Cisco 5510 - ASA SSL / IPsec VPN Edition User Manual

1-27
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring IPsec
The tables that follow combine the IP addresses shown in Figure 1-3 to the concepts shown in Table 1-4.
The real ACEs shown in these tables ensure that all IPsec packets under evaluation within this network
receive the proper IPsec settings.
You can apply the same reasoning shown in the example network to use cascading ACLs to assign
different security settings to different hosts or subnets protected by a ASA.
Note By default, the ASA does not support IPsec traffic destined for the same interface from which it enters.
Names for this type of traffic include U-turn, hub-and-spoke, and hairpinning. However, you can
configure IPsec to support U-turn traffic by inserting an ACE to permit traffic to and from the network.
For example, to support U-turn traffic on Security Appliance B, add a conceptual “permit B B” ACE to
ACL1. The actual ACE would be as follows:
permit 192.168.12.0 255.255.255.248 192.168.12.0 255.255.255.248
Managing Public Key Infrastructure (PKI) Keys
You must set public key infrastructure (PKI) in order for an administrator to choose the Suite B ECDSA
algorithms when generating or zeroing a keypair:
Prerequisites
If you are configuring a cryptography map to use an RSA or ECDSA trustpoint for authentication, you
must first generate the key set. You can then create the trustpoint and reference it in the tunnel group
configuration.
Restrictions
The 4096-bit RSA keys are only supported on the 5580, 5585, or later platforms.
Table 1-5 Example Permit and Deny Statements for Security Appliance A
Security
Appliance
Crypto Map
Sequence
No. ACE Pattern Real ACEs
A 1 deny A.3 B deny 192.168.3.3 255.255.255.192 192.168.12.0 255.255.255.248
deny A.3 C deny 192.168.3.3 255.255.255.192 192.168.201.0 255.255.255.224
permit A B permit 192.168.3.0 255.255.255.192 192.168.12.0 255.255.255.248
permit A C permit 192.168.3.0 255.255.255.192 192.168.201.0 255.255.255.224
2 permit A.3 B permit 192.168.3.3 255.255.255.192 192.168.12.0 255.255.255.248
permit A.3 C permit 192.168.3.3 255.255.255.192 192.168.201.0 255.255.255.224
B None needed permit B A permit 192.168.12.0 255.255.255.248 192.168.3.0 255.255.255.192
permit B C permit 192.168.12.0 255.255.255.248 192.168.201.0 255.255.255.224
C None needed permit C A permit 192.168.201.0 255.255.255.224 192.168.3.0 255.255.255.192
permit C B permit 192.168.201.0 255.255.255.224 192.168.12.0 255.255.255.248

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English