CISCO ASA IPSEC

[aprasad11]

Hi All,

I have a situtation where i need to setup IPSEC tunnel between two  CISCO ASA's. The main CISCO ASA only had public IP and remote ASA is behind a NAT device (Starlink). The remote ASA will initiate the IPSEC tunnel connection.

Fortinet does this very well and is very simple but i need to setup in CISCO ASA. ASA model is 5525 model and if someone can help me provide some simple videos or documentation in setting this up.

I did some research and NAT-T is used however i do not have any simple video or documentation for the setup.

Thanks 

prasad

[Aref Alsouqi · Accepted solution]

Check these links please, hope they help:

Configure ASA-to-ASA Dynamic-to-Static IKEv1/IPsec - Cisco

Cisco ASA VPN Static to Dynamic IP (DHCP) | PeteNetLive

Cisco ASA Site to Site IKEv2 VPN Static to Dynamic | PeteNetLive

[aprasad11]

Thanky ou Aref.. the first link was perfect and was able to do this.  Currently the config is accepting IPSEC connection from all public IP range but i would like to lock this down to a specific public IP range. Are you also able to tell me how this can be done 

[Aref Alsouqi]

You're welcome. You can use the control plane access list which basically responsible to block or allow the traffic to the ASA itself. However, please be careful when you apply it as that might potentially lock you out of the firewall if you use remote connection to manage it. 

You would need something similar to this:

access-list CONTROL-PLANE extended permit esp host 1.1.1.1 any
access-list CONTROL-PLANE extended permit udp host 1.1.1.1 any eq 500
access-list CONTROL-PLANE extended permit udp host 1.1.1.1 any eq 4500
access-list CONTROL-PLANE extended deny esp any any
access-list CONTROL-PLANE extended deny udp any any eq 500
access-list CONTROL-PLANE extended deny udp any any eq 4500
access-list CONTROL-PLANE extended permit ip any any

access-group CONTROL-PLANE in interface outside control-plane

The IP address 1.1.1.1 will be replaced with the remote peer that will be allowed to establish the VPN tunnel with your ASA. The keyword "any" that is highlighted could be replaced with your ASA outside interface public IP.

Configure Control Plane Access Control for Secure FTD and ASA - Cisco

Configure a control-plane ACL for ASA using CLI - Cisco Video Portal