Tunnel-groups on ASA

CiscoBrownBelt — Fri, 21 Feb 2020 17:12:04 GMT

Can you use the same tunnel-group for each IPSEC tunnel you have built on the ASA? Basically, I don't see how or what command associates the tunnel-group with a particular IPSEC tunnel see configs below:

ASA1:
crypto ikev2 policy 3
encryption aes
integrity sha
group 3
lifetime seconds 86400
exit
crypto ipsec ikev2 ipsec-proposal PH-4
protocol esp encryption aes-256
protocol esp integrity sha-1
exit
tunnel-group 20.20.20.20 type ipsec-l2l
tunnel-group 20.20.20.20 ipsec-attributes
ikev2 local-authentication pre-shared-key ccdp*123
ikev2 remote-authentication pre-shared-key ccdp*123
exit

access-list VPN_SiteB_ACL extended permit ip object-group Internal_LAN object SiteB_Internal_Lan log info
crypto map ASA1-MAP_SiteB 1 match address VPN_SiteB_ACL
crypto map ASA1-MAP_SiteB 1 set peer 20.20.20.20
crypto map ASA1-MAP_SiteB 1 set ikev2 ipsec-proposal PH-4
crypto map ASA1-MAP_SiteB interface Outside
crypto ikev2 enable Outside

sysopt connection permit-vpn

Re: Tunnel-groups on ASA

Marvin Rhoads — Sun, 09 Jun 2019 14:47:50 GMT

The tunnel-group definition has the remote peer IP address in it. So does the crypto map section.

It's that common element that associates it with a given IPsec site-site VPN.

Re: Tunnel-groups on ASA

CiscoBrownBelt — Mon, 10 Jun 2019 20:33:22 GMT

Great thanks!

topic Re: Tunnel-groups on ASA in Network Security

Tunnel-groups on ASA

Re: Tunnel-groups on ASA

Re: Tunnel-groups on ASA