! PermitANY — Cisco ASA Site-to-Site VPN (IPsec IKEv2)
! Site-to-site IPsec VPN configuration between two Cisco ASA firewalls using IKEv2 — the modern, more secure replacement for IKEv1.
! Generated: 2026-09-21
! These are EXAMPLE values. Replace with your actual config before deploying.
!
! ── IKEv2 Policy ──────────────────────────────────────
crypto ikev2 policy 10
 encryption aes-256
 integrity sha-256
 group 14
 prf sha-256
 lifetime seconds 86400
!
crypto ikev2 enable outside
!
! ── IPsec Proposal ───────────────────────────────────
crypto ipsec ikev2 ipsec-proposal PROP-VPN-TO-BRANCH-01
 protocol esp encryption aes-256
 protocol esp integrity sha-256
!
! ── Tunnel Group (peer settings) ─────────────────────
tunnel-group 198.51.100.1 type ipsec-l2l
tunnel-group 198.51.100.1 ipsec-attributes
 ikev2 remote-authentication pre-shared-key VpnK3y!Secure#2024
 ikev2 local-authentication pre-shared-key VpnK3y!Secure#2024
!
! ── Crypto Map ───────────────────────────────────────
access-list ACL-VPN-VPN-TO-BRANCH-01 extended permit ip 10.1.0.0 255.255.255.0 10.2.0.0 255.255.255.0
!
crypto map CMAP 10 match address ACL-VPN-VPN-TO-BRANCH-01
crypto map CMAP 10 set peer 198.51.100.1
crypto map CMAP 10 set ikev2 ipsec-proposal PROP-VPN-TO-BRANCH-01
crypto map CMAP 10 set pfs group14
crypto map CMAP interface outside
!

! ── NAT Exemption ────────────────────────────────────
object network LOCAL_NET
 subnet 10.1.0.0 255.255.255.0
object network REMOTE_NET
 subnet 10.2.0.0 255.255.255.0
nat (inside,outside) 1 source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET no-proxy-arp

!