DocsICP FilingConsole
Documentation
Home Page VPN Gateway IPsec-VPN Configure on-premises devices Cisco firewall configuration

Cisco firewall configuration

Updated at:
Copy as MD
Product
My Favorites

After you configure a VPN gateway in Alibaba Cloud, you must add the VPN configuration to your on-premises gateway device to establish an IPsec-VPN connection between your data center and the Alibaba Cloud VPC. This topic describes how to add a VPN configuration to a Cisco firewall.

Scenario

image

This topic uses the scenario in the preceding figure as an example. A company has a VPC on Alibaba Cloud with the CIDR block 10.0.0.0/16 that hosts applications on ECS instances. The company also has an on-premises data center with the CIDR block 192.168.0.0/16. The company plans to establish an IPsec-VPN connection between the data center and the VPC to enable communication between them.

Important

In this scenario, a Cisco firewall in the data center uses two public IP addresses to establish a dual-tunnel IPsec-VPN connection to Alibaba Cloud. If your VPN Gateway instance supports only IPsec-VPN connections in single-tunnel mode, see the Single-tunnel mode configuration section at the end of this topic.

We recommend that you Upgrade VPN Gateway to dual-tunnel mode. IPsec-VPN connections in dual-tunnel mode support zone-level disaster recovery, improving network high availability.

CIDR block plan and sample VPN configurations

CIDR block plan

Resource

CIDR block

IP address

Data center

CIDR block for communication with the VPC: 192.168.0.0/16

Server IP address: 192.168.50.198

Cisco firewall

N/A

Physical interfaces on the Cisco firewall that connect to the Internet:

  • GigabitEthernet0/0: Configured with a public IP address (for example, 121.XX.XX.211).

  • GigabitEthernet0/2: Configured with a public IP address (for example, 121.XX.XX.77).

  • GigabitEthernet0/1: This interface connects to the data center and is configured with the IP address 192.168.50.217.

VPC

Primary CIDR block: 10.0.0.0/16

vSwitch 1: 10.0.10.0/24

vSwitch 2: 10.0.20.0/24

ECS instance IP address: 10.0.10.33

VPN Gateway instance (public network type)

N/A

  • IPsec address 1: 39.XX.XX.218

  • IPsec address 2: 182.XX.XX.19

Note

After you create a VPN Gateway instance, the system automatically assigns IP addresses to it.

BGP CIDR block plan

This topic describes how to configure a Cisco firewall for an IPsec-VPN connection using either static routes or BGP dynamic routing. If you do not plan to use BGP dynamic routing, skip this section. The following table shows the BGP CIDR block plan for this example.

Resource

Tunnel

BGP tunnel CIDR block

BGP IP address

BGP local ASN

VPN Gateway instance

Tunnel 1

169.254.10.0/30

Note

For a VPN Gateway instance, each tunnel must have a unique CIDR block.

169.254.10.1

65530

Tunnel 2

169.254.20.0/30

169.254.20.1

Cisco firewall

Tunnel 1

169.254.10.0/30

169.254.10.2

65000

Tunnel 2

169.254.20.0/30

169.254.20.2

Sample VPN configurations

  • In this example, Tunnel 1 (the active tunnel) and Tunnel 2 (the standby tunnel) use the same sample values.

  • For each tunnel, the VPN configurations on Alibaba Cloud and the Cisco firewall must match.

Parameter

Alibaba Cloud value

Cisco firewall value

Pre-shared key

123456****

123456****

IKE configuration

IKE version

ikev2

ikev2

Negotiation mode

main

main

Encryption algorithm

aes

aes

Authentication algorithm

sha1

sha1

Diffie-Hellman (DH) group

group14

group14

Security association (SA) lifetime (seconds)

86400

86400

IPsec configuration

Encryption algorithm

aes

aes

Authentication algorithm

sha1

sha1

Diffie-Hellman (DH) group

group14

group14

Security association (SA) lifetime (seconds)

86400

86400

Configuration

Note

  • This topic uses Cisco ASA software version 9.19.1 as a configuration example. The configuration commands may vary among software versions. During operations, query the corresponding documentation or consult the relevant vendor based on your actual environment.

  • In the following scenarios, we recommend that you use Destination Routing mode - static route or Destination Routing mode - BGP dynamic routing.

Destination-based routing - static

Prerequisites

This topic explains how to configure a Cisco firewall for a VPN connection. It does not cover configurations on the Alibaba Cloud side. Before you begin, ensure that you have created a VPN Gateway instance, a customer gateway, an IPsec-VPN connection, and configured routes for the VPN Gateway. See Standard VPN Gateway quick start.

Procedure

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    This example assumes the Cisco firewall interfaces are already configured and enabled. The following code shows an example interface configuration.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    #Public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #Interface connected to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security-level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 121.XX.XX.77 255.255.255.255    #Public IP address configured for the GigabitEthernet0/2 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 182.XX.XX.19 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        #Configure a route to the on-premises data center.

  3. Enable IKEv2 on the public interfaces.

    crypto ikev2 enable outside1
crypto ikev2 enable outside2

  4. Create an IKEv2 Policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

  5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

  6. Create tunnel groups and specify the pre-shared key for each tunnel. The pre-shared keys must match those on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 1.
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key 123456****  #Specify the remote pre-shared key for Tunnel 1, which is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   #Specify the local pre-shared key for Tunnel 1, which must match the key on the Alibaba Cloud side.
!
tunnel-group 182.XX.XX.19 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 2.
tunnel-group 182.XX.XX.19 ipsec-attributes
 ikev2 remote-authentication pre-shared-key 123456****  #Specify the remote pre-shared key for Tunnel 2, which is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   #Specify the local pre-shared key for Tunnel 2, which must match the key on the Alibaba Cloud side.
!

