Firewalls and VPNs lab 3 of 16
ASA crypto map to an IOS VTI - matching traffic selectors
Join a policy-based ASA to a branch router that uses route-based tunnels. Watch a static VTI refuse the ASA's traffic selectors, then fix it with a dynamic VTI that accepts them and injects the route, while the ASA keeps its crypto map, NAT exemption and internet PAT.
Run this lab
It needs Lite: its 5 nodes are set to 5 vCPU and 4,096 MB in total. That fits the free demo too.
In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 03 - ASA crypto map to an IOS VTI - matching traffic selectors
- Level
- Advanced
- Time
- About 90 minutes
- Nodes need
- 5 vCPU, 4,096 MB
- Smallest plan
- Lite
The scenario
Harbourside Logistics protects its Southampton head office with an ASA, run by the security team, and every tunnel on it is a crypto map. The Portsmouth branch router belongs to the network team, whose standard is route-based tunnels: a VTI per peer, with routing deciding what is encrypted. Your job is to join the two without either team throwing away its standard.
| Device | Interface | Address | Notes |
|---|---|---|---|
| HQ-FW | Gi0/0 inside / Gi0/1 outside | 10.10.10.1/24 / 203.0.113.2/24 | PAT for the HQ LAN to the internet |
| HQ-PC | Gi0/0 | 10.10.10.10/24 | Gateway 10.10.10.1 |
| ISP | Gi0/0 / Gi0/1 / Lo0 | 203.0.113.1 / 192.0.2.1 / 198.51.100.10 | Lo0 is an internet web server |
| BRANCH | Gi0/0 / Gi0/1 | 192.0.2.2/24 / 10.20.20.1/24 | PAT for the branch LAN (VPN traffic already excluded) |
| BR-PC | Gi0/0 | 10.20.20.10/24 | Gateway 10.20.20.1 |
| Setting | Value |
|---|---|
| IKE SA | IKEv2, AES-256-GCM, PRF SHA-384, DH group 20 |
| Authentication | Pre-shared key Harbour-VPN-27 |
| IPsec SA | ESP AES-256-GCM, PFS group 20, 3,600 s |
| Protected traffic | 10.10.10.0/24 to and from 10.20.20.0/24 |
What you’ll practise
- Configure an ASA IKEv2 crypto map with AES-256-GCM, a PRF and DH group 20
- Exempt VPN traffic from the ASA's PAT with identity NAT
- Explain why a static VTI and a crypto map disagree about traffic selectors
- Read TS_UNACCEPTABLE evidence on both ends
- Build an IOS dynamic VTI (virtual template) that accepts a policy-based peer and injects its route
- Verify the tunnel on both vendors: show crypto ikev2 sa, show crypto ipsec sa, show vpn-sessiondb, show crypto session
The tasks
- Check the underlay
- The ASA end (policy-based)
- The branch end, first try: a static VTI
- The fix: a dynamic VTI with multiple SAs
- Verify on both vendors
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- HQ-FW
Gi0/0to HQ-PCGi0/0 - HQ-FW
Gi0/1to ISPGi0/0 - ISP
Gi0/1to BRANCHGi0/0 - BRANCH
Gi0/1to BR-PCGi0/0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| HQ-FW | Cisco ASAv | asav-9.22.1.1-PLR-Licensed | 1 vCPU, 2,048 MB |
| HQ-PC | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| ISP | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| BRANCH | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| BR-PC | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Firewalls and VPNs multi-vendor guided labs.Open
03 - ASA crypto map to an IOS VTI - matching traffic selectorsand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Firewalls and VPNs labs
Related labs in other courses
CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.