topic Re: ASA: IKEv1 AND IKEv2 tunnels on the same context? in Network Security

ASA: IKEv1 AND IKEv2 tunnels on the same context?

swscco001 — Fri, 08 Mar 2024 13:53:51 GMT

Hello everybody,

a customer has a ASA5516-X running 9.16(4) with two contexts. He is using one
context for remote access by AnyConnect with IKEv2. The other context was used
just for IKEv1 tunnels until now.

Now he need to start to convert IKEv1 to IKEv2 tunnels if possible. So he will
have IKEv1 AND IKEv2 tunnels on the same context.

Is there any we need to keep in mind or is there a known bug that is against this
change project?

Every hint is welcome!

Thanks a lot and have a nice weekend!

Bye
R.

Re: ASA: IKEv1 AND IKEv2 tunnels on the same context?

Rob Ingram — Fri, 08 Mar 2024 14:00:53 GMT

@swscco001 you can run both IKEv1 and IKEv2 in parallel without problem in single mode, I don't see a problem either if using multi-context mode.

Re: ASA: IKEv1 AND IKEv2 tunnels on the same context?

MHM Cisco World — Fri, 08 Mar 2024 14:39:08 GMT

convert from IKEv1 to IKEv2,

I.e. both protect same subnet ? if Yes then there is issue, you need to use either IKEv1 or IKEv2

MHM

Re: ASA: IKEv1 AND IKEv2 tunnels on the same context?

Rob Ingram — Fri, 08 Mar 2024 15:17:18 GMT

You can run IKEv1 and IKEv2 on the same crypto map, IKEv2 would be preferred but can fail back to IKEv1.

Re: ASA: IKEv1 AND IKEv2 tunnels on the same context?

MHM Cisco World — Fri, 08 Mar 2024 15:48:53 GMT

I will run lab my friend and share result here.

If you have other points to check in lab please share it

Thanks

MHM

Re: ASA: IKEv1 AND IKEv2 tunnels on the same context?

MHM Cisco World — Sat, 09 Mar 2024 18:56:31 GMT

the IKEv1 have seq 5 and IKEv2 have seq 10

the IPSec VPN is build without check IKEv2
note:- again this in case your same LAN is protect by both IKEv1/v2

Re: ASA: IKEv1 AND IKEv2 tunnels on the same context?

Sheraz.Salim — Sun, 10 Mar 2024 11:49:33 GMT

just to add in my bit. My understanding about reading your question.

ASA5516-X running 9.16(4) with two contexts. One context running IKEv2 anyconnect and the other context running IKEv1 tunnel. Now the customer want to migrate IKEv1 tunnel to IKEv2.

ASA vpn multi-context support in version 9.16.x. Customer would be fine migrating from tunnel IKEv1 to IKEv2. Just tell them to do the prep-configuration prior to switchover. (having said Rob already mentioned the prefference would be IKEv2). Swift Migration of IKEv1 to IKEv2 L2L Tunnel This is an old document but still very relevent today.

I suggest if customer or youself making these changes in change window ask your third party/remote side to switch to ikev2 as your ASA will automatially switchoff to ikev2 from ikev1. In case if this does not happens issue this command where ikev1 tunnel resides.

vpn-sessiondb logoff tunnel-group 1.1.1.1 noconfirm