Cisco ASA Site-to-Site VPN (IPsec IKEv2)

Cisco ASAIntermediate

Site-to-site IPsec VPN configuration between two Cisco ASA firewalls using IKEv2 — the modern, more secure replacement for IKEv1.

↓ example.txt

What is it?

A site-to-site IPsec VPN creates an encrypted tunnel between two locations — for example, headquarters and a branch office. All traffic between the two sites flows through the tunnel, encrypted and protected from interception. IKEv2 (Internet Key Exchange version 2) is the modern standard — it's faster to negotiate, more resilient to network interruptions, and more secure than IKEv1. The ASA handles both the IKEv2 negotiation (Phase 1) and the IPsec data encryption (Phase 2) automatically.

✓ When to use

·Connecting branch offices to headquarters over the internet
·Securing communication between a cloud environment (AWS, Azure) and your on-premises network
·Replacing expensive MPLS circuits with internet + VPN for WAN connectivity
·Connecting partner networks with specific traffic requirements

✗ When NOT to use

·Remote users working from home — use AnyConnect (SSL VPN) instead
·When latency is critical and you have budget — MPLS provides guaranteed QoS that VPN cannot
·When both sites use dynamic public IPs — consider DMVPN on IOS instead

How it compares

vs IKEv1IKEv1 is older and requires more round trips to establish. IKEv2 is faster, more secure, and supports MOBIKE (handles IP changes without reconnecting). Always prefer IKEv2 for new deployments.

vs AnyConnect (SSL VPN)AnyConnect is for individual remote users connecting from a laptop. Site-to-site IPsec is for connecting entire networks. Use both: IPsec for office-to-office, AnyConnect for work-from-home.

vs DMVPN (on IOS)DMVPN scales better for many branches — spokes can talk directly without going through hub. ASA site-to-site is simpler for small numbers of tunnels (2-10 sites).

Prerequisites

→Both ASA firewalls must have static public IP addresses (or use dynamic crypto maps for dynamic IPs)
→Both sides must agree on the same IKEv2 policy parameters (encryption, integrity, DH group)
→NAT exemption must be configured if the ASA is also doing NAT — otherwise VPN traffic gets NATted before the crypto ACL matches
→The outside interface must allow UDP 500 and UDP 4500 inbound from the peer IP
→Both sites must have non-overlapping internal IP ranges

Config Generator

Outside Interface *

Local Public IP *

Remote Peer Public IP *

Pre-Shared Key *

Local Network *

Remote Network *

Tunnel Group Name *

Use a descriptive name for the remote site

IKE Encryption

IKE Integrity

ESP Encryption

Add NAT exemption?

Prevents the ASA from NATting VPN traffic

Verification commands

show crypto ikev2 sa

Verify IKEv2 Phase 1 (IKE SA) is established

Expected: Should show the peer IP with state 'READY'. If empty, Phase 1 failed.

show crypto ipsec sa

Verify IPsec Phase 2 (data tunnel) is established and passing traffic

Expected: Shows encaps/decaps counters — these should be incrementing if traffic is flowing. Check 'pkts encrypt' and 'pkts decrypt'.

show vpn-sessiondb l2l

Show active site-to-site VPN sessions with bytes transferred

Expected: Lists active tunnels with remote IP, protocol, and data counters

Debug commands

debug crypto ikev2 protocol 255

Debug IKEv2 negotiation — shows Phase 1 exchange step by step

⚠ Very verbose. Capture output quickly and run 'no debug all' immediately after. Do not use in production during business hours.

debug crypto ipsec 255

Debug IPsec Phase 2 negotiation

⚠ Verbose. Use 'no debug all' after.

Common mistakes & fixes

⚡ VPN tunnel not coming up — 'show crypto ikev2 sa' is empty

Cause: Phase 1 mismatch: encryption, integrity, DH group, or pre-shared key doesn't match on both sides

Fix: Verify both sides have identical IKEv2 policy (encryption, integrity, group, prf). Verify pre-shared key matches exactly (case-sensitive). Check UDP 500/4500 is not blocked.

⚡ Phase 1 up but Phase 2 fails

Cause: Crypto ACL mismatch — the interesting traffic ACL doesn't match on both sides (must be mirror images)

Fix: Local ACL: permit ip LOCAL_NET REMOTE_NET. Remote ACL must be: permit ip REMOTE_NET LOCAL_NET. They must be exact mirror images.

⚡ Tunnel is up but no traffic flows

Cause: NAT exemption missing — ASA is translating VPN traffic before it hits the crypto ACL

Fix: Add a NAT exemption rule: 'nat (inside,outside) source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET no-proxy-arp'. Move it above the PAT rule in the NAT table.

⚡ Tunnel drops and reconnects frequently

Cause: Lifetime mismatch causing constant renegotiation, or DPD (Dead Peer Detection) triggering on an unreliable link

Fix: Match lifetime on both sides. Check 'show crypto ipsec sa' for expired SAs. Consider increasing DPD interval if the link is flaky.