CloudLabBox
Try the free demo

Cisco ASA lab 9 of 15

Route-based VPN: a virtual tunnel interface with BGP over IPsec

Replace crypto-ACL thinking with routing: build an IKEv2 virtual tunnel interface (VTI) between HQ-FW and the branch router, run eBGP across it, and add a new branch subnet without touching the IPsec configuration.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 09 - Route-based VPN - a virtual tunnel interface with BGP over IPsec

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
5 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

The crypto-map VPN from lab 8 worked, but every new branch subnet means editing crypto ACLs and NAT exemptions on both ends, in step, during a change window. Kestrel's network architect wants the branch on a route-based VPN instead: a virtual tunnel interface on each side, IPsec protecting everything that is routed into it, and BGP deciding what goes there. The branch is about to add a voice VLAN (10.20.30.0/24, already on BRANCH's Loopback1) and the architect expects it to work without any VPN change.

SettingValue
IKEv2 SAAES-256, SHA-256 (integrity and PRF), DH group 19, PSK Kestrel-VTI-26
IPsec SAESP AES-256 + SHA-256, PFS group 19, 3,600 s
Tunnel addresses169.254.10.1/30 (HQ-FW, name vti-branch), 169.254.10.2/30 (BRANCH)
BGPHQ-FW AS 65010 advertises 10.10.10.0/24; BRANCH AS 65020 advertises 10.20.20.0/24
PolicyBranch networks (10.20.0.0/16) may start any connection to the HQ LAN

What you’ll practise

  • Explain the difference between policy-based (crypto map) and route-based (VTI) VPNs
  • Configure an ASA VTI with an IPsec profile, tunnel group and IKEv2
  • Configure the matching IOS tunnel interface with tunnel protection
  • Run eBGP over the tunnel and control branch-initiated traffic with an ACL on the VTI
  • Show why VTI traffic needs no NAT exemption

The tasks

  1. IKEv2 and the IPsec profile on HQ-FW
  2. The tunnel interface on HQ-FW
  3. The branch side
  4. BGP across the tunnel
  5. Let the branch in
  6. Add the voice VLAN without touching IPsec

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Route-based VPN - a virtual tunnel interface with BGP over IPsec5 nodes, 4 links. Every link is listed as text below the diagram.HQ-FWPC1ISPBRANCHBR-PCGi0/0Gi0/0Gi0/1Gi0/0Gi0/1Gi0/0Gi0/1Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • ISP Gi0/1 to BRANCH Gi0/0
  • BRANCH Gi0/1 to BR-PC Gi0/0
Nodes in Route-based VPN: a virtual tunnel interface with BGP over IPsec, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BRANCHCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BR-PCCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 09 - Route-based VPN - a virtual tunnel interface with BGP over IPsec and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.