  7. Create the tunnel interfaces.

    interface Tunnel1                                  #Create the interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside1                  #Set the source for Tunnel 1 to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   #Set the destination for Tunnel 1 to the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create the interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.20.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside2                  #Set the source for Tunnel 2 to the public interface GigabitEthernet0/2.
 tunnel destination 182.XX.XX.19                   #Set the destination for Tunnel 2 to the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

  8. Check the status of the IPsec-VPN connection.

    You can run the show ipsec sa command to view the SAs that have been successfully negotiated.

    ciscoasa# show ipsec sa
interface: aliyun1
    Crypto map tag: __vti-crypto-map-Tunnel1-0-1, seq num: 65280, local addr: 192.___.179

      Protected vrf (ivrf): Global
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      current_peer: 39.**.**.218


      #pkts encaps: 140, #pkts encrypt: 140, #pkts digest: 140
      #pkts decaps: 138, #pkts decrypt: 138, #pkts verify: 138
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 140, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: **.**.**.**/4500, remote crypto endpt.: 39.**.**.218/4500
      path mtu 1500, ipsec overhead 82(52), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 245B612E
      current inbound spi : 8A55D2EA
      
    inbound esp sas:
      spi: 0x8A55D2EA (2320880362)
         SA State: active
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv2, VTI, }
         slot: 0, conn_id: 56, crypto-map: __vti-crypto-map-Tunnel1-0-1
         sa timing: remaining key lifetime (kB/sec): (4147191/28152)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x245B612E (609968430)
         SA State: active
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv2, VTI, }
         slot: 0, conn_id: 56, crypto-map: __vti-crypto-map-Tunnel1-0-1
         sa timing: remaining key lifetime (kB/sec): (4285431/28152)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

    More query commands

    IPsec SA negotiation

    show crypto isakmp sa #View control plane SA information (legacy command).
show crypto ikev2 sa  #View control plane Phase 1 and Phase 2 SAs, role, and protected data flow information.
show crypto ipsec sa peer XX.XX.XX.XX   #Query detailed information about the SA for a specific peer.
show ipsec sa         #View forwarding plane information, such as Phase 1 and Phase 2 SAs, role, protected data flow, and traffic statistics.

    VPN traffic statistics

    show crypto ikev2 stats     #View statistics for protocol packets, encrypted packets, and abnormal packets.
show crypto protocol statistics all #View statistics for protocol packets and encrypted packets.
show ipsec stats            #View IPsec statistics.

  9. Configure static routes to the Alibaba Cloud VPC (10.0.0.0/16).

    route ALIYUN1 10.0.0.0 255.255.0.0 39.XX.XX.218 4  #Configure a high-priority route to the VPC through Tunnel 1.
route ALIYUN2 10.0.0.0 255.255.0.0 182.XX.XX.19 5  #Configure a low-priority route to the VPC through Tunnel 2.

  10. In your on-premises data center, configure routes between clients and the Cisco firewall.

    Test the network connectivity between your on-premises data center and the Alibaba Cloud VPC. See Test connectivity.

Destination-based routing - BGP

Prerequisites

This topic explains how to configure a Cisco firewall for a VPN connection. It does not cover configurations on the Alibaba Cloud side. Before you begin, ensure you have created a VPN Gateway instance, a customer gateway, an IPsec-VPN connection, and enabled BGP. See Dual-tunnel mode with BGP.

Procedure

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    This example assumes the Cisco firewall interfaces are already configured and enabled. The following code shows an example interface configuration.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    #Public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #Interface connected to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security-level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 121.XX.XX.77 255.255.255.255    #Public IP address configured for the GigabitEthernet0/2 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 182.XX.XX.19 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        #Configure a route to the on-premises data center.

  3. Enable IKEv2 on the public interfaces.

    crypto ikev2 enable outside1
crypto ikev2 enable outside2

  4. Create an IKEv2 Policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

  5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

  6. Create tunnel groups and specify the pre-shared key for each tunnel. The pre-shared keys must match those on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 1.
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key 123456****  #Specify the remote pre-shared key for Tunnel 1, which is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   #Specify the local pre-shared key for Tunnel 1, which must match the key on the Alibaba Cloud side.
!
tunnel-group 182.XX.XX.19 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 2.
tunnel-group 182.XX.XX.19 ipsec-attributes
 ikev2 remote-authentication pre-shared-key 123456****  #Specify the remote pre-shared key for Tunnel 2, which is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   #Specify the local pre-shared key for Tunnel 2, which must match the key on the Alibaba Cloud side.
!

  7. Create the tunnel interfaces.

    interface Tunnel1                                  #Create the interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside1                  #Set the source for Tunnel 1 to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   #Set the destination for Tunnel 1 to the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create the interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.20.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside2                  #Set the source for Tunnel 2 to the public interface GigabitEthernet0/2.
 tunnel destination 182.XX.XX.19                   #Set the destination for Tunnel 2 to the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

  8. Check the status of the IPsec-VPN connection.

    You can run the show ipsec sa command to view the SAs that have been successfully negotiated.

    ciscoasa# show ipsec sa
interface: aliyun1
    Crypto map tag: __vti-crypto-map-Tunnel1-0-1, seq num: 65280, local addr: 192.___.179

      Protected vrf (ivrf): Global
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      current_peer: 39.**.**.218


      #pkts encaps: 140, #pkts encrypt: 140, #pkts digest: 140
      #pkts decaps: 138, #pkts decrypt: 138, #pkts verify: 138
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 140, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: **.**.**.**/4500, remote crypto endpt.: 39.**.**.218/4500
      path mtu 1500, ipsec overhead 82(52), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 245B612E
      current inbound spi : 8A55D2EA
      
    inbound esp sas:
      spi: 0x8A55D2EA (2320880362)
         SA State: active
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv2, VTI, }
         slot: 0, conn_id: 56, crypto-map: __vti-crypto-map-Tunnel1-0-1
         sa timing: remaining key lifetime (kB/sec): (4147191/28152)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x245B612E (609968430)
         SA State: active
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv2, VTI, }
         slot: 0, conn_id: 56, crypto-map: __vti-crypto-map-Tunnel1-0-1
         sa timing: remaining key lifetime (kB/sec): (4285431/28152)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

    More query commands

    IPsec SA negotiation

    show crypto isakmp sa #View control plane SA information (legacy command).
show crypto ikev2 sa  #View control plane Phase 1 and Phase 2 SAs, role, and protected data flow information.
show crypto ipsec sa peer XX.XX.XX.XX   #Query detailed information about the SA for a specific peer.
show ipsec sa         #View forwarding plane information, such as Phase 1 and Phase 2 SAs, role, protected data flow, and traffic statistics.

