Setting up redundancy with 2x Cisco CSR 1000V in AWS is easy, but what if I have two or more route-tables, cidr and network interfaces (eni)?   For example: "ios-config-39= \" redundancy \"\n " , "ios-config-40= \" cloud provider aws 1 \"\n " , "ios-config-41= \" bfd peer 172.17.1.2 \"\n " , "ios-config-42= \" route-table " , { "Ref" : "CSR1PrivateRouteTable1" } , " \"\n " , "ios-config-43=\"route-table ", { "Ref" : "CSR2PrivateRouteTable1" }, "\"\n", "ios-config-44= \" cidr ip 8.8.8.8 \/ 32 \"\n " , "ios-config-45=\"cidr ip 200.200.1.1\/32\"\n", "ios-config-46=\"cidr ip 102.199.98.1\/32\"\n", "ios-config-47= \" eni " , { "Ref" : "Csr1PriInt1" } , " \"\n " , "ios-config-48=\"eni ", { "Ref" : "Csr2PriInt1" }, "\"\n", "ios-config-49= \" region " , { "Ref" : "AWS::Region" } , " \"\n " ,   The above does not work. Does that mean I'll have to have multiple cloud providers for each route-table?   i.e.  cloud provider aws 1, cloud provider aws 2, cloud provider aws 3 ?   Thanks! ... View more

I have on-prem Cisco ASA and in AWS 2x Cisco VSRs. I'm trying to set up a VPN tunnel between those devices.   Some requirements: IP addresses between tunnels must be via DHCP (i.e. I don't want to specify the IP addresses... it should pick up automatically) Phase 1: AES-256-CBC SHA-384 Pre-share Group 24 Lifetime 14400 seconds Phase 2: ESP Mode Tunnel Ipsec encryption AES-256-CBC Authentication sha-384 PFS yes NAT-T enable group 24 3600 seconds I am able to create the tunnel on the CSR via CLI, but on the ASA I'm trying and it doesn't work (using ASDM). It would be great if you guys could help with the ASA commands (not ASDM). Just have in mind that there are existing VPN connections on the ASA so the configs you send must not overwrite those VPN connections, as this is a production ASA.   CSR commands: crypto ikev2 proposal VPN_TEST_IKEV2_PROPOSAL encryption aes-cbc-256 aes-cbc-192 aes-cbc-128 integrity sha384 group 5 ! crypto ikev2 policy VPN_TEST_IKEV2_POLICY match fvrf any proposal VPN_TEST_IKEV2_PROPOSAL ! crypto ikev2 keyring VPN_TEST_KEY peer TEST_DC address 200.200.200.1 pre-shared-key MySecretKey ! crypto ikev2 profile VPN_TEST_IKEV2_PROFILE match address local interface GigabitEthernet1 match identity remote any authentication local pre-share authentication remote pre-share keyring local VPN_TEST_KEY lifetime 36000 dpd 60 5 periodic ! crypto ipsec security-association lifetime seconds 3600 crypto ipsec security-association replay window-size 1024 ! crypto ipsec transform-set VPN_TEST_TS esp-aes 256 esp-sha-hmac mode tunnel ! crypto ipsec profile VPN_TEST_VTI set security-association lifetime seconds 3600 set transform-set VPN_TEST_TS set pfs group24 set ikev2-profile VPN_TEST_IKEV2_PROFILE ! interface Tunnel6 ip address 169.254.0.57 255.255.255.252 <-- I do not know how to specify dynamic IP here ip mtu 1400 ip tcp adjust-mss 1360 tunnel source GigabitEthernet1 <-- "outside" ethernet tunnel mode ipsec ipv4 tunnel destination 200.200.200.1 tunnel protection ipsec profile VPN_TEST_VTI ! ip route 192.168.100.0 255.255.255.0 Tunnel6 <-- remote network end That VPN config works between 2x Cisco CSRs, but it doesn't work between 1x CSR and 1x ASA. ... View more

Hi. I'm trying to deploy a High Availability CSR setup in AWS.  The goal is to deploy 2x CSRs in different AZs, then attach Public and Private subnets to that CSR. Each subnet must be created in a different AZ for HA purposes.   Also, that is a requirement for me, as I'll be deploying an ELB later one which requires at least 2x AZs.   At the moment I am creating 2x Public Subnets and 2x Private Subnets. However, they are in the same AZ. If I create a Network interface in a different AZ than the CSR, I won't be able to attach it to the CSR.   This is the expected result: CISCO CSR #1 ap-southeast-2a Public-NetworkInterface-1 ap-southeast-2a Public-NetworkInterface-2 ap-southeast-2b Private-NetworkInterface-1 ap-southeast-2a Private-NetworkInterface-2 ap-southeast-2b Private-NetworkInterface-3 ap-southeast-2c   CISCO CSR #2 ap-southeast-2b Public-NetworkInterface-1 ap-southeast-2a Public-NetworkInterface-2 ap-southeast-2b Private-NetworkInterface-1 ap-southeast-2a Private-NetworkInterface-2 ap-southeast-2b Private-NetworkInterface-3 ap-southeast-2c   Reading this online documentation, I can see it is possible to do what I'm aiming to. However, it does not say how to do it.   Does anybody know if it is possible to do that? if not, do you guys have any other suggestions? Thanks! ... View more

