IKE phase 1

[Mohd Khairul Nizam]

Existing config on ASA 5510:

crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400

=====

i want to create another site to site vpn, the second site also using the same (pre-share,aes256, hash sha,group 5)

should i configure again using different policy number or it used the existing one.

[Karsten Iwen · Accepted solution]

You can share the crypto-config you have. So you don't need a new policy and if the second peer also uses the same Phase2-crypto, you also don't need another transform-set.

All you need is an additional sequence in the existing crypto map with (at least) "set peer", "set transform-set" and "match address".

[Mohd Khairul Nizam]

Ok got it.

if existing

crypto map VPN_map 10 match address VPN_cryptomap
crypto map VPN_map 10 set peer x.x.x.x 
crypto map VPN_map 10 set transform-set ESP-AES-256-SHA
crypto map VPN_map interface outside

==========

i would like to create 

crypto map SG_map bb match address SG_cryptomap
crypto map SG_map bb set peer y.y.y.y
crypto map SG_map bb set transform-set xxxxxxxxxxxxxxxxx
crypto map SG_map interface outside

i would like to know what no bb is?

can i use 20

[Karsten Iwen · Accepted solution]

Does the new VPN terminate on the same interface as the first VPN? Then you have to use the same crypto map as there can only be one crypto map applied to each interface:

crypto map VPN_map 10 match address VPN_cryptomap
crypto map VPN_map 10 set peer x.x.x.x 
crypto map VPN_map 10 set transform-set ESP-AES-256-SHA
crypto map VPN_map 20 match address SG_cryptomap
crypto map VPN_map 20 set peer y.y.y.y
crypto map VPN_map 20 set transform-set xxxxxxxxxxxxxxxxx
crypto map VPN_map interface outside

In general, it just has to be a unique number per different destination-network.