    VPN traffic statistics

    show crypto ikev2 stats     #View statistics for protocol packets, encrypted packets, and abnormal packets.
show crypto protocol statistics all #View statistics for protocol packets and encrypted packets.
show ipsec stats            #View IPsec statistics.

  9. Configure BGP dynamic routing.

    router bgp 65000
 address-family ipv4 unicast
  neighbor 169.254.10.1 remote-as 65530       #Specify the BGP peer, which is the IP address of Tunnel 1 on the Alibaba Cloud side.
  neighbor 169.254.10.1 ebgp-multihop 255
  neighbor 169.254.10.1 activate              #Activate the BGP peer.
  neighbor 169.254.20.1 remote-as 65530       #Specify the BGP peer, which is the IP address of Tunnel 2 on the Alibaba Cloud side.
  neighbor 169.254.20.1 ebgp-multihop 255
  neighbor 169.254.20.1 activate              #Activate the BGP peer.
  network 192.168.0.0 mask 255.255.0.0        #Advertise the CIDR block of the on-premises data center.
 exit-address-family

  10. Check the BGP peer status and BGP routes.

    Enter show bgp summary, show bgp ipv4 unicast, and show route respectively.

    ciscoasa(config)# show bgp summary
BGP router identifier **.**.**.**, local AS number 65000
BGP table version is 46, main routing table version 46
3 network entries using 600 bytes of memory
5 path entries using 400 bytes of memory
3/2 BGP path/bestpath attribute entries using 624 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1648 total bytes of memory
BGP activity 6/3 prefixes, 31/26 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
169.254.10.1    4        65530 1245    1085          46    0    0 03:27:00 2
169.254.20.1    4        65530 733     639           46    0    0 02:01:32 2


ciscoasa(config)# show bgp ipv4 unicast
BGP table version is 46, local router ID is **.**.**.**
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop          Metric LocPrf Weight Path
*  10.0.10.0/24     169.254.20.1         200             0 65530 i
*>                  169.254.10.1         100             0 65530 i
*  10.0.20.0/24     169.254.20.1         200             0 65530 i
*>                  169.254.10.1         100             0 65530 i
*> 192.168.0.0/16   192.168.50.**         0         32768 i


ciscoasa(config)# show route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is not set

B        10.0.10.0 255.255.255.0 [20/100] via 169.254.10.1, 03:33:37
B        10.0.20.0 255.255.255.0 [20/100] via 169.254.10.1, 03:33:37

  11. In your on-premises data center, configure routes between clients and the Cisco firewall.

    Test the network connectivity between your on-premises data center and the Alibaba Cloud VPC. See Test connectivity.

Protected data flow - static routing

Prerequisites

This topic explains how to configure a Cisco firewall for a VPN connection. It does not cover configurations on the Alibaba Cloud side. Before you begin, ensure that you have created a VPN Gateway instance, a customer gateway, and an IPsec-VPN connection. See Standard VPN Gateway quick start, and note the following:

  • When you create an IPsec connection, set the routing mode to Flow Protection, set Local CIDR Block to 10.0.0.0/16, and set Peer CIDR Block to 192.168.0.0/16.

    Important

    If your scenario requires you to specify multiple Local CIDR Block or Peer CIDR Block, we recommend that you use Destination Routing mode - static route or Destination Routing mode - BGP dynamic routing. For more solutions, see Recommended configuration solutions for multiple CIDR blocks.

  • After you create an IPsec connection, you need to Advertise policy-based routes to the VPC route table. You do not need to configure destination routes.

Procedure

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    This example assumes the Cisco firewall interfaces are already configured and enabled. The following code shows an example interface configuration.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    #Public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #Interface connected to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security-level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 121.XX.XX.77 255.255.255.255    #Public IP address configured for the GigabitEthernet0/2 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 182.XX.XX.19 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        #Configure a route to the on-premises data center.

  3. Enable IKEv2 on the public interfaces.

    crypto ikev2 enable outside1
crypto ikev2 enable outside2

  4. Create an IKEv2 Policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

  5. Create an IPsec proposal. Specify the encryption algorithm and authentication algorithm for the IPsec phase on the Cisco firewall. These settings must be the same as those on the Alibaba Cloud side.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The ESP protocol is used. The Alibaba Cloud side uses the ESP protocol by default.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The ESP protocol is used. The Alibaba Cloud side uses the ESP protocol by default.

  6. Define interesting traffic.

    Specify the traffic CIDR blocks that the IPsec-VPN connection is allowed to transmit. This example specifies that the 192.168.0.0/16 CIDR block of the on-premises data center communicates with the 10.0.0.0/16 CIDR block of the Alibaba Cloud VPC.

    access-list acl_tun extended permit ip 192.168.0.0 255.255.0.0 10.0.0.0 255.255.0.0

  7. Create an IPsec policy.

    #Create an IPsec policy for Tunnel 1
crypto map TUNL1 1 match address acl_tun                      #Apply the defined protected data flows.
crypto map TUNL1 1 set pfs group14                            #Specify the DH group.	
crypto map TUNL1 1 set peer 39.XX.XX.218                      #Specify the peer ID, which is Alibaba Cloud IPsec address 1.
crypto map TUNL1 1 set ikev2 ipsec-proposal ALIYUN-PROPOSAL   #Apply the IPsec proposal.
crypto map TUNL1 1 set ikev2 pre-shared-key 0 123456****      #Specify the pre-shared key. It must be the same as the pre-shared key in the tunnel-group command.
crypto map TUNL1 1 set security-association lifetime seconds  86400             #Specify the time-based IPsec SA lifetime.
crypto map TUNL1 1 set security-association lifetime kilobytes unlimited        #Disable the traffic-based IPsec SA lifetime.
crypto map TUNL1 interface outside1                                             #Apply the IPsec policy to the public interface GigabitEthernet0/0.
!
#Create an IPsec policy for Tunnel 2
crypto map TUNL2 1 match address acl_tun                      #Apply the defined protected data flows.
crypto map TUNL2 1 set pfs group14                            #Specify the DH group.	
crypto map TUNL2 1 set peer 182.XX.XX.19                      #Specify the peer ID, which is Alibaba Cloud IPsec address 2.
crypto map TUNL2 1 set ikev2 ipsec-proposal ALIYUN-PROPOSAL   #Apply the IPsec proposal.
crypto map TUNL2 1 set ikev2 pre-shared-key 0 123456****      #Specify the pre-shared key. It must be the same as the pre-shared key in the tunnel-group command.
crypto map TUNL2 1 set security-association lifetime seconds  86400             #Specify the time-based IPsec SA lifetime.
crypto map TUNL2 1 set security-association lifetime kilobytes unlimited        #Disable the traffic-based IPsec SA lifetime.
crypto map TUNL2 interface outside2                                             #Apply the IPsec policy to the public interface GigabitEthernet0/2.

