Docs

VPN Connet

Manual configuration

Configuring Cisco firewall

Scenarios

In the scenario that the Cisco firewall is applying to your local data center, after configuring the cloud VPN gateway, customer gateway, and IPsec-VPN connection, you also need to configure the VPN connection on the Cisco firewall.

warning

Commands in the article are examples. Adapt them to your specific environment. For more information on Cisco firewall configurations, consult third-party vendors. This article offers a general guide only.

Prerequisites

You have completed procedures for creating a VPN gateway, creating a customer gateway, creating an IPsec-VPN connection, and adding a VPN gateway route.

Argument configuration

Virtual Private Cloud (VPC): The CIDR block is 192.168.2.0/24, and the Elastic IP Address (EIP) of the VPN gateway is 22.XX.XX.10.

Data center: The private CIDR block is 10.1.1.0/24, and the static EIP of the gateway device is 122.XX.XX.64.

The EIP of a VPN gateway is automatically assigned when the VPN gateway is created. It serves as the egress IP address of the VPN gateway. Unlike separately purchased EIP instances, the EIP cannot be independently owned, and shares the same lifetime as the VPN gateway.

IKEv1 version

IPsec argument configuration

IPsec-VPN connection

Pre-Shared Key: test@1234

IKE Config

Strategy
Value
Authentication algorithm
sha256
Encryption algorithm
aes192
DH algorithm
group14
Negotiation
main
Version
ikev1
Lifecycle
86400

IPsec Config

Strategy	Value
Authentication algorithm	sha256
Encryption algorithm	aes192
DH algorithm	group14 tip If the on-premises firewall does not support the PFS feature or has no Diffie-Hellman (DH) algorithm configured, set the value to disable.
lifecycle	86400

Procedure

Run an SSH command to log in to the configuration interface of the on-premises Cisco firewall.

ssh -p admin@110.XX.XX.32 #Use the SSH command to log in to Cisco firewall.
User Access Verification #Input username and password to enter user mode.
Username: admin
Password: *** #The password is encrypted in this example. Enter your own password during operation.
Type help or '?' for a list of available commands.

Enter the global configuration mode of Cisco firewall.

ASA>
ASA> en
Password: #Input enable and its password to enter privileged mode, where you can only view settings.
ASA #conf t
ASA(config)# #Input config ter to enter global mode, where you can configure firewall.

Configure a firewall interface for the VPC in global configuration mode.

interface GigabitEthernet0/0
nameif outside #Define the secure domain name for the port.
security-level 0 #Define the security level for the port.
ip address 122.XX.XX.64 255.255.255.255 #Input the public IP address of the on-premises data center.

Configure isakmp policy.

crypto ikev1 policy 1 #Set IKEv1 Phase 1 proposal number to 1 (range: 1–65535; lower number = higher priority).
authentication pre-share #Set the authentication method to Pre-Shared Key.
encryption aes #Set Phase 1 encryption algorithm to aes.
hash sha #Set the IKE authentication algorithm to sha.
group 14 #Set the IKE DH group to group 14。
lifetime 86400 #Set the IKE lifetime to 86,400 seconds.

Configure the pre-shared key for establishing the IPsec-VPN connection.

crypto isakmp key test@1234 address 22.XX.XX.10 #Enter the pre-shared key, which must match the pre-shared key used to create the IPsec-VPN connection. 22.XX.XX.10 is the public IP address of the VPN gateway.

Configure the IPsec protocol.

crypto ipsec transform-set ipsecpro64 esp-aes esp-sha-hmac mode tunnel #Set the encryption algorithm and authentication algorithm for IPsec phase 2 negotiation.

Configure an ACL policy.

access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.2.0 0.0.0.255 # Configure ACL policy to capture data flows in the VPN tunnel. If the local gateway device has multiple network segments, you need to add an ACL policy for each segment separately.

