Configuring VPN on Cisco ASA

This material follows up on the topic covered in the Configuring VPN between two Cisco routers, but is being dedicated an entirely separate article, since it deals explicitly with configuring Cisco ASA devices.

The task will again consist of connecting a main and a branch office through VPN, but this time the main office works on a Cisco ASA 5510 firewall instead of a Cisco 2800 router.

At our disposal we have:
Cisco ASA 5510 firewall in the main office

• Users are inside LAN 192.168.10.0 /24
• External static IP address is 1.1.1.2 /30
• ISP gateway is 1.1.1.1 /30

Router Cisco 881 at the branch office

• Users are inside LAN 192.168.20.0 /24
• External static IP address is 2.2.2.2 /30
• ISP gateway 2.2.2.1 /30

The process of configuring the Cisco 881 router has been described in the “second universal method” section for configuring VPN tunnels in the article Configuring VPN between two Cisco routers, so here we will focus only on configuring the Cisco ASA firewall. The firewall is already configured with the basic settings outlined in Cisco ASA. The Basics. Internet access article: it is accessible for remote administration and the office LAN can reach the Internet.

Step 0

If your ASA IOS version is older than 8.3 (you can check the current version with the “sh ver” command), then turn off nat-control option for the ease of configuration:

Step 1. Interface configuration check

First, let’s check that our firewall has correctly configured outside and inside interfaces. Since we are working on Cisco ASA 5510 model (as opposed to 5505), this configuration is slightly different than the one mentioned in the initial article. The IP addresses and other parameters are assigned directly to the physical interfaces Ethernet0 and Ethenet1 instead of the virtual VLAN interface.

The outside interface:

Step 2. Define the encryption parameters

Here we configure the encryption parameters for the VPN tunnel between the main office and the branch location and turn on the VPN on the outside interface. These parameters are identical to the ones used on the Cisco 881 router at the remote site:
For IOS version less than 9.0

For IOS version greater than 9.0

Step 3. Define the “interesting traffic” that should be encrypted and sent into the tunnel

Create an access list named ACL_CRYPTO_DO, in which we define the traffic that needs to be encrypted into the VPN tunnel, this is called “interesting traffic” in Cisco. All other packets will not be routed into the VPN.

Step 4. Create the encryption policy

Create the encryption policy, also known as a “crypto map“, in which we will reference all the rules and encryption parameters that were created in steps 2 and 3:
For IOS version less than 9.0

Instead of XXXXX enter the key you wish to use for the VPN with the remote peer. It needs to be identical on both the Cisco ASA in the main office and the Cisco 881 at the branch office. I recommend making it complex, no less than 50 symbols, using digits, letters and special characters.

All the same but for IOS version greater than 9.0

Step 5. Routing

Directly define the route to the branch LAN network through the outside interface and the gateway, provided by the ISP (1.1.1.1) :

Step 6. Avoiding unneccessary translation (NO-NAT)

If the Cisco ASA is used for user access to the Internet (Dynamic NAT is configured to translate internal addresses to the outside), you need to prevent unneccessary translation of packets which should be routed to the private ip networks through the tunnel. In order to avoid this add these strings

For IOS version after 8.3

For IOS version before 8.3

If this won’t be done, the tunnel will be established, but packets will not be transmitted.

Step 7. Check the VPN tunnel

After we create the mirror configuration on the branch office’s Cisco 881, next step is to check whether the VPN tunnel works by sending a ping from a workstation in the main office to a workstation at the branch office.

You can check the tunnel with the following commands:

• Check the active VPN connections with the “show crypto isakmp sa” command

Any state except (!) MM_ACTIVE means that the VPN is not working. If it is taking more than one minute in order to establish the tunnel, you need to check all the configured encryption parameters and ensure that they are identical on both VPN peers.
If this command does not produce any output, then you are probably missing some part of configuration – for example, you did not aplpy the crypto map to the outside interface.

• The “show crypto ipsec sa” command give you the number of transmitted and received packets inside the VPN tunnel. This is the ultimate command for troubleshooting a connection. The information is available only (!) when the tunnel has been established – otherwise the output is empty.

• The “clear crypto isakmp sa” command allows to reset all the current VPN tunnels and force them to re-initialize. The command “clear crypto ipsec sa peer 2.2.2.2” will reset the counters of all transmitted and received packets.