!

  8. Create tunnel groups and specify the pre-shared key for each tunnel. The pre-shared keys must match those on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 1.
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key 123456****  #Specify the remote pre-shared key for Tunnel 1, which is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   #Specify the local pre-shared key for Tunnel 1, which must match the key on the Alibaba Cloud side.
!
tunnel-group 182.XX.XX.19 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 2.
tunnel-group 182.XX.XX.19 ipsec-attributes
 ikev2 remote-authentication pre-shared-key 123456****  #Specify the remote pre-shared key for Tunnel 2, which is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   #Specify the local pre-shared key for Tunnel 2, which must match the key on the Alibaba Cloud side.
!

  9. View the status of the IPsec-VPN connection.

    You can run the following command to view the SAs that have been successfully negotiated.

    ciscoasa(config)# show ipsec sa
interface: outside1
    Crypto map tag: TUNL1, seq num: 1, local addr: **.**.**.**

      access-list acl_tun extended permit ip 192.168.0.0 255.255.0.0 10.0.0.0 255.255.0.0
      Protected vrf (ivrf):
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.0.0.0/255.255.0.0/0/0)
      current_peer: 39.**.**.218


      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 12, #pkts decrypt: 12, #pkts verify: 12
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: **.**.**.**/**, remote crypto endpt.: 39.**.**.218/4500
      path mtu 1500, ipsec overhead 82(52), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: FA64A523
      current inbound spi : EAD36BD6
      
    inbound esp sas:
      spi: 0xEAD36BD6 (3939724246)
         SA State: active
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, PFS Group 14, IKEv2, }
         slot: 0, conn_id: 316, crypto-map: TUNL1
         sa timing: remaining key lifetime (sec): 86382
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00007FFF
    outbound esp sas:
      spi: 0xFA64A523 (4200899875)
         SA State: active
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, PFS Group 14, IKEv2, }
         slot: 0, conn_id: 316, crypto-map: TUNL1
         sa timing: remaining key lifetime (sec): 86382
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

    Click to view more query commands.

    Commands to query IPsec SA negotiation

    show crypto isakmp sa #View control plane negotiated SAs.
show crypto ikev2 sa  #View control plane negotiated Phase 1 and Phase 2 SAs, roles, and protected data flow information.
show crypto ipsec sa peer XX.XX.XX.XX   #Query the detailed information of a specified peer SA.
show ipsec sa         #View basic information about data plane Phase 1 and Phase 2 SAs, roles, protected data flows, SAs, and traffic statistics.

    Commands to query VPN traffic statistics

    show crypto ikev2 stats     #View statistics on protocol packets, encrypted packets, and abnormal packets.
show crypto protocol statistics all #View statistics on protocol packets and encrypted packets.
show ipsec stats            #View IPsec statistics.

  10. Configure a floating static route to the Alibaba Cloud VPC (10.0.0.0/16).

    sla monitor 1                                                  # Define an SLA operation with ID 1.
 type echo protocol ipIcmpEcho 10.0.10.33 interface outside1   # Perform an icmp-echo check between the outside1 interface and the 10.0.10.33 address on the Alibaba Cloud side.
 num-packets 2
 timeout 60
 frequency 5
sla monitor schedule 1 life forever start-time now             #Start SLA 1 immediately and run it permanently.

track 1 rtr 1 reachability                                     #Create Track 1 and bind it to SLA 1 to detect the connectivity between the outside1 interface and the 10.0.10.33 address on the Alibaba Cloud side.

#If the track status for connectivity between the outside1 interface and the 10.0.10.33 address on the Alibaba Cloud side is DOWN, withdraw this route.
#If the track status for connectivity between the outside1 interface and the 10.0.10.33 address on the Alibaba Cloud side is UP, add this route.
route outside1 10.0.0.0 255.255.0.0 39.XX.XX.218 1 track 1     
route outside2 10.0.0.0 255.255.0.0 182.XX.XX.19 5

  11. In your on-premises data center, configure routes between clients and the Cisco firewall.

    Test the network connectivity between your on-premises data center and the Alibaba Cloud VPC. See Test connectivity.

IKEv1

If your Cisco firewall requires IKEv1, use the configurations in this section.

To use these configurations, the corresponding IPsec-VPN connection on Alibaba Cloud must be configured for destination-based routing and IKEv1.

Destination-based routing - static

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    This example assumes the Cisco firewall interfaces are already configured and enabled. The following code shows an example interface configuration.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    #Public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #Interface connected to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security-level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 121.XX.XX.77 255.255.255.255    #Public IP address configured for the GigabitEthernet0/2 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 182.XX.XX.19 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        #Configure a route to the on-premises data center.

  3. Enable IKEv1 on the public interfaces.

    crypto ikev1 enable outside1
crypto ikev1 enable outside2

  4. Create an IKEv1 policy. Specify the authentication method, IKE authentication algorithm, IKE encryption algorithm, DH group, and SA lifetime. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev1 policy 10   
 authentication pre-share   # Specify the authentication method as pre-shared key.
 encryption aes             # Specify the encryption algorithm.
 hash sha                   # Specify the authentication algorithm.
 group 14                   # Specify the DH group.
 lifetime 86400             # Specify the time-based SA lifetime.

