Cisco ASA Site-to-Site IPsec VPN CLI Configuration

The ASA remains one of the most common VPN gateways in enterprise networks, and its site-to-site (LAN-to-LAN) configuration is still done fastest on the CLI: ISAKMP policy, an interesting-traffic ACL, the tunnel-group holding the pre-shared key, and a crypto map binding it all to the outside interface. This guide follows the official Cisco ASA VPN CLI configuration guide step by step and shows a complete working example you can adapt.

Step 1: Configure Interfaces (Inside/Outside)

hostname(config)# interface gigabitethernet0/0
hostname(config-if)# nameif outside
hostname(config-if)# ip address 203.0.113.1 255.255.255.248
hostname(config-if)# no shutdown
hostname(config-if)# exit
hostname(config)# interface gigabitethernet0/1
hostname(config-if)# nameif inside
hostname(config-if)# security-level 100
hostname(config-if)# ip address 192.168.1.1 255.255.255.0
hostname(config-if)# no shutdown

Step 2: Configure the IKEv1 Policy and Enable ISAKMP

hostname(config)# crypto ikev1 policy 1
hostname(config-ikev1-policy)# authentication pre-share
hostname(config-ikev1-policy)# encryption aes
hostname(config-ikev1-policy)# hash sha
hostname(config-ikev1-policy)# group 2
hostname(config-ikev1-policy)# lifetime 43200
hostname(config-ikev1-policy)# exit
hostname(config)# crypto ikev1 enable outside

Step 3: Create the Transform Set and Interesting-Traffic ACL

hostname(config)# crypto ipsec ikev1 transform-set FirstSet esp-aes esp-sha-hmac
hostname(config)# access-list l2l_list extended permit ip 192.168.1.0 255.255.255.0 10.10.4.0 255.255.255.0

The ACL defines exactly which traffic enters the tunnel - local source subnet to remote destination subnet. It must mirror the peer's ACL, or the tunnel will establish but pass no traffic.

Step 4: Define the Tunnel Group with the Pre-Shared Key

hostname(config)# tunnel-group 10.10.4.108 type ipsec-l2l
hostname(config)# tunnel-group 10.10.4.108 ipsec-attributes
hostname(config-tunnel-ipsec)# ikev1 pre-shared-key 44kkaol59636jnfx

The tunnel-group name must be the IP address of the remote peer. Use the same pre-shared key on the far-end ASA, which references this device's public IP.

Step 5: Build the Crypto Map and Apply It

hostname(config)# crypto map abcmap 1 match address l2l_list
hostname(config)# crypto map abcmap 1 set peer 10.10.4.108
hostname(config)# crypto map abcmap 1 set ikev1 transform-set FirstSet
hostname(config)# crypto map abcmap interface outside
hostname(config)# write memory

For IKEv2 peers replace the policy/transform-set steps with crypto ikev2 policy, an ikev2 ipsec-proposal, and crypto map ... set ikev2 ipsec-proposal secure - the ACL and tunnel-group structure stay the same. Do not forget the NAT exemption (or nat ... no-proxy-arp route-lookup with identity NAT) or your interesting traffic will be translated before it can match the crypto ACL.

Verification Commands

hostname# show crypto isakmp sa
hostname# show crypto ipsec sa
hostname# show crypto map
hostname# show vpn-sessiondb l2l

In show crypto ipsec sa, check that both inbound and outbound encaps/decaps counters increase when you ping across the tunnel.

Related Guides on This Site

Start from the basics with Cisco ASA CLI basics: interfaces, ACLs and NAT, and compare with FortiGate IPsec setup or Juniper SRX route-based IPsec when you run multi-vendor VPNs.

原文链接：https://www.cisco.com/c/en/us/td/docs/security/asa/asa916/configuration/vpn/asa-916-vpn-config/vpn-site2site.html