CISCO ASA IKEv2 hub and spoke
Configuration
The difference between site-to-site and hub-and-spoke topologies on a Cisco ASA is that you need to add some extra commands:
- Static routes
- Access-list entries
- Crypto map change on ASA1 (hub).
- One new command on ASA1 (hub).
ASA1
The following command is important:
same-security-traffic permit intra-interface
This permits the ASA to receive and transmit packets out of the same interface (OUTSIDE).
This is the full config:
hostname ASA1 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.1.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.1 255.255.255.0 ! same-security-traffic permit intra-interface ! access-list ASA1_ASA2 extended permit ip host 192.168.1.1 host 192.168.2.2 access-list ASA1_ASA2 extended permit ip host 192.168.3.3 host 192.168.2.2 access-list ASA1_ASA3 extended permit ip host 192.168.1.1 host 192.168.3.3 access-list ASA1_ASA3 extended permit ip host 192.168.2.2 host 192.168.3.3 ! route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.2 1 route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.3 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto ipsec security-association pmtu-aging infinite crypto map MY_CRYPTO_MAP 10 match address ASA1_ASA2 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.2 192.168.123.3 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP 20 match address ASA1_ASA3 crypto map MY_CRYPTO_MAP 20 set peer 192.168.123.3 crypto map MY_CRYPTO_MAP 20 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.2 type ipsec-l2l tunnel-group 192.168.123.2 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO tunnel-group 192.168.123.3 type ipsec-l2l tunnel-group 192.168.123.3 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end
ASA2
hostname ASA2 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.2.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.2 255.255.255.0 ! access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.1.1 access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.3.3 ! route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1 route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.1 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto ipsec security-association pmtu-aging infinite crypto map MY_CRYPTO_MAP 10 match address ASA2_ASA1 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.1 type ipsec-l2l tunnel-group 192.168.123.1 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end
ASA3
hostname ASA3 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.3.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.3 255.255.255.0 ! access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.1.1 access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.2.2 ! route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1 route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.1 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto map MY_CRYPTO_MAP 10 match address ASA3_ASA1 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.1 type ipsec-l2l tunnel-group 192.168.123.1 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end