# Cisco ASA Site-to-Site IKEv1 IPsec VPN Dynamic Peers **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 19, 2016, 4:40pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827 "2016-12-19T16:40:07Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [December 19, 2016, 4:40pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/1 "2016-12-19T16:40:07Z")
This topic is to discuss the following lesson: > **[Cisco ASA Site-to-Site IKEv1 IPsec VPN Dynamic Peers](https://networklessons.com/cisco/asa-firewall/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers)** > > In this lesson, you will learn how to configure Cisco ASA firewalls with multiple peers with dynamic IP addresses. ---
**Author:** ![Zaman.rubd](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/45deac/32.png) [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)\ **Post date:** [March 27, 2016, 1:52pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/2 "2016-03-27T13:52:44Z")
Hi Rene, I can’t understand How ASA1 recognizes dynamically the peer IP address with the command `ASA1(config)# tunnel-group DefaultL2LGroup ipsec-attributes` and ```auto ASA1(config)# tunnel-group ASA1_ASA2 type ipsec-l2l ASA1(config)# tunnel-group ASA1_ASA2 ipsec-attributes ``` Could you please help me to describe how they are working ?? br/ zaman ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [March 28, 2016, 12:09pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/3 "2016-03-28T12:09:23Z")
Hi Zaman, On ASA2 you will find this line: `ASA2(config)# crypto isakmp identity key-id ASA1_ASA2` When ASA2 tries to connect to ASA1, it will use “ASA1\_ASA2” to identify itself. This will help ASA1 to decide which tunnel group to pick: `ASA1(config)# tunnel-group ASA1_ASA2 type ipsec-l2l` ASA1 will accept connections from any IP address. Rene ---
**Author:** ![yannaing.ml](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/y/edb3f5/32.png) [@yannaing.ml](https://forum.networklessons.com/u/yannaing.ml)\ **Post date:** [March 29, 2016, 3:46am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/4 "2016-03-29T03:46:45Z")
Hi Rene, I have a one question for site to site ipsec vpn. I have two ASA 5525-x firewall and using Active/Standby in production. But I have a one public ip address in WAN interface. I want to use site to site ipsec vpn now. Could I use one public ip address for active/standby design and Is it possible? How to work failover? This design we can get failover when active firewall is down. Is there any recommendation reference? Thanks ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [March 29, 2016, 11:48am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/5 "2016-03-29T11:48:01Z")
Hi Mark, Configure the ASAs without the standby IP on the outside interface is no problem. The standby IP is used for management and to monitor the interface (by sending hello packets). If you do specify a standby IP on the inside interfaces then you can use that to access your standby ASA. When your primary ASA fails, it will be notified through the failover link and your standby ASA will take over. Rene ---
**Author:** ![yannaing.ml](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/y/edb3f5/32.png) [@yannaing.ml](https://forum.networklessons.com/u/yannaing.ml)\ **Post date:** [March 29, 2016, 12:50pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/6 "2016-03-29T12:50:51Z")
Hi Rene, Thanks for your reply. ---
**Author:** ![ukpongudo28](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/u/5e9695/32.png) [@ukpongudo28](https://forum.networklessons.com/u/ukpongudo28)\ **Post date:** [March 29, 2016, 4:06pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/7 "2016-03-29T16:06:57Z")
Thanks for all the explanations, but please I have a question "should my WAN LINK caries a public IP address or should I assign any? ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [March 30, 2016, 7:56pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/8 "2016-03-30T19:56:48Z")
Hi Emmanuel, If you intend to build a VPN over the Internet then you will need public IP addresses. It depends on the ISP if you get these through DHCP or if you have to configure them statically. Rene ---
**Author:** ![jesselvella](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/j/5f8ce5/32.png) [@jesselvella](https://forum.networklessons.com/u/jesselvella)\ **Post date:** [July 8, 2016, 7:59pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/9 "2016-07-08T19:59:40Z")
Hello Rene, Can this setup be applied to an ASA with a static then IKEV1 tunnels to dynamic Cisco 871 routers? Thanks! Jesse ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [July 10, 2016, 11:58am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/10 "2016-07-10T11:58:34Z")
Hi Jesse, That’s no problem at all, just keep in mind that your routers will have to initiate the connection. Rene ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [April 13, 2018, 6:16pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/13 "2018-04-13T18:16:46Z")
Hi John, For your access-lists, something like this should work: ASA-1: `access-list ASA1_ASA2 extended permit ip 172.16.32.0 255.255.255.0 any` ASA-2: `access-list ASA2_ASA1 extended permit ip any 172.16.32.0 255.255.255.0` This allows all hosts in the 172.16.32.0/24 subnet to go through the VPN tunnel to any destination (including the Internet). Don’t forget to configure NAT somewhere…like those routers. About adding that second peer, is there any overlap with your crypto map (or access-lists) that could cause this? Make sure each peer “lands” on the correct tunnel group. Rene ---
**Author:** ![praveenmakhar7777](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/praveenmakhar7777/32/1678_2.png) [@praveenmakhar7777](https://forum.networklessons.com/u/praveenmakhar7777)\ **Post date:** [May 19, 2019, 2:07pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/14 "2019-05-19T14:07:03Z")
Hi Rene, `ASA2(config)# crypto isakmp identity key-id ASA1_ASA2` This is a configuration line on ASA2. This “ASA1\_ASA2” is only present on ASA1 but doesn’t have any existence on ASA2 at all. So how the things are working. ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [May 20, 2019, 12:24pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/16 "2019-05-20T12:24:40Z")
