4

If I have a crypto map with a line as follows:

crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8

Can I change that simply by typing the following in conf t:

# crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3

Or do additional steps need to be taken beforehand? What about afterwards?? Running a Cisco ASA 5510, software version 8.3(2)

6

Can I change that simply by typing the following in conf t:

In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for Outside_map's sequence number 10. The peer list can hold up to ten addresses.

ASA3(config)# show run crypto | i peer
crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 

ASA3(config)# crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3
ASA3(config)# show run crypto | i peer
crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 0.9.8.7 6.5.4.3

You'll need to negate the entries for 1.2.3.4 5.6.7.8 if you intend to simply swap the two for two.

..do additional steps need to be taken beforehand? What about afterwards?...

Ensuring the new VPN peer(s) have compatible IKE phase I and phase II configurations, reflexive ACLs, tunnel-group configuration for the new peer addresses and a roll-back plan may help with making this change.

ASA 8.3 L2L VPN Configuration Reference

Example Output:

The following example shows changing an ASA's remote peer IP address from 2.2.2.2 to 4.4.4.4.

asa1(config)# show run crypto 
crypto map Outside_map 1 set peer 2.2.2.2

asa1(config)# tunnel-group 4.4.4.4 type ipsec-l2l
asa1(config)# tunnel-group 4.4.4.4 general-attributes
asa1(config-tunnel-general)# tunnel-group 4.4.4.4 ipsec-attributes
asa1(config-tunnel-ipsec)#  ikev1 pre-shared-key C1sc0123

asa1(config)# show crypto isa sa

1   IKE Peer: 2.2.2.2
    Type    : L2L             Role    : initiator 
    Rekey   : no              State   : MM_ACTIVE 

asa1(config)# show crypto ipsec sa
interface: outside
Crypto map tag: Outside_map, seq num: 1, local addr: 3.3.3.3

  access-list VPN_ALLOWED_ACCESS extended permit ip 1.1.1.0 255.255.255.0 1.1.2.0 255.255.255.0 
  local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
  remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)
  current_peer: 2.2.2.2

  #pkts encaps: 60, #pkts encrypt: 60, #pkts digest: 60
  #pkts decaps: 60, #pkts decrypt: 60, #pkts verify: 60 


asa1(config)# no crypto map Outside_map 1 set peer 2.2.2.2 
WARNING: The crypto map entry will be incomplete!
asa1(config)# crypto map Outside_map 1 set peer 4.4.4.4 
asa1(config)# show run crypto | include peer
crypto map Outside_map 1 set peer 4.4.4.4 

After making the change a new SA should be built to the new peer address(es).

#ping vrf ASA4 10.10.10.2 rep 50 

Type escape sequence to abort.
Sending 50, 100-byte ICMP Echos to 1.1.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!..!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 96 percent (48/50), round-trip min/avg/max = 96/109/200 ms

asa1(config)# show crypto isa sa

1   IKE Peer: 4.4.4.4
    Type    : L2L             Role    : initiator 
    Rekey   : no              State   : MM_ACTIVE 


asa1(config)# show crypto ipsec sa
interface: outside
    Crypto map tag: Outside_map, seq num: 1, local addr: 3.3.3.3

    access-list VPN_ALLOWED_ACCESS extended permit ip 1.1.1.0 255.255.255.0 1.1.2.0 255.255.255.0 
    local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)
    current_peer: 4.4.4.4

    #pkts encaps: 172, #pkts encrypt: 172, #pkts digest: 172
    #pkts decaps: 172, #pkts decrypt: 172, #pkts verify: 172
2
  • Hey one.time - awesome explanation !! TY - may I ask, how you got this test output? GNS3?? So basically just need to make sure the new tunnel groups are in, add the new peer lines and remove the old one. Cool, I can do that!
    – A L
    May 8 '14 at 14:36
  • @AL - The output is from GNS3 running 8.4(2).
    – one.time
    May 9 '14 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.