A useful acronym to remember how to configure IKEv1 policy is HAGLE. IKEv1 is about negotiating the parameters, including dynamic shared keys, for security associations. Haggling is a type of negotiation.

H – Hash (the algorithm used for data integrity in the IKEV1 SA)
A – Authentication (method the two peers use to identify each other)
G – Group (the Diffie-Hellmann Group number)
L – Lifetime (time threshold after which the IKEV1 SA is rekeyed)
E – Encryption (the algorithm used for privacy in the IKEV1 SA)

1.  Set the ‘Identity Sent to Peer” to ‘Address’

ciscoasa# crypto isakmp identity address

2.  Allow IKEv1 on outside interface

ciscoasa# crypto ikev1 enable  outside

3.  Verify IKEv1 policy on the ASA.

The other side of the tunnel is preconfigured with several IKEv1 policies. You need to verify the existence of the equivalent policy of interest on the ASA.

ciscoasa# show run crypto ikev1

crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 1
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400

4.  Create the Crypto Map

ciscoasa# access-list Site1-VPN-Traffic line 1 extended permit ip 10.10.0.0 255.255.0.0 10.10.20.0 255.255.255.0
ciscoasa# crypto map outside_map 1 match address Site1-VPN-Traffic
ciscoasa# crypto map outside_map 1 set  peer  200.200.20.2
ciscoasa# crypto map outside_map 1 set  ikev1 transform-set  ESP-AES-128-SHA
ciscoasa# crypto map outside_map interface outside

5.  Define the corresponding tunnel group (Connection Profile)

ciscoasa# group-policy Site1-Policy internal
ciscoasa# group-policy Site1-Policy attributes
ciscoasa-attr# vpn-tunnel-protocol ikev1
ciscoasa# exit
ciscoasa# tunnel-group 200.200.20.2 type ipsec-l2l
ciscoasa# tunnel-group 200.200.20.2 general-attributes
ciscoasa-attr# default-group-policy Site1-Policy
ciscoasa# tunnel-group 200.200.20.2 ipsec-attributes
ciscoasa-attr# ikev1 pre-shared-key **********
ciscoasa-attr# isakmp keepalive threshold 10 retry 2

6.  Add a NAT Exemption for traffic from HQ to Site

ciscoasa# object network 10.10-Inside
ciscoasa# subnet 10.10.0.0 255.255.0.0
ciscoasa# object network 10.10.20-Site1
ciscoasa# subnet 10.10.20.0 255.255.255.0
ciscoasa# nat (inside,outside) 1 source static 10.10-Inside 10.10-Inside destination static 10.10.20-Site1 10.10.20-Site1

VERIFY THE CONNECTION…

Generate traffic from one side of the tunnel to the other to make the tunnel come up.

1.  View the status of the IKEv1 SA:

ciscoasa# sho crypto isa sa

IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 200.200.20.2
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE

2.  View the status of the IPsec SAs:

ciscoasa# sh crypto ipsec sa

interface: outside
Crypto map tag: outside_map, seq num: 10, local addr: 200.200.1.2
access-list Site1-VPN-Traffic extended permit ip 10.10.0.0 255.255.0.0
10.20.10.0 255.255.255.0
local ident (addr/mask/prot/port): (10.10.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.20.10.0/255.255.255.0/0/0)
current_peer: 200.200.20.2
#pkts encaps: 104, #pkts encrypt: 104, #pkts digest: 104
#pkts decaps: 95, #pkts decrypt: 95, #pkts verify: 95
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 104, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 200.200.1.2/0, remote crypto endpt.: 200.200.20.2/0
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 357F34E6
current inbound spi : 291040FE
inbound esp sas:
spi: 0x291040FE (688931070)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 81920, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4373971/3145)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x357F34E6 (897529062)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 81920, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4373928/3145)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

3.  Use DEBUG

ciscoasa# debug crypto ikev1 5

Monitor a tunnel teardown: (issue a ‘clear ikev1 sa‘)

Jan 10 16:32:26 [IKEv1]Group = 200.200.20.2, IP = 200.200.20.2, Session is being torn down. Reason: Administrator Reset
Jan 10 16:32:26 [IKEv1]Group = 200.200.20.2, IP = 200.200.20.2, Connection terminated for peer 200.200.20.2. Reason: Administrator Reset Remote Proxy 10.20.10.0, Local Proxy 10.10.0.0
Jan 10 16:32:26 [IKEv1 DEBUG]Group = 200.200.20.2, IP = 200.200.20.2, IKE Deleting SA: Remote Proxy 10.20.10.0, Local Proxy 10.10.0.0
Jan 10 16:32:26 [IKEv1]IP = 200.200.20.2, Received encrypted packet with no matching SA, dropping

A common requirement with Site-to-Site tunnels is access-control through the tunnel. One strategy to accomplish this might be to have a rather complex crypto ACL. But this leads to additional administration overhead as there is actually a pair of IPsec SAs for each active
entry in the crypto ACL. The proper way to limit traffic through a Site-to-Site tunnel with the ASA is to apply a filter via group policy. In this section of the lab, you will prevent Site1 systems from reaching the management subnet.

1.  Create an ACL which denies access to 10.10.2.0/24 for use as a filter for the Site1 VPN
Navigate to Configuration > Site-to-Site VPN > Advanced > ACL Manager
The table of ACLs defined on the ASA appears.
Click Add > Add ACL.
Enter the name Site1-VPN-Filter and click OK.

With Site1-VPN-Filter highlighted in the table, click Add > Add ACE.
Define the first Access Control Entry as follows:
• Action: Deny
• Source: Any
• Destination: 10.10.2.0/24
• Service: ip
Leave other options at their default values and click OK.

Select the first line in the Site1-VPN-Filter and select Add > Add ACE.
Define the first Access Control Entry as follows:
• Action: Permit
• Source: Any
• Destination: Any
• Service: ip
Leave other options at their default values and click OK.
Click Apply.

2.  Modify the group policy for Site1-VPN, and select the new ACL as the filter:
Navigate to Configuration > Site-to-Site VPN > Group Policies
Select the Site1-Policy and click Edit.
Modify the group policy as follows:
• IPv4 Filter: Uncheck Inherit and select Site1-VPN-Filter
Leave the other values at their defaults and click OK.
Click Apply.

The policy is defined, but it won’t take effect until the next time the Site1 VPN tunnel is negotiated.

3.  “Bounce” the Site1 tunnel:
Navigate to Monitoring > VPN > VPN Statistics > Sessions
Set the filter to IPsec Site-to-Site.
If the tunnel to 200.200.20.2 is still active, click Logout.