Since I still have my ASA lab up, let’s play with two types of VPNs.
Here is tonight’s topology

Site to Site VPN

R01

A site to site VPN uses a ACL to match what traffic is going to be encrypted.

R01(config)#ip access-list extended VPN_R01_TO_ASA01
 R01(config-ext-nacl)# permit ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255

For the phase 1 settings we’ll use 3DES encryption, SHA1 hash, and DH group 2. We’ll also use pre-share keys for authentication.

 R01(config)#crypto isakmp policy 100
 R01(config-isakmp)# encr 3des
 R01(config-isakmp)# hash sha
 R01(config-isakmp)# authentication pre-share
 R01(config-isakmp)# group 2
 R01(config-isakmp)#exit

We’ll use 3DES and SHA1 for phase 2 as well.

R01(config)#crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
 R01(cfg-crypto-trans)#exit

Next we set a pre-share key for ASA01’s WAN IP address.

R01(config)#crypto isakmp key meowcat address 200.11.254.11

Now that all the pieces are configured, we need to make a crypto map to tie everything together.
The reverse-route is a handy feature that generates a static route for the VPN so we can redistribute it into other routing protocols.

R01(config)#crypto map VPN 100 ipsec-isakmp 
 R01(config-crypto-map)# set peer 200.11.254.11
 R01(config-crypto-map)# set transform-set ESP-3DES-SHA 
 R01(config-crypto-map)# set pfs group2
 R01(config-crypto-map)# set reverse-route tag 100
 R01(config-crypto-map)#exit

Lastly we enable the VPN on our outside interface.

R01(config)#int g0/1.1254
R01(config-subif)#crypto map VPN

ASA01

The ASA follows a similar logic, we make a ACL that matches the VPN traffic.

ASA01(config)# access-list VPN_ASA01_TO_R01 extended permit ip 192.168.11.0 255.255.255.0 192.168.10.0 255.255.255.0

Then we make a phase 1 and 2 policy that matches what we did on the router.

ASA01(config)# crypto ikev1 policy 100
 ASA01(config-ikev1-policy)# authentication pre-share
 ASA01(config-ikev1-policy)# encryption 3des
 ASA01(config-ikev1-policy)# hash sha
 ASA01(config-ikev1-policy)# group 2
 ASA01(config-ikev1-policy)# lifetime 86400
 ASA01(config)# crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

We will also have to enable IKEv1 on the firewall.

ASA01(config)# crypto ikev1 enable outside​

On a ASA we define a pre-share key in a tunnel-group

 ASA01(config)# tunnel-group 200.1.254.1 ipsec-attributes
 ASA01(config-tunnel-ipsec)# ikev1 pre-shared-key meowcat
 ASA01(config-tunnel-ipsec)# exit

Then we make a crypto map that ties everything together.

 crypto map VPN 100 match address VPN_ASA01_TO_R01
 crypto map VPN 100 set pfs 
 crypto map VPN 100 set peer 200.1.254.1 
 crypto map VPN 100 set ikev1 transform-set ESP-3DES-SHA
 crypto map VPN 100 set reverse-route
 crypto map VPN interface outside

Testing

Now the VPN is setup we can ping from S01 to S11

 cisco@S01:~$ ping 192.168.11.100 -c 5
 PING 192.168.11.100 (192.168.11.100) 56(84) bytes of data.
 64 bytes from 192.168.11.100: icmp_seq=1 ttl=63 time=260 ms
 64 bytes from 192.168.11.100: icmp_seq=2 ttl=63 time=243 ms
 64 bytes from 192.168.11.100: icmp_seq=3 ttl=63 time=269 ms
 64 bytes from 192.168.11.100: icmp_seq=4 ttl=63 time=301 ms
 64 bytes from 192.168.11.100: icmp_seq=5 ttl=63 time=307 ms

The VPN is up when we see QM_IDLE as a connection status.

R01#show crypto isakmp sa 
 IPv4 Crypto ISAKMP SA
 dst src state conn-id status
 200.1.254.1 200.11.254.11 QM_IDLE 1008 ACTIVE
 
 ASA01(config)# show isakmp sa 
 
 IKEv1 SAs:
 
 Active SA: 1
 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
 Total IKE SA: 1
 
 1 IKE Peer: 200.1.254.1
 Type : L2L Role : initiator 
 Rekey : no State : MM_ACTIVE

We can see the reverse route working by looking at the routing table.

