CISCO ASA IKEv2 hub and spoke

Configuration

The difference between site-to-site and hub-and-spoke topologies on a Cisco ASA is that you need to add some extra commands:

  • Static routes
  • Access-list entries
  • Crypto map change on ASA1 (hub).
  • One new command on ASA1 (hub).

ASA1

The following command is important:

same-security-traffic permit intra-interface

This permits the ASA to receive and transmit packets out of the same interface (OUTSIDE).

This is the full config:

hostname ASA1 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.1.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.1 255.255.255.0 ! same-security-traffic permit intra-interface ! access-list ASA1_ASA2 extended permit ip host 192.168.1.1 host 192.168.2.2 access-list ASA1_ASA2 extended permit ip host 192.168.3.3 host 192.168.2.2 access-list ASA1_ASA3 extended permit ip host 192.168.1.1 host 192.168.3.3 access-list ASA1_ASA3 extended permit ip host 192.168.2.2 host 192.168.3.3 ! route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.2 1 route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.3 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto ipsec security-association pmtu-aging infinite crypto map MY_CRYPTO_MAP 10 match address ASA1_ASA2 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.2 192.168.123.3 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP 20 match address ASA1_ASA3 crypto map MY_CRYPTO_MAP 20 set peer 192.168.123.3 crypto map MY_CRYPTO_MAP 20 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.2 type ipsec-l2l tunnel-group 192.168.123.2 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO tunnel-group 192.168.123.3 type ipsec-l2l tunnel-group 192.168.123.3 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end

ASA2

hostname ASA2 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.2.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.2 255.255.255.0 ! access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.1.1 access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.3.3 ! route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1 route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.1 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto ipsec security-association pmtu-aging infinite crypto map MY_CRYPTO_MAP 10 match address ASA2_ASA1 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.1 type ipsec-l2l tunnel-group 192.168.123.1 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end

ASA3

hostname ASA3 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.3.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.3 255.255.255.0 ! access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.1.1 access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.2.2 ! route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1 route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.1 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto map MY_CRYPTO_MAP 10 match address ASA3_ASA1 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.1 type ipsec-l2l tunnel-group 192.168.123.1 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end