ASA vpn site-to-site isakmp question

[giuseppe parlato]

Hello,

it has been asked me to configure on ASA a new vpn site-to-site. For this vpn I should set :

crypto isakmp identity address
crypto isakmp enable outside

.. from my configuration crypto isakmp identity is auto and crypto isakmp is not enabled on any interface. I have many vpn with ike enabled on outside interface. My question is : why should I enable isakmp on outside interface and mostly can it create disruptions to ike vpn that are already in place ?

Furthermore either group-policy or tunnel-group it has been asked me to configure, both have not ike indication. Never seen this kind of vpn configuration before, something new.

Thanks

[Aditya Ganjoo · Accepted solution]

Hi Giuseppe,

The command crypto isakmp enable outside has been changed to crypto ikev1 enable outside in newer ASA versions so you do not need to enable this.

You also do not need to configure crypto isakmp identity address as it is set to auto.

This command tells that the tunnel would be negotiated on the basis of IP address but since it is set to auto it will on it own do that so no need to specify this command.

Yes you can create a new group policy and tunnel group for this new tunnel and it should have no impact on the other working tunnels.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[giuseppe parlato]

Thanks for your answer Aditya but is it correct they didn't asked me to configure IKE either in group policy or tunnel group configuration?

Let me add a question : it has been also asked to configure a crypto isakmp policy but maybe (as you wrote) it's just the same as crypto ike policy ?

ps. I'm talking about configuring vpn to AWS.