Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
If I have a crypto map with a line as follows:
crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8
Can I change that simply by typing the following in conf t:
# crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3
Or do additional steps need to be taken beforehand? What about afterwards?? Running a Cisco ASA 5510, software version 8.3(2)
Can I change that simply by typing the following in conf t:
In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for Outside_map's sequence number 10. The peer list can hold up to ten addresses.
ASA3(config)# show run crypto | i peer
crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8
ASA3(config)# crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3
ASA3(config)# show run crypto | i peer
crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 0.9.8.7 6.5.4.3
You'll need to negate the entries for 1.2.3.4 5.6.7.8 if you intend to simply swap the two for two.
..do additional steps need to be taken beforehand? What about afterwards?...
Ensuring the new VPN peer(s) have compatible IKE phase I and phase II configurations, reflexive ACLs, tunnel-group configuration for the new peer addresses and a roll-back plan may help with making this change.
ASA 8.3 L2L VPN Configuration Reference
Example Output:
The following example shows changing an ASA's remote peer IP address from 2.2.2.2 to 4.4.4.4.
asa1(config)# show run crypto
crypto map Outside_map 1 set peer 2.2.2.2
asa1(config)# tunnel-group 4.4.4.4 type ipsec-l2l
asa1(config)# tunnel-group 4.4.4.4 general-attributes
asa1(config-tunnel-general)# tunnel-group 4.4.4.4 ipsec-attributes
asa1(config-tunnel-ipsec)# ikev1 pre-shared-key C1sc0123
asa1(config)# show crypto isa sa
1 IKE Peer: 2.2.2.2
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
asa1(config)# show crypto ipsec sa
interface: outside
Crypto map tag: Outside_map, seq num: 1, local addr: 3.3.3.3
access-list VPN_ALLOWED_ACCESS extended permit ip 1.1.1.0 255.255.255.0 1.1.2.0 255.255.255.0
local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)
current_peer: 2.2.2.2
#pkts encaps: 60, #pkts encrypt: 60, #pkts digest: 60
#pkts decaps: 60, #pkts decrypt: 60, #pkts verify: 60
asa1(config)# no crypto map Outside_map 1 set peer 2.2.2.2
WARNING: The crypto map entry will be incomplete!
asa1(config)# crypto map Outside_map 1 set peer 4.4.4.4
asa1(config)# show run crypto | include peer
crypto map Outside_map 1 set peer 4.4.4.4
After making the change a new SA should be built to the new peer address(es).
#ping vrf ASA4 10.10.10.2 rep 50
Type escape sequence to abort.
Sending 50, 100-byte ICMP Echos to 1.1.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!..!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 96 percent (48/50), round-trip min/avg/max = 96/109/200 ms
asa1(config)# show crypto isa sa
1 IKE Peer: 4.4.4.4
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
asa1(config)# show crypto ipsec sa
interface: outside
Crypto map tag: Outside_map, seq num: 1, local addr: 3.3.3.3
access-list VPN_ALLOWED_ACCESS extended permit ip 1.1.1.0 255.255.255.0 1.1.2.0 255.255.255.0
local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)
current_peer: 4.4.4.4
#pkts encaps: 172, #pkts encrypt: 172, #pkts digest: 172
#pkts decaps: 172, #pkts decrypt: 172, #pkts verify: 172
