Setting up VPN between F5 LTM & ASA
Download as PPTX, PDF0 likes274 views
This document provides steps to configure a site-to-site VPN tunnel between an F5 LTM and a Cisco ASA. It outlines 4 steps: 1) define IKE Phase 1 parameters, 2) define IKE Phase 2 security policy, 3) define crypto ACLs for tunnel traffic, and 4) configure a layer 3 forwarding virtual server. It also provides configuration details and commands to monitor and troubleshoot the VPN tunnel.
Setting up VPN between F5 LTM & ASA
- 1. Site to site VPN Tunnel F5 LTM & Cisco ASA By Dhruv Sharma 5/3/2020 1
- 2. Steps to achieve the task • Step 1: Define IKE Phase 1 parameters. • Step 2: Define IKE Phase 2 Security Policy. • Step 3: Define interesting traffic / Crypto ACL for the Tunnel. • Step 4: Configure Layer 3 forward virtual Server for the Tunnel. 5/3/2020 2
- 4. • Phase 1 Parameters 5/3/2020 4
- 5. Step 1: IKE Phase1 • Configure settings as shown 5/3/2020 5
- 6. • IKE Phase 2 parameters 5/3/2020 6
- 7. Step 2: IKE Phase 2 Parameters • IKE Phase 2 Parameter 5/3/2020 7
- 8. Step 3: Crypto ACL • Configure Crypto ACL 5/3/2020 8
- 9. Step 4: Create IP forwarding Virtual Server • For IPsec, you create a forwarding virtual server to intercept IP traffic and direct it over the tunnel. This force F5 to work like a router. We could have provided local crypto ACL subnets as well. • 5/3/2020 9
- 10. • VPN configuration on ASA 5/3/2020 10
- 11. Configuration on ASA • Refer below embedded configuration of ASA for reference. 5/3/2020 11
- 12. • Monitor Traffic 5/3/2020 12
- 13. Monitor Traffic • Run below commands: tmsh modify net ipsec ike-daemon ikedaemon log-level info Refer below link for more details: https://techdocs.f5.com/kb/en-us/products/big- ip_ltm/manuals/product/bigip-tmos-tunnels-ipsec-12-1-0/7.html 5/3/2020 13
- 14. Monitor Traffic • To troubleshoot your IPSec tunnel, from a Big-IP terminal: tail -f /var/log/racoon.log • To confirm your IPSec tunnel status on a Big-IP: racoonctl -ll show-sa isakmp racoonctl -ll show-sa ipsec tmsh show net ipsec ipsec-sa all-properties 5/3/2020 14