Hi Praveen, This matches with the tunnel-group on ASA1. Here is the tunnel-group of ASA1: ``` ASA1(config)# tunnel-group ASA1_ASA2 type ipsec-l2l ASA1(config)# tunnel-group ASA1_ASA2 ipsec-attributes ASA1(config-tunnel-ipsec)# ikev1 pre-shared-key ASA1_ASA2_KEY ``` And here’s the key ID on ASA2: ``` ASA2(config)# crypto isakmp identity key-id ASA1_ASA2 ASA2(config)# crypto ikev1 enable OUTSIDE ``` When ASA2 connects, ASA1 knows to which tunnel group it belongs because of the ID. Rene ---
**Author:** ![zeeshan\_yousuf](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/ba9def/32.png) [@zeeshan\_yousuf](https://forum.networklessons.com/u/zeeshan_yousuf)\ **Post date:** [January 5, 2020, 1:17pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/17 "2020-01-05T13:17:11Z")
Hi Rene, Thanks for this explanation. my question may not be directly related to this topic, what will need to be done if ASA2 subnet and ASA3 subnet needs to talk to each other what will need to be enabled on ASA 1 or ASA2 & 3? Also for e.g instead of ASA 2 I have a different brand of firewall like Sophos XG, will i be able to set the key-id on Sophos for ASA1 to identify which map it will use for Sophos? Thanks in advance for your clarification. Regards, Zeeshan ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 8, 2020, 8:23am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/18 "2020-01-08T08:23:10Z")
Hello Zeeshan We can consider this topology as a kind of hub and spoke, where ASA1 is the hub and ASAs 2 and 3 are the spokes. In order to allow ASA2 to ASA3 communication, it is necessary to do several things. Each spoke has to send the traffic for the other spoke through the tunnel that already exists to the hub. So, both the existing access lists must be extended to include spoke to spoke traffic. Secondly, the static routing at each spoke must include the subnets of the other spoke. Third, the hub must be configured so that the ACL for the ASA1 to ASA2 traffic includes ASA3 to ASA2 traffic, and the ACL for the ASA1 to ASA3 traffic includes ASA2 to ASA3 traffic. And finally, the hub must be configured to allow traffic to enter and leave on the same interface, which is not the default behaviour. Take a look at this Cisco Community post that describes a similar configuration to that in the lesson, and adds at the end, the requirements for spoke to spoke communication. > **[Cisco ASA: VPN-Spoke-to-Spoke communication via the Hub](https://community.cisco.com/t5/security-knowledge-base/cisco-asa-vpn-spoke-to-spoke-communication-via-the-hub/ta-p/3154011)** > > (Eine deutsche Version dieses Dokumentes gibt es unter http://security-planet.de/2013/11/29/cisco-asa-vpns-spoke-to-spoke-traffic-via-hub/)   The question how to configure spoke-to-spoke VPN traffic on the ASA is quite frequent on the Cisco... Take a look and you should be able to conform it to the lesson. > [@zeeshan\_yousuf](#): > > Also for e.g instead of ASA 2 I have a different brand of firewall like Sophos XG, will i be able to set the key-id on Sophos for ASA1 to identify which map it will use for Sophos? IPsec IKEv1 is an open standard, and as long as your firewall supports this standard, the appropriate key-id will be able to be sent so that the ASA1 will identify which map to use for Sophos. I hope this has been helpful! Laz ---
**Author:** ![irfanpgill](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/i/8baadc/32.png) [@irfanpgill](https://forum.networklessons.com/u/irfanpgill)\ **Post date:** [March 30, 2020, 12:27pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/19 "2020-03-30T12:27:46Z")
Hi Rene, What if you have dynamic peers on both sides, can you apply the similar config that you’re applying on ASA1. thanks.. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 30, 2020, 1:59pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/20 "2020-03-30T13:59:19Z")
Hello Irfan It is not possible to have both ends of a site to site connection be dynamic. At least one of the ends must be static because if both ends don’t know the IP address of the other, no VPN tunnels could be established. If you have dynamic IPs on both ends (as would occur if you had ADSL connections on both ends with dynamic IPs), you would have to establish a way to find the IP address of one of the ends. This could theoretically be achieved using services like DynDNS, or NoIP, but ASA does not support these. The best practice is to have at least one end have as static IP. I hope this has been helpful! Stay safe and healthy! Laz ---
**Author:** ![irfanpgill](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/i/8baadc/32.png) [@irfanpgill](https://forum.networklessons.com/u/irfanpgill)\ **Post date:** [March 30, 2020, 2:10pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/21 "2020-03-30T14:10:48Z")
Hi Laz, That was great info. Thanks, Irfan ---
**Author:** ![buhajla1993](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/b/c37758/32.png) [@buhajla1993](https://forum.networklessons.com/u/buhajla1993)\ **Post date:** [April 1, 2020, 8:54am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/22 "2020-04-01T08:54:29Z")
Hi Rene, I asked something same before but please don’t mind if i ask my question again in this scenario. So is there any advantage or disadvantage if i use IKEv2 instead of IKEv1 in this scenario? Thank you for your time! B.A ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [April 1, 2020, 4:16pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/23 "2020-04-01T16:16:58Z")
Hello András The advantages that IKEv2 provides over IKEv1 are not particular to the specific Dynamic Peers topology. The advantages are simply those provided by version 2 in any topology. Some improvements that may be beneficial in this specific topology include: 1. the ability of IKEv2 to perform NAT traversal 2. requires less overhead than IKEv1 thus making it better if you are applying it via a low bandwidth WAN There are additional advantages, but these are note particular to the specific topology. I hope this has been helpful! Laz [Next page](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827.md?page=2)