Ensure that the cryptographic algorithms are supported on your device.Ensure all names and policy numbers are unique on your device.Identify the routes for your inside/private and outside/public networks.Specify the interface configuration for both inside and outside interfaces.Replace the placeholder values in the script with the device settings for your configuration.

Other parameters, such as TCP MSS clampingĬomplete the following steps before you use the sample script.

IPsec policy and parameters (phase 2 or quick mode).

IKE policy and parameters (phase 1 or main mode).

The S2S VPN tunnel configuration consists of the following parts: The script provides a sample that is based on the configuration and parameters that are described in the previous sections. Consult your VPN device specifications to verify the algorithms that are supported for your VPN device models and firmware versions.

At the time of publication, ASA models 5505, 5510, 5520, 5540, 5550, and 5580 do not support these algorithms. This support requirement applies to newer ASA devices. Support for IPsec Encryption with AES-GCM and IPsec Integrity with SHA-256, SHA-384, or SHA-512, requires ASA version 9.x. Support for DH Group and PFS Group beyond Group 5 requires ASA version 9.x. Support for IKEv2 requires ASA version 8.4 and later. * On some devices, IPsec Integrity must be a null value when the IPsec Encryption algorithm is AES-GCM. The following table lists the IPsec/IKE algorithms and parameters that are used in the sample. This section lists the parameters for the sample. Virtual network and VPN gateway information You can optionally configure the BGP across the VPN tunnel.įor step-by-step instructions to build the Azure configurations, see Single VPN tunnel setup. This configuration consists of a single S2S VPN tunnel between an Azure VPN gateway and an on-premises VPN device. If you specify an exact combination of algorithms and key strengths, be sure to use the corresponding specifications on your VPN devices. You can optionally specify an exact combination of cryptographic algorithms and key strengths for a specific connection, as described in About cryptographic requirements.

Reset cisco 5505 asa