2

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc).

The question is: Do I need to create a separate isakmp policy for each tunnel or do I just define a single policy and it will share the policy with multiple crypto map (phase 2) configurations?

I have the following policy:

crypto ikev1 policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800

Here is the crypto-map for site0

crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map vpn_site0 1 match address ACL_VPN_SITE0
crypto map vpn_site0 1 set pfs
crypto map vpn_site0 1 set peer 35.35.35.1
crypto map vpn_site0 1 set ikev1 transform-set ESP-AES-SHA
crypto map vpn_site0 1 set security-association lifetime seconds 3600
crypto map avpn_site0 interface outside

Question:

  1. Do I need to create an isakmp policy for site1 if everything is same? How does isakmp policy map with crypto map?

  2. Can I use the same transform crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac for all of the other sites?

  • Am I correct to assume that you have multiple LANs on each side that you would like to connect using ipsec? If yes, may I suggest to configure GRE tunnel between the sites, and add a routes to LAN networks of the other side via the tunnel. Then you could to encrypt only the tunnel traffic using access list selector for GRE traffic, example: access-list 100 permit gre any any. This way you using one crypto map, but encrypting several networks. – timgold Sep 12 '17 at 5:42
  • We are going to use IPsec tunnel, and yes every site has own LAN subnet. Just like star network topology. – Satish Sep 12 '17 at 13:06
  • Not tested, but I think, you will have to create different crypto map for each site, but you could use the same transform-set and isakmp policy for each crypto map. Also , I didn't see "mode tunnel" under your transform-set. This suppose to create ipsec tunnel of type ESP tunnel (allows encryption) and not AH tunnel. Also reminder for my previous comment: reccomend to use GRE tunnel. Just try and see what works for you, and tell us what configuration worked for you. – timgold Sep 13 '17 at 5:26
4
  1. The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and same crypto ikev1 policy 10 on firewalls at your HeadQuater and Remote Offices, that is enough.

    • And if you try to create an another identical isakmp policy (let us say policy 20), ASA firewall will not accept it and throw out the message ikev1 policy 20 is superceded by identical policy 10.

    • When we have more than one isakmp policy on ASA firewalls, the
      firewall who initiates the ISAKMP negotiation will send all of its
      policies to the other end to find a match. The remote end starts
      checking all of the peer's policies against each of its configured
      policies in priority order (highest priority first - lowest policy
      number).

  2. For your second question: yes, one and same ikev1 transform-set (IPSec policy) across your VPN tunnel configurations should not be a problem.

  3. I found a problem with your crypto map configuration. crypto map vpn_site0 and crypto map avpn_site0 are not match

    You can apply ONLY ONE crypto-map per interface, here is outside interface. If you have multiple S2S VPN tunnels, you have to use the same crypto-map with different priority numbers. Therefore, you should name your crypto-map meaningful and use this for all of your tunnels terminated on that outside interface.

I would propose the crypto-map name is crypto map vpn_sites with below configuration:

crypto map vpn_sites 1 match address ACL_VPN_SITE0
...
crypto map vpn_sites 1 set security-association lifetime seconds 3600
crypto map vpn_sites 2 match address ACL_VPN_SITE1
...
crypto map vpn_sites 2 set security-association lifetime seconds 3600
crypto map vpn_sites 3 match address ACL_VPN_SITE2
...
crypto map vpn_sites 3 set security-association lifetime seconds 3600
...
crypto map vpn_sites interface outside

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.