CloudLabBox
Try the free demo

Cisco ASA lab 8 of 15

Site-to-site VPN: IKEv2 crypto map between the ASA and an IOS router

Connect the Kestrel branch office to HQ with a policy-based IKEv2 IPsec VPN between HQ-FW and the branch IOS router, exempt the VPN from PAT, verify both IKE and IPsec SAs, and troubleshoot a proposal mismatch.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 08 - Site-to-site VPN - IKEv2 crypto map between the ASA and an IOS router

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
5 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

Kestrel has opened a branch office. Its router, BRANCH, already gives the branch LAN internet access with PAT (and its NAT ACL already leaves HQ-bound traffic alone). Branch staff now need the HQ servers on 10.10.10.0/24, and HQ admins need to reach branch devices. Build an IKEv2 IPsec tunnel between HQ-FW and BRANCH. Kestrel's crypto standard:

SettingValue
IKEv2 SA (phase 1)AES-256-CBC, SHA-256 integrity and PRF, DH group 19 (ECP-256), lifetime 86,400 s
Authenticationpre-shared key Kestrel-VPN-26
IPsec SA (phase 2)ESP AES-256 with SHA-256, PFS group 19, lifetime 3,600 s, tunnel mode
Protected traffic10.10.10.0/24 to and from 10.20.20.0/24
PeersHQ-FW 203.0.113.2, BRANCH 192.0.2.2

What you’ll practise

  • Plan matching IKEv2 (phase 1) and IPsec (phase 2) parameters for two vendors' syntax
  • Configure an ASA crypto map with IKEv2, a tunnel group and pre-shared keys
  • Configure the IOS side with an IKEv2 proposal, policy, keyring, profile and crypto map
  • Exempt VPN traffic from PAT with identity NAT
  • Verify with show crypto ikev2 sa, show crypto ipsec sa, show vpn-sessiondb and packet-tracer
  • Troubleshoot a phase 2 mismatch

The tasks

  1. Check the underlay
  2. HQ-FW crypto configuration
  3. BRANCH crypto configuration
  4. Bring the tunnel up and verify
  5. Internet still works
  6. Troubleshoot a mismatch

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Site-to-site VPN - IKEv2 crypto map between the ASA and an IOS router5 nodes, 4 links. Every link is listed as text below the diagram.HQ-FWPC1ISPBRANCHBR-PCGi0/0Gi0/0Gi0/1Gi0/0Gi0/1Gi0/0Gi0/1Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • ISP Gi0/1 to BRANCH Gi0/0
  • BRANCH Gi0/1 to BR-PC Gi0/0
Nodes in Site-to-site VPN: IKEv2 crypto map between the ASA and an IOS router, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BRANCHCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BR-PCCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 08 - Site-to-site VPN - IKEv2 crypto map between the ASA and an IOS router and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.