Have a beginner - intermediate level knowledge of VPN config on ASA and trying to clarify couple things...
First, I've studied "Configuring IPSEC and ISAKMP" doc and compared to my actual ASA config (done by other CCNP). The doc makes no mention of tunnel-groups yet I see l2l tunnel-groups which contain pre-shared-key. Why does doc make no mention of tunnel-groups or pre-shared-keys?
Next, I do not see how these l2l tunne-groups link to their group-policy. How does ASA know which tunnel-group to select when sa negotiation takes place?
Next, remote-access tunnel-groups contain "default-group-policy" command. Also there is "vpn-group-policy" command under username <name> password <pass>. Why? Is one take precedence over other?
The tunnel-groups are used to be able to tell the ASA what type of remote access to allow the peer to use. You can have remote access or l2l tunnel-groups. The l2l tunnel group references the ip address of the remote peer, and under this it would have the pre-shared key that has to match on both ends.
The tunnel-group is associated to your crypto map. The l2l tunnel group that has the pre-shared key is for phase 1 negotiations, and phase 2 is done through your transform-sets and ACLs that are applied to your crypto map:
crypto map VPN 10 set peer 188.8.131.52
crypto map VPN 10 match address VPN
crypto map VPN 10 set transform-set VPN
tunnel-group 184.108.40.206 ipsec-l2l
tunnel-group 220.127.116.11 ipsec-attributes
access-list VPN permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
When a request comes in from 18.104.22.168 for 192.168.1.0, then the crypto map that's applied to the outside interface runs through it's sequence numbers to find a match. After it sees 22.214.171.124 as the requesting peer, it tries to match up the key with the tunnel-group. If that matches, then it proceeds to the next steps making sure that the same traffic is encrypted on the other side, transform sets match, etc.
The default-group-policy is a "catch-all" that matches anything that doesn't match the "vpn-group-policy" that you have. If you have a user using "vpn-group-policy", but you have other users that aren't locked into a group, then they'd use the default group policy.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...