Cisco ASA Series Cli Configuration Manual page 1804

Defining a Tunnel Group
The ACLs that you configure for this LAN-to-LAN VPN control connections are based on the source
and translated destination IP addresses. Configure ACLs that mirror each other on both sides of the
connection.
An ACL for VPN traffic uses the translated address.
To configure an ACL, perform the following steps:
Step 1
Enter the access-list extended command. The following example configures an ACL named l2l_list that
lets traffic from IP addresses in the 192.168.0.0 network travel to the 150.150.0.0 network. The syntax
is access-list listname extended permit ip source-ipaddress source-netmask destination-ipaddress
destination-netmask.
hostname(config)# access-list l2l_list extended permit ip 192.168.0.0 255.255.0.0
150.150.0.0 255.255.0.0
hostname(config)#
Step 2
Configure an ACL for the ASA on the other side of the connection that mirrors the ACL. In the following
example, the prompt for the peer is hostname2.
hostname2(config)# access-list l2l_list extended permit ip 150.150.0.0 255.255.0.0
192.168.0.0 255.255.0.0
hostname(config)#
Defining a Tunnel Group
A tunnel group is a set of records that contain tunnel connection policies. You configure a tunnel group
to identify AAA servers, specify connection parameters, and define a default group policy. The ASA
stores tunnel groups internally.
There are two default tunnel groups in the ASA: DefaultRAGroup, which is the default IPsec
remote-access tunnel group, and DefaultL2Lgroup, which is the default IPsec LAN-to-LAN tunnel
group. You can modify them but not delete them.
The main difference between IKE versions 1 and 2 lies in terms of the authentication method they allow.
IKEv1 allows only one type of authentication at both VPN ends (that is, either pre-shared key or
certificate). However, IKEv2 allows assymetric authentication methods to be configured (that is,
pre-shared key authentication for the originator but certificate authentication for the responder) using
separate local and remote authentication CLIs. Therefore, with IKEv2 you have assymmetric
authentication where one side authenticates with one credential whereas the other side uses another
credential (either pre-shared key or certificate).
You can also create one or more new tunnel groups to suit your environment. The ASA uses these groups
to configure default tunnel parameters for remote access and LAN-to-LAN tunnel groups when there is
no specific tunnel group identified during tunnel negotiation.
To establish a basic LAN-to-LAN connection, you must set two attributes for a tunnel group:
•
•
Note
To use VPNs, including tunnel groups, the ASA must be in single-routed mode. The commands to
configure tunnel-group parameters do not appear in any other mode.
Cisco ASA Series CLI Configuration Guide
1-8
Set the connection type to IPsec LAN-to-LAN.
Configure an authentication method for the IP, in the following example, preshared key for IKEv1
and IKEv2.
Chapter 1 Configuring LAN-to-LAN IPsec VPNs