ASA01(config)# show route static 
 
 Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, + - replicated route
 Gateway of last resort is 200.11.254.254 to network 0.0.0.0
 
 S* 0.0.0.0 0.0.0.0 [1/0] via 200.11.254.254, outside
 V 192.168.10.0 255.255.255.0 connected by VPN (advertised), outside

VTI VPN

The problem with site to site VPNs is that we have to manually entering what networks to encrypt with a crypto map, ASAs now support a routed VPN called a VTI to make things more dynamic. Currently it supports BGP routing and will likely support other protocols as we go.

R01

We’ll reuse the phase 1 and 2 settings from the site to site to save a bit of time and then add a preshare key for ASA02

R01(config)#crypto isakmp key meowcat address 200.12.254.12​

Next we’ll make a IPSEC profile for the VTI

R01(config)#crypto ipsec profile VTI
 R01(ipsec-profile)# set transform-set ESP-3DES-SHA 
 R01(ipsec-profile)# set pfs group2

A VTI is a tunnel so we’ll make Tunnel12, give it an IP and attach the ipsec profile to it.

R01(config)#interface Tunnel12
 R01(config-if)# ip address 10.1.12.1 255.255.255.0
 R01(config-if)# tunnel source GigabitEthernet0/1.1254
 R01(config-if)# tunnel mode ipsec ipv4
 R01(config-if)# tunnel destination 200.12.254.12
 R01(config-if)# tunnel protection ipsec profile VTI

Since this is a routing VPN we’ll setup BGP across the tunnel and advertise the LAN network.

 R01(config)#router bgp 100
 R01(config-router)# bgp log-neighbor-changes
 R01(config-router)# network 192.168.10.0
 R01(config-router)# neighbor 10.1.12.12 remote-as 100

ASA02

On the ASA side we’ll use the same phase 1 and 2 settings from above and add a tunnel-group entry for R01, don’t forget to enable ISAKMP!

 ASA02(config)# tunnel-group 200.1.254.1 ipsec-attributes
 ASA02(config-tunnel-ipsec)# ikev1 pre-shared-key meowcat
 ASA02(config-tunnel-ipsec)# exit

Next we need a ipsec profile

 ASA02(config)# crypto ipsec profile VTI
 ASA02(config-ipsec-profile)# set ikev1 transform-set ESP-3DES-SHA
 ASA02(config-ipsec-profile)# set pfs group2

Then we make a tunnel interface like we did on the router

 ASA02(config)# interface Tunnel12
 ASA02(config-if)# nameif VPN
 ASA02(config-if)# ip address 10.1.12.12 255.255.255.0 
 ASA02(config-if)# tunnel source interface outside
 ASA02(config-if)# tunnel destination 200.1.254.1
 ASA02(config-if)# tunnel mode ipsec ipv4
 ASA02(config-if)# tunnel protection ipsec profile VTI

Lastly we just need BGP on the ASA

ASA02(config)# router bgp 100
 ASA02(config-router)# bgp log-neighbor-changes
 ASA02(config-router)# address-family ipv4 unicast
 ASA02(config-router-af)# neighbor 10.1.12.1 remote-as 100
 ASA02(config-router-af)# neighbor 10.1.12.1 activate
 ASA02(config-router-af)# network 192.168.12.0
 ASA02(config-router-af)# no auto-summary
 ASA02(config-router-af)# no synchronization
 ASA02(config-router-af)# exit-address-family

Testing

Once BGP comes up we can now ping from S01 to S12

cisco@S01:~$ ping 192.168.12.100 -c 5 
 PING 192.168.12.100 (192.168.12.100) 56(84) bytes of data.
 64 bytes from 192.168.12.100: icmp_seq=1 ttl=63 time=268 ms
 64 bytes from 192.168.12.100: icmp_seq=2 ttl=63 time=193 ms
 64 bytes from 192.168.12.100: icmp_seq=3 ttl=63 time=151 ms
 64 bytes from 192.168.12.100: icmp_seq=4 ttl=63 time=262 ms
 64 bytes from 192.168.12.100: icmp_seq=5 ttl=63 time=305 ms
 
 --- 192.168.12.100 ping statistics ---
 5 packets transmitted, 5 received, 0% packet loss, time 4006ms
 rtt min/avg/max/mdev = 151.800/236.337/305.269/55.486 ms

And we can see the BGP working as it should

ASA02(config-router)# show bgp
 
 BGP table version is 9, local router ID is 200.12.254.12
 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
 r RIB-failure, S Stale, m multipath
 Origin codes: i - IGP, e - EGP, ? - incomplete
 
 Network Next Hop Metric LocPrf Weight Path
 *>i192.168.10.0 10.1.12.1 0 100 0 i
 *> 192.168.12.0 0.0.0.0 0 32768 i