  5. Create an IPsec transform set and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev1 transform-set TRANSFORM esp-aes esp-sha-hmac  # Create an IPsec transform set and specify the encryption and authentication algorithms.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev1 transform-set TRANSFORM                               # Apply the created transform set.
 set pfs group14                                                 # Specify the PFS and DH group.
 set security-association lifetime seconds 86400                 # Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited           # Disable the traffic-based SA lifetime.

crypto isakmp identity address                                   # Use the address format for the identity.

  6. Create tunnel groups and specify the pre-shared key for each tunnel. The pre-shared keys must match those on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 1.
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev1 pre-shared-key 123456****                        #Specify the remote pre-shared key for Tunnel 1, which is the pre-shared key on the Alibaba Cloud side.
!
tunnel-group 182.XX.XX.19 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 2.
tunnel-group 182.XX.XX.19 ipsec-attributes         
 ikev1 pre-shared-key 123456****                        #Specify the remote pre-shared key for Tunnel 2, which is the pre-shared key on the Alibaba Cloud side.
!

  7. Create the tunnel interfaces.

    interface Tunnel1                                  #Create the interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside1                  #Set the source for Tunnel 1 to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   #Set the destination for Tunnel 1 to the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create the interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.20.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside2                  #Set the source for Tunnel 2 to the public interface GigabitEthernet0/2.
 tunnel destination 182.XX.XX.19                   #Set the destination for Tunnel 2 to the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

  8. Configure static routes to the Alibaba Cloud VPC (10.0.0.0/16).

    route ALIYUN1 10.0.0.0 255.255.0.0 39.XX.XX.218 4  #Configure a high-priority route to the VPC through Tunnel 1.
route ALIYUN2 10.0.0.0 255.255.0.0 182.XX.XX.19 5  #Configure a low-priority route to the VPC through Tunnel 2.

  9. In your on-premises data center, configure routes between clients and the Cisco firewall.

    Test the network connectivity between your on-premises data center and the Alibaba Cloud VPC. See Test connectivity.

Destination-based routing - BGP

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    This example assumes the Cisco firewall interfaces are already configured and enabled. The following code shows an example interface configuration.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    #Public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #Interface connected to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security-level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 121.XX.XX.77 255.255.255.255    #Public IP address configured for the GigabitEthernet0/2 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 182.XX.XX.19 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        #Configure a route to the on-premises data center.

  3. Enable IKEv1 on the public interfaces.

    crypto ikev1 enable outside1
crypto ikev1 enable outside2

  4. Create an IKEv1 policy. Specify the authentication method, IKE authentication algorithm, IKE encryption algorithm, DH group, and SA lifetime. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev1 policy 10   
 authentication pre-share   # Specify the authentication method as pre-shared key.
 encryption aes             # Specify the encryption algorithm.
 hash sha                   # Specify the authentication algorithm.
 group 14                   # Specify the DH group.
 lifetime 86400             # Specify the time-based SA lifetime.

  5. Create an IPsec transform set and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev1 transform-set TRANSFORM esp-aes esp-sha-hmac  # Create an IPsec transform set and specify the encryption and authentication algorithms.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev1 transform-set TRANSFORM                               # Apply the created transform set.
 set pfs group14                                                 # Specify the PFS and DH group.
 set security-association lifetime seconds 86400                 # Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited           # Disable the traffic-based SA lifetime.

crypto isakmp identity address                                   # Use the address format for the identity.

  6. Create tunnel groups and specify the pre-shared key for each tunnel. The pre-shared keys must match those on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 1.
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev1 pre-shared-key 123456****                        #Specify the remote pre-shared key for Tunnel 1, which is the pre-shared key on the Alibaba Cloud side.
!
tunnel-group 182.XX.XX.19 type ipsec-l2l                #Specify l2l as the encapsulation mode for Tunnel 2.
tunnel-group 182.XX.XX.19 ipsec-attributes         
 ikev1 pre-shared-key 123456****                        #Specify the remote pre-shared key for Tunnel 2, which is the pre-shared key on the Alibaba Cloud side.
!

  7. Create the tunnel interfaces.

    interface Tunnel1                                  #Create the interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside1                  #Set the source for Tunnel 1 to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   #Set the destination for Tunnel 1 to the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create the interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.20.2 255.255.255.252           #Specify the IP address for the interface.
 tunnel source interface outside2                  #Set the source for Tunnel 2 to the public interface GigabitEthernet0/2.
 tunnel destination 182.XX.XX.19                   #Set the destination for Tunnel 2 to the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

  8. Configure BGP dynamic routing.

    router bgp 65000
 address-family ipv4 unicast
  neighbor 169.254.10.1 remote-as 65530       #Specify the BGP peer, which is the IP address of Tunnel 1 on the Alibaba Cloud side.
  neighbor 169.254.10.1 ebgp-multihop 255
  neighbor 169.254.10.1 activate              #Activate the BGP peer.
  neighbor 169.254.20.1 remote-as 65530       #Specify the BGP peer, which is the IP address of Tunnel 2 on the Alibaba Cloud side.
  neighbor 169.254.20.1 ebgp-multihop 255
  neighbor 169.254.20.1 activate              #Activate the BGP peer.
  network 192.168.0.0 mask 255.255.0.0        #Advertise the CIDR block of the on-premises data center.
 exit-address-family

  9. In your on-premises data center, configure routes between clients and the Cisco firewall.

    Test the network connectivity between your on-premises data center and the Alibaba Cloud VPC. See Test connectivity.

Single-tunnel mode configuration

View a single-tunnel configuration example

Example scenario

image

This topic provides an example based on the preceding figure. A company wants to connect its data center (192.168.0.0/16) to an Alibaba Cloud VPC (10.0.0.0/16) that runs applications on an ECS instance. The company uses an IPsec-VPN connection to enable resource access between the two environments.

CIDR block plan and VPN configurations

CIDR block plan

Resource

CIDR block

IP address

Data center

The CIDR block that you want to connect to the VPC: 192.168.0.0/16

Server IP address: 192.168.50.198

Cisco firewall

Not applicable

Physical interfaces on the Cisco firewall that connect to the internet:

  • GigabitEthernet0/0: This interface is configured with a public IP address. In this example, 121.XX.XX.211 is used.

  • GigabitEthernet0/1: This interface connects to the data center and has the IP address 192.168.50.217.

