Home / server / Questions / 820396
In Process
Mike
Asked: 2016-12-14 03:26:56 +0800 CST

Cisco IPsec VPN with key-id on a specific tunnel only

  • 772

I'm trying to work with another party to set up a site-to-site IPsec VPN between us and them. We are behind NAT, so need their Cisco (ASA 5510 on IOS 9.1.7) to match on our IKE id (key-id in Cisco parlance). The problem is the other party has said that they can only enable key-id on a global level, not on a tunnel-level, so they aren't able to do so due to impacting other VPNs.

Is this correct, key-id matching is an all or nothing thing? If enabled it's used for all tunnels, not just the ones that require it? The only literature I've found on it is from Cisco itself and does seem to imply a global scope, but I'm not an expert in Cisco config hence this question.

To change the peer identification method, enter the following command:

crypto isakmp identity {address | hostname | key-id id-string | auto}

Are there any other alternatives to get an IPsec tunnel correctly matching when we are NAT'd? We are restricted to IPsec and IKEv1 using PSK. Certificates aren't an option unfortunately.

vpn site-to-site-vpn cisco nat ipsec

1 Answers

  1. In the documentation you provided it states the following:

    "The security appliance uses the Phase I ID to send to the peer. This is true for all VPN scenarios except LAN-to-LAN connections in main mode that authenticate with preshared keys."

    Rather than authenticating with the Key ID, I would use Pre-Shared-Keys. Replace x.x.x.x with your globally known IP. z.z.z.z would be their globally known address.

    The remote ASA Code would look something like this:

    tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
 ikev1 pre-shared-key 0 secretp@ssw0rd

    If you have a Cisco IOS Router, your code may looks something like this:

    crypto isakmp key 0 secretp@ssw0rd address z.z.z.z

    key 0 or pre-shared-key 0 denotes that the following PSK is unencypted. It is not a unique value that must be the same on both sides of the tunnel.

    • 1