This doc will talk about configuration of Cisco asav+ CloudStackside for site-site VPN connection . After
reading this document ,you will able to understand ,configure and
establish tunnel (site-site vpn connection )between both sides.
On Cisco side:
#enable
#config t
1)
Define the interfaces and assign a IP's.like below:
#
Here configured name label "outside" is public IP of cisco device and "inside" is internal Guest VM's IP.
Note: you can assign management IP to access the console or you can use same public IP for accessing the console:
if you want to use management IP then use below config:
#
2) Create a networks and map the subnets :
#
ColudStack:
refer the documentation on site-site vpn connection section.
On Cisco side:
#enable
#config t
1)
Define the interfaces and assign a IP's.like below:
#
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.147.49.159 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.168.0.1 255.255.255.0
!
interface GigabitEthernet0/2
nameif inside2
security-level 100
ip address 192.168.0.1 255.255.255.0
!
Here configured name label "outside" is public IP of cisco device and "inside" is internal Guest VM's IP.
Note: you can assign management IP to access the console or you can use same public IP for accessing the console:
if you want to use management IP then use below config:
#
interface Management0/0
shutdown
nameif management
security-level 0
ip address 10.147.41.49 255.255.254.0
2) Create a networks and map the subnets :
#
object network obj-any
subnet 0.0.0.0 0.0.0.0
object network a_network
subnet 172.168.0.0 255.255.255.0
object network r_network
subnet 10.0.0.0 255.0.0.0
object network a1_network
subnet 192.168.0.0 255.255.255.0
3)Define ACL's for allowing access between networks
#
access-list outside_access_in extended permit ip any any
access-list SITE2_VPN extended permit ip object a1_network object r_network
access-list SITE2_VPN extended permit ip object r_network object a1_network
access-list SITE2_VPN extended permit ip object a_network object r_network
access-list SITE2_VPN extended permit ip object r_network object a_network
access-list Trust_Access extended permit ip any4 any
4)Configuring the NAT explicitly between source and destination:
#
nat (inside,outside) source static a_network a_network destination static r_network r_network no-proxy-arp route-lookup
nat (inside2,outside) source static a1_network a1_network destination static r_network r_network no-proxy-arp route-lookup
!
object network obj-any
nat (inside2,outside) dynamic interface
object network a_network
nat (inside,outside) dynamic interface
object network a1_network
nat (inside2,management) dynamic interface
access-group outside_access_in in interface outside
5)Add route to public :
#
route outside 0.0.0.0 0.0.0.0 10.147.49.1 2
6) define the phase1 and phase2 communication channel and protocols
#ike1
crypto ipsec ikev1 transform-set ASA1TS esp-aes esp-sha-hmac
#ike2
crypto ipsec ikev2 ipsec-proposal TSET
protocol esp encryption aes
protocol esp integrity sha-1
crypto ipsec security-association lifetime seconds 3600
crypto ipsec security-association pmtu-aging infinite
crypto map CRYPTO-MAP 1 match address SITE2_VPN
crypto map CRYPTO-MAP 1 set pfs
crypto map CRYPTO-MAP 1 set peer 10.147.53.45
crypto map CRYPTO-MAP 1 set ikev2 ipsec-proposal TSET
crypto map CRYPTO-MAP 1 set nat-t-disable
crypto map CRYPTO-MAP interface outside
7)Define the policy :
crypto ikev2 policy 1
encryption aes
integrity sha
group 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
8)
create a tunnel and define the attributes:
tunnel-group 10.147.53.45 type ipsec-l2l
tunnel-group 10.147.53.45 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
To get the ssh access :
add these rules:
#
ssh 0.0.0.0 0.0.0.0 outside
ssh 10.0.0.0 255.0.0.0 outside
ssh 10.0.0.0 255.0.0.0 management
ColudStack:
refer the documentation on site-site vpn connection section.
