Cisco ASA IPsec VPN issue

[Jinny]

안녕하세요
유영진입니다

VPN 연결 중에 질문이 있습니다.
동적 VPN을 구성했으며 피어 정보를 모르는 ASA로 VPN 세션을 시작할 수 있는지 궁금합니다.

도와 주셔서 감사합니다.

[Oleg Volkov]

Hi.
Can You show dynamic crypto map?
And can You write in English :-) ?

[Jinny]

Cisco ASA IPsec VPN issue

Hello
I'm yu youngjin

I have a question during a VPN connection.
I've configured dynamic VPNs and i wonder if you can start a VPN session with an ASA that doesn't know peer information.

Thank you help.

---------------ASA(1)----------------

crypto ipsec ikev1 transform-set IPSEC_SA esp-aes esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map DY-MAP 1 set ikev1 transform-set IPSEC_SA
crypto dynamic-map DY-MAP 1 set reverse-route
crypto map DY-MAP 1 ipsec-isakmp dynamic DY-MAP
crypto map DY-MAP interface outside
crypto ca trustpool policy
no crypto isakmp nat-traversal
crypto ikev1 enable outside
crypto ikev1 policy 100
authentication pre-share
encryption aes
hash sha
group 2
lifetime 3600

tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key *****

---------------ASA(2)----------------

crypto ipsec ikev1 transform-set IPSEC_SA esp-aes esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map VPN_T 1 match address IPSEC_T
crypto map VPN_T 1 set peer 1.1.1.253
crypto map VPN_T 1 set ikev1 transform-set IPSEC_SA
crypto map VPN_T interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption aes
hash sha
group 2
lifetime 3600

tunnel-group 1.1.1.253 type ipsec-l2l
tunnel-group 1.1.1.253 ipsec-attributes
ikev1 pre-shared-key *****

[Oleg Volkov]

I have same config except this:
crypto dynamic-map RGMAP 5 match address RVPN <- this ACL with local networks and remote networks
But tunnel initialize only from ASA with dynamic IP

[Jinny]

So can't an ASA that doesn't know peer can't form a session?

[Oleg Volkov]

What you mean?
Try to detailed describe Your question please

[Jinny]

I want to know how to communicate with VPN in both directions in the context of dynamicVPN configured
Not just one side, but both

[Oleg Volkov · Accepted solution]

After VPN is UP, communictae can flow in both direction. But You do not know remote peer IP and can not initiate VPN.
Do You need always UP VPN?

[Jinny]

Always tell us how you can keep your VPN session.

Thank you very much for your help

[Oleg Volkov]

Ok.
You must keep any traffic from remote ASA.
You can do:
ntp server <Remote host IP> source inside

[Jinny]

Thank you for letting us know.
What happens if ntp is blocked?
Is there another way?

[Oleg Volkov]

Any traffic from inside to remote inside - for example ping (but not from ASA)

[Jinny]

Remote is supposed to maintain a VPN

Thank you very much for your help