I am trying to monitor the VPN connection on my ASA 5520. The goal here is to create an alert with NAGIOS that, if a specific VPN goes down, send me an email.   I, however, can't make it work. I am using the following: snmpwalk -v 2c public -H 192.168.1.1 -o 1.3.6.1.4.1.9.9.171.1.2.1.1   What I get in return is: Configuration directives understood: In snmpwalk.conf and snmpwalk.local.conf: includeRequested (1|yes|true|0|no|false) excludeRequested (1|yes|true|0|no|false) printStatistics (1|yes|true|0|no|false) dontCheckOrdering (1|yes|true|0|no|false) timeResults (1|yes|true|0|no|false) timeResultsSingle (1|yes|true|0|no|false) In snmp.conf and snmp.local.conf: extraX509SubDir string x509CRLFile string tlsAlgorithms string localCert string peerCert string alias NAME TRANSPORT_DEFINITION doDebugging (1|0) debugTokens token[,token...] logTimestamp (1|yes|true|0|no|false) logOption string mibdirs [mib-dirs|+mib-dirs|-mib-dirs] mibs [mib-tokens|+mib-tokens] mibfile mibfile-to-read showMibErrors (1|yes|true|0|no|false) commentToEOL (1|yes|true|0|no|false) strictCommentTerm (1|yes|true|0|no|false) mibAllowUnderline (1|yes|true|0|no|false) mibWarningLevel integerValue mibReplaceWithLatest (1|yes|true|0|no|false) printNumericEnums (1|yes|true|0|no|false) printNumericOids (1|yes|true|0|no|false) escapeQuotes (1|yes|true|0|no|false) dontBreakdownOids (1|yes|true|0|no|false) quickPrinting (1|yes|true|0|no|false) numericTimeticks (1|yes|true|0|no|false) oidOutputFormat integerValue suffixPrinting integerValue extendedIndex (1|yes|true|0|no|false) printHexText (1|yes|true|0|no|false) printValueOnly (1|yes|true|0|no|false) dontPrintUnits (1|yes|true|0|no|false) hexOutputLength integerValue dumpPacket (1|yes|true|0|no|false) reverseEncodeBER (1|yes|true|0|no|false) defaultPort integerValue defCommunity string noTokenWarnings (1|yes|true|0|no|false) noRangeCheck (1|yes|true|0|no|false) persistentDir string tempFilePattern string noDisplayHint (1|yes|true|0|no|false) 16bitIDs (1|yes|true|0|no|false) clientaddr string clientaddrUsesPort (1|yes|true|0|no|false) serverSendBuf integerValue serverRecvBuf integerValue clientSendBuf integerValue clientRecvBuf integerValue noPersistentLoad (1|yes|true|0|no|false) noPersistentSave (1|yes|true|0|no|false) noContextEngineIDDiscovery (1|yes|true|0|no|false) timeout integerValue retries integerValue defDomain application domain defTarget application domain target dontLoadHostConfig (1|yes|true|0|no|false) defSecurityModel string tsmUseTransportPrefix (1|yes|true|0|no|false) defAuthType MD5|SHA defPrivType DES|AES defSecurityName string defContext string defPassphrase string defAuthPassphrase string defPrivPassphrase string defAuthMasterKey string defPrivMasterKey string defAuthLocalizedKey string defPrivLocalizedKey string defVersion 1|2c|3 defSecurityLevel noAuthNoPriv|authNoPriv|authPriv trustCert trustCert FINGERPRINT|FILENAME In snmpapp.conf and snmpapp.local.conf: defDomain application domain defTarget application domain target engineID string engineIDType num engineIDNic string   How can I get the SNMP working in a way that it returns me if a specific VPN (based on the peer IP Address maybe?) is UP or NOT?   Thanks in advance!   UPDATE: I managed to get the number of IPSEC connections... snmpwalk -v 2c public -H 192.168.1.1 -o 1.3.6.1.4.1.9.9.392.1.3.26.0   ... However, what I need is to see if a specific Site-To-Site IKEv2 VPN is up or down. ... View more