Configure the IPsec policy.

crypto map ipsecpro64 10 ipsec-isakmp
set peer 22.XX.XX.10 #Set the cloud gateway IP — use the VPN Gateway's EIP.
set transform-set ipsecpro64 #Set the encryption map entry to use IKEv1.
set pfs group14 #Set the DH group for the IPsec policy.
match address 100 #Reference the traffic captured by the ACL.

Start the IPsec policy.

interface g0/0
crypto map ipsecpro64

Configure a static route.

ip route 192.168.2.0 255.255.255.0 22.XX.XX.10

Test the connectivity between the VPC and the on-premises data center.

Log in to the ECS in the VPC associated with the VPN gateway, and execute the ping command. If the IP address of the local data center can be pinged, it indicates that the IPsec communication tunnel is established.

IKEv2

IPsec argument configuration

IPsec-VPN connection

Pre-Shared Key: test@1234

NAT traversal: On

IKE Config

Strategy
Value
Authentication algorithm
sha256
Encryption algorithm
aes256
DH algorithm
group14
Negotiation
main
Version
ikev2
Lifecycle
86400

IPsec Config

Strategy	Value
Authentication algorithm	sha256
Encryption algorithm	aes
DH algorithm	group14 tip If the on-premises firewall does not support the PFS feature or has no Diffie-Hellman (DH) algorithm configured, set the value to disable.
Lifecycle	86400

Procedure

Follow steps 1 to 3 in the above IKEv1 Version procedures to log in to the local Cisco firewall configuration interface.

Configure arguments in IKE Phase 1.

crypto ikev2 proposal daemon
integrity sha256 #Set authentication algorithm for IKE policy to sha256.
encryption aes-cbc-192 #Set encryption algorithm for Phase 1 negotiation to aes192.
group 14 #Set DH algorithm for IKE policy to group 14.
lifetime 86400 #Set lifecycle to 86400s.

Configure an IKEv2 policy.

crypto ikev2 policy ipsecpro64_v2 #Set IKEv2 policy.
proposal daemon #Apply proposal.

Configure the Pre-Shared Key.

crypto ikev2 keyring ipsecpro64_v2
peer vpngw
address 22.XX.XX.10
pre-shared-key 0 test@1234 #Input the pre-shared key. It must match the PSK configured when creating the IPsec connection.

Configure the identity authentication information.

crypto ikev2 profile ipsecpro64_v2
match identity remote address 22.XX.XX.10 255.255.255.255 #Cloud gateway IP — use the VPN Gateway's EIP.
identity local address 10.1.1.1 #Input the IP address of local gateway.
authentication remote pre-share
authentication local pre-share
keyring local ipsecpro64_v2

Configure the IPsec Protocol.

crypto ipsec transform-set ipsecpro64_v2 esp-aes esp-sha-hmac mode tunnel #Set the encryption algorithm and authentication algorithm for IPsec Phase 2 negotiation.

Configure an ACL policy.

access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.2.0 0.0.0.255 #Configure ACL policy to capture data flows of VPN tunnels. If the local gateway device has multiple network segments, you need to add ACL policies for each segment separately.

Configure the IPsec policy.

crypto map ipsecpro64_v2 10 ipsec-isakmp
set peer 22.XX.XX.10 #The IP address of the cloud gateway to which IPsec-protected traffic is forwarded. In this case, use the public IP address of the VPN Gateway.
set transform-set ipsecpro64_v2 #Set the encryption mapping entry to use the IKEv2 protocol.
set pfs group14 #Set DH group for IPsec policy.
match address 100 #Reference the traffic captured by the ACL.

Start the IPsec policy.

interface g0/0
crypto map ipsecpro64_v2

Configure a static route.

ip route 192.168.2.0 255.255.255.0 22.XX.XX.10

Test the connectivity between the VPC and the on-premises data center.

Log in to the ECS in the VPC associated with the VPN gateway, and execute the ping command. If the IP address of the local data center can be pinged, it indicates that the IPsec communication tunnel is established.

Last updated: 2026.07.17 11:00:34