Cisco Systems ASA5515K9, ASA 5500 Configuring LAN-to-LAN IPsec VPNs

CHAPT ER
73-1
Cisco ASA 5500 Series Configuration Guide using the CLI
73
Configuring LAN-to-LAN IPsec VPNs
A LAN-to-LAN VPN connects networks in different geographic locations.
The ASA supports LAN-to-LAN VPN connections to Cisco or third-party peers when the two peers have
IPv4 inside and outside networks (IPv4 addresses on the inside and outside interfaces).
For LAN-to-LAN connections using mixed IPv4 and IPv6 addressing, or all IPv6 addressing, the
security appliance supports VPN tunnels if both peers are Cisco ASA 5500 series security appliances,
and if both inside networks have matching addressing schemes (both IPv4 or both IPv6).
Specifically, the following topologies are supported when both peers are Cisco ASA 5500 series ASAs:
•The ASAs have IPv4 inside networks and the outside network is IPv6 (IPv4 addresses on the inside
interfaces and IPv6 addresses on the outside interfaces).
•The ASAs have IPv6 inside networks and the outside network is IPv4 (IPv6 addresses on the inside
interface and IPv4 addresses on the outside interfaces).
•The ASAs have IPv6 inside networks and the outside network is IPv6 (IPv6 addresses on the inside
and outside interfaces).
Note The ASA supports LAN-to-LAN IPsec connections with Cisco peers, and with third-party peers that
comply with all relevant standards.
This chapter describes how to build a LAN-to-LAN VPN connection. It includes the following sections:
•Summary of the Configuration, page73-1
•Configuring Interfaces, page73-2
•Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface, page73-3
•Creating an IKEv1 Transform Set, page73-5
•Creating an IKEv2 Proposal, page73-6
•Configuring an ACL, page73-7
•Defining a Tunnel Group, page73-7
•Creating a Crypto Map and Applying It To an Interface, page73-9
Summary of the Configuration
This section provides a summary of the example LAN-to-LAN configuration this chapter describes.
Later sections provide step-by-step instructions.