VPC

Primary CIDR block: 10.0.0.0/16

vSwitch 1: 10.0.10.0/24

vSwitch 2: 10.0.20.0/24

ECS IP address: 10.0.10.33

VPN gateway instance (public)

Not applicable

Public IP address of the VPN gateway: 39.XX.XX.218

Note

After you create a VPN gateway instance, the system automatically assigns an IP address to it.

BGP network plan

This topic describes how to configure a Cisco firewall for an IPsec-VPN connection that uses static routing or BGP dynamic routing. If you do not need to use BGP dynamic routing, you can skip this section.

Resource

BGP tunnel CIDR block

BGP IP address

Local AS number

VPN gateway instance

169.254.10.0/30

Note

The CIDR block of each tunnel in a VPN gateway instance must be unique.

169.254.10.1

65530

Cisco firewall

169.254.10.0/30

169.254.10.2

65000

Sample VPN configurations

Ensure the VPN configurations on the Alibaba Cloud side and the Cisco firewall side match.

Parameter

Alibaba Cloud value

Cisco firewall value

Pre-shared key

123456****

123456****

IKE configurations

IKE version

ikev2

ikev2

Negotiation mode

main

main

Encryption algorithm

aes

aes

Authentication algorithm

sha1

sha1

DH group

group14

group14

SA lifetime (seconds)

86400

86400

IPsec configurations

Encryption algorithm

aes

aes

Authentication algorithm

sha1

sha1

DH group

group14

group14

SA lifetime (seconds)

86400

86400

Configuration procedure

Note

  • This topic uses Cisco ASA software version 9.19.1 as a configuration example. The configuration commands may vary among software versions. During operations, query the corresponding documentation or consult the relevant vendor based on your actual environment.

  • In the following scenarios, we recommend that you use Destination Routing mode - static route or Destination Routing mode - BGP dynamic routing.

Destination-based static routing

Prerequisites

This topic describes how to add a VPN configuration to a Cisco firewall. This topic does not describe the configurations for the Alibaba Cloud VPN gateway. Therefore, before you begin, make sure that you have created a VPN gateway instance, a customer gateway, and an IPsec-VPN connection, and configured routes for the VPN gateway. See Single-tunnel mode.

Steps

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    Ensure that the interfaces on the Cisco firewall are configured and enabled.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            # Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    # Public IP address of the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                # The interface connected to the data center.
 nameif private                             # Name of the GigabitEthernet0/1 interface.
 security-level 100                         # Specify a security level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    # IP address of the GigabitEthernet0/1 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   # Configure a route to the public IP address of the Alibaba Cloud VPN gateway. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        # Configure a route to the data center.

  3. Enable IKEv2 on the public interface.

    crypto ikev2 enable outside1

  4. Create an IKEv2 policy. Specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev2 policy 10     
 encryption aes             # Specify the encryption algorithm.
 integrity sha              # Specify the authentication algorithm.
 group 14                   # Specify the DH group.
 prf sha                    # The prf value must be the same as the integrity value. On the Alibaba Cloud side, the prf value is the same as the authentication algorithm by default.
 lifetime seconds 86400     # Specify the SA lifetime.

  5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    # Create an IPsec proposal.
 protocol esp encryption aes                         # Specify the encryption algorithm. The protocol is ESP, which is required by Alibaba Cloud.
 protocol esp integrity sha-1                        # Specify the authentication algorithm. The protocol is ESP, which is required by Alibaba Cloud.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            # Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    # Set the local ID format to an IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     # Specify the PFS and DH group.
 set security-association lifetime seconds 86400     # Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited # Disable the traffic-based SA lifetime.

  6. Create a tunnel group and specify the pre-shared key for the tunnel. The pre-shared key must match the one configured on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                # Specify the encapsulation mode for the tunnel as Layer-2-to-Layer-2 (L2L).
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key 123456****  # Specify the pre-shared key of the remote peer. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   # Specify the pre-shared key of the local peer. This must match the key on the Alibaba Cloud side.
!

  7. Create a tunnel interface.

    interface Tunnel1                                  # Create a tunnel interface.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           # Specify the IP address for the interface.
 tunnel source interface outside1                  # Set the tunnel source to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   # Set the tunnel destination to the public IP address of the Alibaba Cloud VPN gateway.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    # Apply the ALIYUN-PROFILE IPsec profile to the tunnel.
 no shutdown                                       # Enable the tunnel interface.
!

  8. Configure a static route to the Alibaba Cloud VPC (10.0.0.0/16).

    route ALIYUN1 10.0.0.0 255.255.0.0 39.XX.XX.218

  9. Configure routes in your data center for traffic between clients and the Cisco firewall.

    You can now test the network connectivity between your data center and the Alibaba Cloud VPC. See Test connectivity.

Destination-based BGP routing

Prerequisites

This topic describes only how to add a VPN configuration to a Cisco firewall and does not describe the configuration for the Alibaba Cloud VPN Gateway. Before you begin, make sure that you have created a VPN gateway instance, a customer gateway, and an IPsec-VPN connection, and enabled BGP. See Single-tunnel mode with BGP.

Steps

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface and public route configurations.

    Ensure that the interfaces on the Cisco firewall are configured and enabled.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            # Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    # Public IP address of the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                # The interface connected to the data center.
 nameif private                             # Name of the GigabitEthernet0/1 interface.
 security-level 100                         # Specify a security level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    # IP address of the GigabitEthernet0/1 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   # Configure a route to the public IP address of the Alibaba Cloud VPN gateway. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        # Configure a route to the data center.

  3. Enable IKEv2 on the public interface.

    crypto ikev2 enable outside1

  4. Create an IKEv2 policy. Specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev2 policy 10     
 encryption aes             # Specify the encryption algorithm.
 integrity sha              # Specify the authentication algorithm.
 group 14                   # Specify the DH group.
 prf sha                    # The prf value must be the same as the integrity value. On the Alibaba Cloud side, the prf value is the same as the authentication algorithm by default.
 lifetime seconds 86400     # Specify the SA lifetime.

