Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Crypto Confusion

Have a beginner - intermediate level knowledge of VPN config on ASA and trying to clarify couple things...

First, I've studied "Configuring IPSEC and ISAKMP" doc and compared to my actual ASA config (done by other CCNP). The doc makes no mention of tunnel-groups yet I see l2l tunnel-groups which contain pre-shared-key. Why does doc make no mention of tunnel-groups or pre-shared-keys?

Next, I do not see how these l2l tunne-groups link to their group-policy. How does ASA know which tunnel-group to select when sa negotiation takes place?

Next, remote-access tunnel-groups contain "default-group-policy" command. Also there is "vpn-group-policy" command under username <name> password <pass>. Why? Is one take precedence over other?




Re: Crypto Confusion


The tunnel-groups are used to be able to tell the ASA what type of remote access to allow the peer to use. You can have remote access or l2l tunnel-groups. The l2l tunnel group references the ip address of the remote peer, and under this it would have the pre-shared key that has to match on both ends.

The tunnel-group is associated to your crypto map. The l2l tunnel group that has the pre-shared key is for phase 1 negotiations, and phase 2 is done through your transform-sets and ACLs that are applied to your crypto map:

crypto map VPN 10 set peer

crypto map VPN 10 match address VPN

crypto map VPN 10 set transform-set VPN

tunnel-group ipsec-l2l

tunnel-group ipsec-attributes

pre-shared-key test

access-list VPN permit ip

When a request comes in from for, then the crypto map that's applied to the outside interface runs through it's sequence numbers to find a match. After it sees as the requesting peer, it tries to match up the key with the tunnel-group. If that matches, then it proceeds to the next steps making sure that the same traffic is encrypted on the other side, transform sets match, etc.

The default-group-policy is a "catch-all" that matches anything that doesn't match the "vpn-group-policy" that you have. If you have a user using "vpn-group-policy", but you have other users that aren't locked into a group, then they'd use the default group policy.



HTH, John *** Please rate all useful posts ***
Community Member

Re: Crypto Confusion

Thanks John.

Helped a lot.


Community Member

Re: Crypto Confusion

Additionally, it appears that the documentation you were reading was using the old 6.x code. Tunnel groups were introduced in 7.0

CreatePlease to create content