Cisco ASA 5505 - Manual (Page 1577)

C H A P T E R
73-1
Cisco ASA 5500 Series Configuration Guide using the CLI
73
Configuring LAN-to-LAN IPsec VPNs
A LAN-to-LAN VPN connects networks in different geographic locations.
The ASA supports LAN-to-LAN VPN connections to Cisco or third-party peers when the two peers have
IPv4 inside and outside networks (IPv4 addresses on the inside and outside interfaces).
For LAN-to-LAN connections using mixed IPv4 and IPv6 addressing, or all IPv6 addressing, the
security appliance supports VPN tunnels if both peers are Cisco ASA 5500 series security appliances,
and if both inside networks have matching addressing schemes (both IPv4 or both IPv6).
Specifically, the following topologies are supported when both peers are Cisco ASA 5500 series ASAs:
• The ASAs have IPv4 inside networks and the outside network is IPv6 (IPv4 addresses on the inside
interfaces and IPv6 addresses on the outside interfaces).
• The ASAs have IPv6 inside networks and the outside network is IPv4 (IPv6 addresses on the inside
interface and IPv4 addresses on the outside interfaces).
• The ASAs have IPv6 inside networks and the outside network is IPv6 (IPv6 addresses on the inside
and outside interfaces).
Note The ASA supports LAN-to-LAN IPsec connections with Cisco peers, and with third-party peers that
comply with all relevant standards.
This chapter describes how to build a LAN-to-LAN VPN connection. It includes the following sections:
• Summary of the Configuration, page 73-1
• Configuring Interfaces, page 73-2
• Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface, page 73-3
• Creating an IKEv1 Transform Set, page 73-5
• Creating an IKEv2 Proposal, page 73-6
• Configuring an ACL, page 73-7
• Defining a Tunnel Group, page 73-7
• Creating a Crypto Map and Applying It To an Interface, page 73-9
Summary of the Configuration
This section provides a summary of the example LAN-to-LAN configuration this chapter describes.
Later sections provide step-by-step instructions.