  5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    # Create an IPsec proposal.
 protocol esp encryption aes                         # Specify the encryption algorithm. The protocol is ESP, which is required by Alibaba Cloud.
 protocol esp integrity sha-1                        # Specify the authentication algorithm. The protocol is ESP, which is required by Alibaba Cloud.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            # Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    # Set the local ID format to an IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     # Specify the PFS and DH group.
 set security-association lifetime seconds 86400     # Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited # Disable the traffic-based SA lifetime.

  6. Create a tunnel group and specify the pre-shared key for the tunnel. The pre-shared key must match the one configured on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                # Specify the encapsulation mode for the tunnel as Layer-2-to-Layer-2 (L2L).
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key 123456****  # Specify the pre-shared key of the remote peer. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   # Specify the pre-shared key of the local peer. This must match the key on the Alibaba Cloud side.
!

  7. Create a tunnel interface.

    interface Tunnel1                                  # Create a tunnel interface.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           # Specify the IP address for the interface.
 tunnel source interface outside1                  # Set the tunnel source to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   # Set the tunnel destination to the public IP address of the Alibaba Cloud VPN gateway.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    # Apply the ALIYUN-PROFILE IPsec profile to the tunnel.
 no shutdown                                       # Enable the tunnel interface.
!

  8. Configure BGP dynamic routing.

    router bgp 65000
 address-family ipv4 unicast
  neighbor 169.254.10.1 remote-as 65530       # Specify the BGP peer, which is the BGP IP address of Tunnel 1 on the Alibaba Cloud side.
  neighbor 169.254.10.1 ebgp-multihop 255
  neighbor 169.254.10.1 activate              # Activate the BGP peer.
  network 192.168.0.0 mask 255.255.0.0        # Advertise the CIDR block of the data center.
 exit-address-family

  9. Configure routes in your data center for traffic between clients and the Cisco firewall.

    You can now test the network connectivity between your data center and the Alibaba Cloud VPC. See Test connectivity.

Protected flow with static routing

Prerequisites

This topic describes only how to add a VPN configuration to a Cisco firewall, and does not describe the configuration on the Alibaba Cloud VPN Gateway side. Therefore, before you begin, make sure that you have created a VPN gateway instance, a customer gateway, and an IPsec-VPN connection. See Single-tunnel mode:

  • When you create an IPsec-VPN connection, select Flow Protection for the routing mode, set Local CIDR Block to 10.0.0.0/16, and set Peer CIDR Block to 192.168.0.0/16.

    Important

    If your scenario requires you to specify multiple Local CIDR Block or Peer CIDR Block, we recommend that you use Destination Routing mode - static route or Destination Routing mode - BGP dynamic routing. For more solutions, see Recommended configuration solutions for multiple CIDR blocks.

  • After creating an IPsec-VPN connection, configure a policy-based route. See Configure policy-based routes. You do not need to configure a destination route.

Procedure

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface configurations.

    Ensure that the interfaces on the Cisco firewall are configured and enabled.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            # Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    # Public IP address of the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                # The interface connected to the data center.
 nameif private                             # Name of the GigabitEthernet0/1 interface.
 security-level 100                         # Specify a security level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    # IP address of the GigabitEthernet0/1 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   # Configure a route to the public IP address of the Alibaba Cloud VPN gateway. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        # Configure a route to the data center.

  3. Enable IKEv2 on the public interface.

    crypto ikev2 enable outside1

  4. Create an IKEv2 Policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

  5. Create an IPsec proposal. Specify the encryption algorithm and authentication algorithm for the IPsec phase on the Cisco firewall. These settings must be the same as those on the Alibaba Cloud side.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The ESP protocol is used. The Alibaba Cloud side uses the ESP protocol by default.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The ESP protocol is used. The Alibaba Cloud side uses the ESP protocol by default.

  6. Define interesting traffic.

    Specify the traffic CIDR blocks that the IPsec-VPN connection is allowed to transmit. This example specifies that the 192.168.0.0/16 CIDR block of the on-premises data center communicates with the 10.0.0.0/16 CIDR block of the Alibaba Cloud VPC.

    access-list acl_tun extended permit ip 192.168.0.0 255.255.0.0 10.0.0.0 255.255.0.0

  7. Create an IPsec policy.

    # Create an IPsec policy for the tunnel.
crypto map TUNL1 1 match address acl_tun                      # Apply the defined protected data flows.
crypto map TUNL1 1 set pfs group14                            # Specify the DH group.	
crypto map TUNL1 1 set peer 39.XX.XX.218                      # Specify the peer ID, which is the public IP address of the Alibaba Cloud VPN gateway.
crypto map TUNL1 1 set ikev2 ipsec-proposal ALIYUN-PROPOSAL   # Apply the IPsec proposal.
crypto map TUNL1 1 set ikev2 pre-shared-key 0 123456****      # Specify the pre-shared key. It must match the key in the tunnel-group command.
crypto map TUNL1 1 set security-association lifetime seconds  86400             # Specify the time-based IPsec SA lifetime.
crypto map TUNL1 1 set security-association lifetime kilobytes unlimited        # Disable the traffic-based IPsec SA lifetime.
crypto map TUNL1 interface outside1                                             # Apply the IPsec policy to the public interface GigabitEthernet0/0.
!

  8. Create a tunnel group and specify the pre-shared key for the tunnel. The pre-shared key must match the one configured on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                # Specify the encapsulation mode for the tunnel as Layer-2-to-Layer-2 (L2L).
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key 123456****  # Specify the pre-shared key of the remote peer. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key 123456****   # Specify the pre-shared key of the local peer. This must match the key on the Alibaba Cloud side.
!

  9. Configure a static route to the Alibaba Cloud VPC (10.0.0.0/16).

    route outside1 10.0.0.0 255.255.0.0 39.XX.XX.218

  10. Configure routes in your data center for traffic between clients and the Cisco firewall.

    You can now test the network connectivity between your data center and the Alibaba Cloud VPC. See Test connectivity.

IKEv1 configuration

Use the configurations in this section if your Cisco firewall requires IKEv1.

To use these examples, the IPsec-VPN connection on the Alibaba Cloud side must also be configured to use IKEv1 and the destination-based routing mode.

Destination-based static routing

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface configurations.

