Cisco ASA single isakmp policy for multiple crypto map

Question

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc).

The question is: Do I need to create a separate isakmp policy for each tunnel or do I just define a single policy and it will share the policy with multiple crypto map (phase 2) configurations?

I have the following policy:

crypto ikev1 policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800

Here is the crypto-map for site0

crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map vpn_site0 1 match address ACL_VPN_SITE0
crypto map vpn_site0 1 set pfs
crypto map vpn_site0 1 set peer 35.35.35.1
crypto map vpn_site0 1 set ikev1 transform-set ESP-AES-SHA
crypto map vpn_site0 1 set security-association lifetime seconds 3600
crypto map avpn_site0 interface outside

Question:

1. Do I need to create an isakmp policy for site1 if everything is same? How does isakmp policy map with crypto map?

2. Can I use the same transform crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac for all of the other sites?

Answer 1

1. The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and same crypto ikev1 policy 10 on firewalls at your HeadQuater and Remote Offices, that is enough.

   • And if you try to create an another identical isakmp policy (let us say policy 20), ASA firewall will not accept it and throw out the message ikev1 policy 20 is superceded by identical policy 10.

   • When we have more than one isakmp policy on ASA firewalls, the
     firewall who initiates the ISAKMP negotiation will send all of its
     policies to the other end to find a match. The remote end starts
     checking all of the peer's policies against each of its configured
     policies in priority order (highest priority first - lowest policy
     number).

2. For your second question: yes, one and same ikev1 transform-set (IPSec policy) across your VPN tunnel configurations should not be a problem.

3. I found a problem with your crypto map configuration. crypto map vpn_site0 and crypto map avpn_site0 are not match

   You can apply ONLY ONE crypto-map per interface, here is outside interface. If you have multiple S2S VPN tunnels, you have to use the same crypto-map with different priority numbers. Therefore, you should name your crypto-map meaningful and use this for all of your tunnels terminated on that outside interface.

I would propose the crypto-map name is crypto map vpn_sites with below configuration:

crypto map vpn_sites 1 match address ACL_VPN_SITE0
...
crypto map vpn_sites 1 set security-association lifetime seconds 3600
crypto map vpn_sites 2 match address ACL_VPN_SITE1
...
crypto map vpn_sites 2 set security-association lifetime seconds 3600
crypto map vpn_sites 3 match address ACL_VPN_SITE2
...
crypto map vpn_sites 3 set security-association lifetime seconds 3600
...
crypto map vpn_sites interface outside