Cisco ASA Series User Manual

CHAPTER
1-1
Cisco ASA Series CLI Configuration Guide
1
Configuring LAN-to-LAN IPsec VPNs
A LAN-to-LAN VPN connects networks in different geographic locations.
The ASA supports LAN-to-LAN VPN connections to Cisco or third-party peers when the two peers have
IPv4 inside and outside networks (IPv4 addresses on the inside and outside interfaces).
For LAN-to-LAN connections using mixed IPv4 and IPv6 addressing, or all IPv6 addressing, the
security appliance supports VPN tunnels if both peers are ASA 5500 series adaptive security appliances,
and if both inside networks have matching addressing schemes (both IPv4 or both IPv6).
Specifically, the following topologies are supported when both peers are ASA 5500 series:
• The ASAs have IPv4 inside networks and the outside network is IPv6 (IPv4 addresses on the inside
interfaces and IPv6 addresses on the outside interfaces).
• The ASAs have IPv6 inside networks and the outside network is IPv4 (IPv6 addresses on the inside
interface and IPv4 addresses on the outside interfaces).
• The ASAs have IPv6 inside networks and the outside network is IPv6 (IPv6 addresses on the inside
and outside interfaces).
Note The ASA supports LAN-to-LAN IPsec connections with Cisco peers, and with third-party peers that
comply with all relevant standards.
This chapter describes how to build a LAN-to-LAN VPN connection. It includes the following sections:
• Summary of the Configuration, page 1-2
• Configuring Site-to-Site VPN in Multi-Context Mode, page 1-2
• Configuring Interfaces, page 1-3
• Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface, page 1-4
• Creating an IKEv1 Transform Set, page 1-6
• Creating an IKEv2 Proposal, page 1-7
• Configuring an ACL, page 1-7
• Defining a Tunnel Group, page 1-8
• Creating a Crypto Map and Applying It To an Interface, page 1-9

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English