another
credential (either pre-shared key or certificate).
You can also create one or more new tunnel groups to suit your environment. The ASA uses these groups
to configure default tunnel parameters for remote access and LAN-to-LAN tunnel groups when there is
no specific tunnel group identified during tunnel negotiation.
To establish a basic LAN-to-LAN connection, you must set two attributes for a tunnel group:
•
Set the connection type to IPsec LAN-to-LAN.
•
Configure an authentication method for the IP, in the following example, preshared key for IKEv1
and IKEv2.
Note
To use VPNs, including tunnel groups, the ASA must be in single-routed mode. The commands to
configure tunnel-group parameters do not appear in any other mode.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......