topic Re: ASA(9.16) to Azure S2S ( Using IKV2+VTI+BGP) Not working in Network Security

ASA(9.16) to Azure S2S ( Using IKV2+VTI+BGP) Not working

machine23 — Sun, 07 May 2023 16:06:33 GMT

Hi All ,

Have been at it for a long time ! The connection wont establish 😕

Attched is the config applied on the ASA which is generated on Azure*

Configuration of the ASA -:

Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
:
ASA Version 9.16(3)23
!
hostname
domain-name **********

interface GigabitEthernet1/1
nameif Inside
security-level 100
ip address 192.168.44.1 255.255.254.0
!

!
interface GigabitEthernet1/8.792
vlan 792
nameif Outside
security-level 0
ip address 184.55.56.44 255.255.255.224
!

interface BVI1
no nameif
no security-level
no ip address
!
interface Tunnel1
nameif AZURE
ip address 192.168.100.1 255.255.255.252
tunnel source interface Outside
tunnel destination 51.142.82.44
tunnel mode ipsec ipv4
tunnel protection ipsec profile AZURE-PROPOSAL
!

route Outside 0.0.0.0 0.0.0.0 x.x.x.23 1
route LINK 10.20.20.0 255.255.252.0 1.1.1.2 1
route Outside AZURE-PUBLIC IP 255.255.255.255 x.x.x.23 1
route AZURE 172.16.0.254 255.255.255.255 192.168.100.2

group-policy AZURE-PUBLIC IP internal
group-policy AZURE-PUBLIC IP attributes
vpn-tunnel-protocol ikev2

group-policy AZURE internal
group-policy AZURE attributes
vpn-tunnel-protocol ikev2

tunnel-group AZURE-PUBLIC IP type ipsec-l2l
tunnel-group AZURE-PUBLIC IP general-attributes
default-group-policy AZURE-PUBLIC IP
tunnel-group AZURE-PUBLIC IP ipsec-attributes
isakmp keepalive disable
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
no tunnel-group-map enable peer-ip
tunnel-group-map default-group AZURE-PUBLIC IP
!
class-map inspection_default
match default-inspection-traffic

On Azure Local Network Gateway -

- BGP Enabled

-Uses Default IPsec/Ike policy

If anyones got any pointers please let me know

Thanks 🙂

Re: ASA(9.16) to Azure S2S ( Using IKV2+VTI+BGP) Not working

MHM Cisco World — Sun, 07 May 2023 16:17:18 GMT

I dont get it one side use bgp and other not ?

Re: ASA(9.16) to Azure S2S ( Using IKV2+VTI+BGP) Not working

machine23 — Sun, 07 May 2023 16:38:59 GMT

Sorry i must have deleted the bgp config when i posted it here :

router bgp 65000
bgp log-neighbor-changes
bgp graceful-restart
address-family ipv4 unicast
neighbor 172.16.0.254 remote-as 65515
neighbor 172.16.0.254 ebgp-multihop 255
neighbor 172.16.0.254 activate
network 192.168.44.0
network 192.168.100.0 mask 255.255.255.252
no auto-summary
no synchronization
exit-address-family

BGP on both sides

Re: ASA(9.16) to Azure S2S ( Using IKV2+VTI+BGP) Not working

MHM Cisco World — Sun, 07 May 2023 16:51:24 GMT

So you run bgp over vti? If yes then why you don't use vti ip as neighbor??

Re: ASA(9.16) to Azure S2S ( Using IKV2+VTI+BGP) Not working

machine23 — Tue, 09 May 2023 07:26:32 GMT

Hi the issue was the following

1 - the azure generated configuration had some errors on the networks for the bgp

2- my Asa does not support DH 2 as it’s insecure , so created a custom policy on azure side and connection is up !

thanks Cisco world for trying to solve.