    Ensure that the interfaces on the Cisco firewall are configured and enabled.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            # Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    # Public IP address of the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                # The interface connected to the data center.
 nameif private                             # Name of the GigabitEthernet0/1 interface.
 security-level 100                         # Specify a security level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    # IP address of the GigabitEthernet0/1 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   # Configure a route to the public IP address of the Alibaba Cloud VPN gateway. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        # Configure a route to the data center.

  3. Enable IKEv1 on the public interface.

    crypto ikev1 enable outside1

  4. Create an IKEv1 policy. Specify the authentication method, IKE authentication algorithm, IKE encryption algorithm, DH group, and SA lifetime. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev1 policy 10   
 authentication pre-share   # Specify the authentication method as pre-shared key.
 encryption aes             # Specify the encryption algorithm.
 hash sha                   # Specify the authentication algorithm.
 group 14                   # Specify the DH group.
 lifetime 86400             # Specify the time-based SA lifetime.

  5. Create an IPsec transform set and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev1 transform-set TRANSFORM esp-aes esp-sha-hmac  # Create an IPsec transform set and specify the encryption and authentication algorithms.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev1 transform-set TRANSFORM                               # Apply the created transform set.
 set pfs group14                                                 # Specify the PFS and DH group.
 set security-association lifetime seconds 86400                 # Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited           # Disable the traffic-based SA lifetime.

crypto isakmp identity address                                   # Use the address format for the identity.

  6. Create a tunnel group and specify the pre-shared key for the tunnel. The pre-shared key must match the one configured on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                # Specify the encapsulation mode for the tunnel as Layer-2-to-Layer-2 (L2L).
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev1 pre-shared-key 123456****                        # Specify the pre-shared key of the remote peer. This is the pre-shared key on the Alibaba Cloud side.
!

  7. Create a tunnel interface.

    interface Tunnel1                                  # Create a tunnel interface.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           # Specify the IP address for the tunnel interface.
 tunnel source interface outside1                  # Set the tunnel source to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   # Set the tunnel destination to the public IP address of the Alibaba Cloud VPN gateway.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    # Apply the ALIYUN-PROFILE IPsec profile to the tunnel.
 no shutdown                                       # Enable the tunnel interface.
!

  8. Configure a static route to the Alibaba Cloud VPC (10.0.0.0/16).

    route ALIYUN1 10.0.0.0 255.255.0.0 39.XX.XX.218

  9. Configure routes in your data center for traffic between clients and the Cisco firewall.

    You can now test the network connectivity between your data center and the Alibaba Cloud VPC. See Test connectivity.

Destination-based BGP routing

  1. Log on to the command line window of the Cisco firewall and enter configuration mode. 

    ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

  2. View the interface configurations.

    Ensure that the interfaces on the Cisco firewall are configured and enabled.

    ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            # Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 121.XX.XX.211 255.255.255.255    # Public IP address of the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                # The interface connected to the data center.
 nameif private                             # Name of the GigabitEthernet0/1 interface.
 security-level 100                         # Specify a security level for the private interface that is lower than the public interface.
 ip address 192.168.50.217 255.255.255.0    # IP address of the GigabitEthernet0/1 interface.
!

route outside1 39.XX.XX.218 255.255.255.255 192.XX.XX.172   # Configure a route to the public IP address of the Alibaba Cloud VPN gateway. The next hop is a public IP address.
route private 192.168.0.0 255.255.0.0 192.168.50.216        # Configure a route to the data center.

  3. Enable IKEv1 on the public interface.

    crypto ikev1 enable outside1

  4. Create an IKEv1 policy. Specify the authentication method, IKE authentication algorithm, IKE encryption algorithm, DH group, and SA lifetime. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ikev1 policy 10   
 authentication pre-share   # Specify the authentication method as pre-shared key.
 encryption aes             # Specify the encryption algorithm.
 hash sha                   # Specify the authentication algorithm.
 group 14                   # Specify the DH group.
 lifetime 86400             # Specify the time-based SA lifetime.

  5. Create an IPsec transform set and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

    Important

    On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

    crypto ipsec ikev1 transform-set TRANSFORM esp-aes esp-sha-hmac  # Create an IPsec transform set and specify the encryption and authentication algorithms.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev1 transform-set TRANSFORM                               # Apply the created transform set.
 set pfs group14                                                 # Specify the PFS and DH group.
 set security-association lifetime seconds 86400                 # Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited           # Disable the traffic-based SA lifetime.

crypto isakmp identity address                                   # Use the address format for the identity.

  6. Create a tunnel group and specify the pre-shared key for the tunnel. The pre-shared key must match the one configured on the Alibaba Cloud side.

    tunnel-group 39.XX.XX.218 type ipsec-l2l                # Specify the encapsulation mode for the tunnel as Layer-2-to-Layer-2 (L2L).
tunnel-group 39.XX.XX.218 ipsec-attributes             
 ikev1 pre-shared-key 123456****                        # Specify the pre-shared key of the remote peer. This is the pre-shared key on the Alibaba Cloud side.
!

  7. Create a tunnel interface.

    interface Tunnel1                                  # Create a tunnel interface.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           # Specify the IP address for the tunnel interface.
 tunnel source interface outside1                  # Set the tunnel source to the public interface GigabitEthernet0/0.
 tunnel destination 39.XX.XX.218                   # Set the tunnel destination to the public IP address of the Alibaba Cloud VPN gateway.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    # Apply the ALIYUN-PROFILE IPsec profile to the tunnel.
 no shutdown                                       # Enable the tunnel interface.
!

  8. Configure BGP dynamic routing.

    router bgp 65000
 address-family ipv4 unicast
  neighbor 169.254.10.1 remote-as 65530       # Specify the BGP peer, which is the BGP IP address on the Alibaba Cloud side.
  neighbor 169.254.10.1 ebgp-multihop 255
  neighbor 169.254.10.1 activate              # Activate the BGP peer.
  network 192.168.0.0 mask 255.255.0.0        # Advertise the CIDR block of the data center.
 exit-address-family

  9. Configure routes in your data center for traffic between clients and the Cisco firewall.

    You can now test the network connectivity between your data center and the Alibaba Cloud VPC. See Test connectivity.

Previous：Configure strongSwanNext：Use Cases