ASA 5525 command "#migrate l2l-- only one endpoint needs this command?

[jmaxwellUSAF]

I'm tasked with upgrading an ASA-5525  L2L VPN from IKEv1 to IKEv2.

Book "Cisco ASA, 3rd edition" states on page 806 simply to use this command "#migrate l2l", and that's it.

1. is that all that is needed for this task?

2. Does the other tunnel endpoint also need to adjust its configuration for this tunnel to only use IKEv2?

Thank you.

[balaji.bandi · Accepted solution]

1. is that all that is needed for this task? yes correct

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113597-ptn-113597.html

2. Does the other tunnel endpoint also need to adjust its configuration for this tunnel to only use IKEv2?

yes that need to match both side config same.

this will ahave downtime when you migrate from v1 to v2.

Note : if you like to have more secure you can change the config after convert.

[MHM Cisco World]

what you need 
IKEv2 policy 
IKEv2 proposal 
IKEv2 tunnel-group local and remote pre-shared key
all this need to make IKEv2 work. 

after migrate make sure that all above is correct.