This blog post provides the simple configuration information to setup a Site-to-Site VPN between two Cisco ASA firewalls using the IKEv2 protocol.
The following lab scenario was setup in GNS3 using the following images:
- Cisco ASAv version 9.5(2)
- Cisco IOS version 15.2(4)
A VPN will be setup between the 2 Cisco ASA firewalls (ASAv-1 and ASAv-2). The 2 routers (R1 and R2) will act as hosts in the local networks in order to generate traffic to initiate the VPN tunnel on demand.
Continue reading Configuring IKEv2 Site-to-Site VPN on Cisco ASA
In a FlexVPN Hub and Spoke design spoke routers are configured with a normal static VTI with the tunnel destination of the Hub’s IP address, the Hub however is configured with a Dynamic VTI. The DVTI on the Hub router is not configured with a static mapping to the peer’s IP address. The VTI on the Hub is created dynamically from a preconfigured tunnel template “virtual-template” when a tunnel is initiated by the spoke router/peer. The dynamic tunnel spawns a separate “virtual-access” interface for each spoke tunnel, inheriting the configuration from the cloned the template.
Continue reading Configuring Cisco FlexVPN Hub-and-Spoke
As mentioned in the previous blog post when configuring FlexVPN configuration can be minimized by using the Smart Defaults, they comprises of default configurations for IKEv2 Proposal, IKEv2 Policy, IPSec Profile and Transform Set. This post provides a simple configuration example when using Smart Defaults and when using custom configurations.
Configuration Example – FlexVPN SVTI with Smart Defaults
This simple lab configuration is to setup a SVTI Site-to-Site VPN between 2 Cisco IOS routers.
Continue reading Configuring Cisco FlexVPN SVTI
FlexVPN is a framework to configure IPSec VPNs on Cisco IOS devices; it was created to simplify the deployment of VPN solutions of all type (Site-to-Site, Remote Access etc). It uses a common configuration template for all VPN types. FlexVPN is based on IKEv2 and does not support IKEv1.
- IKEv2 is more secure than IKEv1 because it supports the latest Suite B cryptographic algorithms
- Built-in support for Dead Peer Detection (DPD) and NAT-Traversal
- Is resistant to DoS attacks
- Consolidated IKEv1 main and aggressive modes into one method, called “initial”
- Supports more authentication methods; in addition to PSK, certificates it also supports EAP authentication.
- XAUTH not used in IKEv2, EAP is used for authentication instead: EAP Tunneling: EAP-TLS, EAP-PEAP, EAP-PSK, EAP Non-Tunnelling: EAP-MSCHAPv2, EAP-MD5, EAP-GTC and
Continue reading Cisco FlexVPN Overview