nxll15 site to site vpn
TRANSCRIPT
Lab 15: Site to Site VPN
Task
1. Configure IP Address as per given in topology.
2. Make sure ICMP open for all networks in ASA's.
3. Configure PAT on both ASA.
4. Make sure ASA1 and ASA2 ping each other.
5. Configure Site-to-Site VPN over ASA. Make sure both 192.168.1.2 and 192.168.2.2 ping each
other. Use Nat exemption for VPN traffic.
Figure 1 Topology
Lab 15: Site to Site VPN
Solution
Task 2: Make sure ICMP open for all networks in ASA's.
Both ASA's
access-list ICMP permit icmp any any
access-group ICMP in interface outside
Task 3: Configure PAT on both ASA.
ASA 1
nat (inside) 1 192.168.1.0 255.255.255.0
global (outside) 1 interface
ASA2
nat (inside) 1 192.168.2.0 255.255.255.0
global (outside) 1 interface
Task 4: Make sure ASA1 and ASA2 ping each other.
ASA 1
route outside 0 0 101.1.1.1
ASA 2
route outside 0 0 102.1.1.1
Task 5: Configure Site-to-Site VPN over ASA. Make sure both 192.168.1.2 and 192.168.2.2 ping
each other. Use Nat exemption for VPN traffic.
ASA 1
crypto isakmp policy 1
authentication pre-share
encryption 3des
group 2
exit
crypto isakmp key cisco address 102.1.1.100
crypto ipsec transform-set tset esp-3des esp-sha-hmac
exit
Lab 15: Site to Site VPN
access-list VPN permit ip host 192.168.1.100 host 192.168.2.100
exit
crypto map CMAP 10 set transform-set tset
crypto map CMAP 10 match address VPN
crypto map CMAP 10 set peer 102.1.1.100
exit
crypto isakmp enable OUTSIDE
crypto map CMAP interface outside
NAT Exemption
access-list nonat permit ip host 192.168.1.2 host 192.168.2.2
nat (inside) 0 access-list nonat
ASA 2
crypto isakmp policy 1
authentication pre-share
encryption 3des
group 2
exit
crypto isakmp key cisco address 101.1.1.100
crypto ipsec transform-set tset esp-3des esp-sha-hmac
exit
access-list VPN permit ip host 192.168.2.100 host 192.168.1.100
exit
crypto map CMAP 10 set transform-set tset
crypto map CMAP 10 match address VPN
crypto map CMAP 10 set peer 101.1.1.100
exit
crypto isakmp enable OUTSIDE
crypto map CMAP interface outside
Lab 15: Site to Site VPN
NAT Exemption
access-list nonat permit ip host 192.168.2.2 host 192.168.1.2
nat (inside) 0 access-list nonat