Site-to-Site VPN Setup Using Preshared Keys

Step 1.

Launch the VPN Wizard by choosing Wizards > VPN Wizard, as shown in Figure 21-3.

Figure 21-3. Launching the VPN Wizard Through the Menu Bar

You can also launch the VPN Wizard by navigating to Configuration > Wizards > VPN.

ASDM launches the VPN Wizard with the option to choose a tunnel type. Click the Site-to-Site radio button, as shown in Figure 21-4.

Figure 21-4. Choosing the Site-to-Site Tunnel Type

Because the remote peer of the site-to-site VPN tunnel resides toward the outside interface of Cisco ASA, the Outside interface is chosen from the drop-down menu in the VPN Tunnel Interface field. Click Next to move to the Remote Site Peer window.

Step 2.

Specify the peer's identity.

The VPN Wizard prompts you to specify peer information, such as its public IP address and ISAKMP authentication method. In the example, the public IP address of Cisco ASA in London is 209.165.201.1, as specified in the Peer IP Address field in Figure 21-5.

Figure 21-5. Site-to-Site ASA Setup

As mentioned in Chapter 15, "Site-to-Site IPSec VPNs," Cisco ASA supports two authentication methods: preshared keys and RSA signatures (PKI). In this topology, preshared keys are used to authenticate the VPN peer. The administrator has chosen to use cisco123 as the preshared secret key for peer authentication. Click Next to move to the IKE Policy window.

Step 3.

Select the IKE policy.

Cisco ASA allows you to choose the IKE parameters such as the encryption and authentication types and the Diffie-Hellman (DH) group. In Figure 21-6, the administrator has selected 3DES for encryption, SHA for authentication, and DH group 2 for key generation. Click Next to move to the IPSec Encryption and Authentication window.

Figure 21-6. Selecting the IKE Policy

Note

It is recommended to use AES-256 as an encryption algorithm. However, AES is a new standard and is not supported by all VPN devices. Check with the remote VPN device administrator to confirm whether it supports this standard.

Step 4.

Set up the IPSec transform set.

Configuring the IPSec transform set is accomplished by selecting an encryption and authentication algorithm. In Figure 21-7, the administrator has chosen 3DES for encryption and SHA for hash authentication. Click Next to move to the Local Hosts and Networks window.

Figure 21-7. Selecting the IPSec Transform Set

Step 5.

Identify local networks.

Select the hosts/subnets or networks to be used as the local proxy during the IPSec negotiation. Cisco ASA recognizes all the local networks, if their routes are in the routing table. You can click the . . . button to see a list of the local networks, as shown in Figure 21-8.

Figure 21-8. Selecting Networks from the List

Optionally, you may manually add an address in the IP Address field with the appropriate subnet mask. After you enter the IP address, click Add to move the address to the Selected Hosts/Networks pane, as illustrated in Figure 21-9. In this example, the administrator has added 192.168.10.0/24 and 192.168.20.0/24 as local networks.

Figure 21-9. Adding Selected Networks as the Local Proxy

Cisco ASA also allows you to specify the interface name or a tunnel group that identifies traffic. These options are hardly used in real-world site-to-site VPN deployments. Click Next to move to the next window.

Step 6.

Define remote networks.

The Remote Hosts and Networks window allows you to identify the remote private network. This window looks very similar to the one in Step 5. In Figure 21-10, the administrator has identified two remote private networks: 192.168.30.0/24 and 192.168.40.0/24. Click Next.

Figure 21-10. Adding Selected Networks as the Remote Proxy

Step 7.

Verify the site-to-site configuration.

The last step in setting up a site-to-site VPN tunnel is to verify that all the parameters are accurate. If they look correct, click Finish to complete the VPN Wizard.