# Cisco ASA Site-to-Site IKEv1 IPsec VPN Dynamic Peers **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 19, 2016, 4:40pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827 "2016-12-19T16:40:07Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![buhajla1993](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/b/c37758/32.png) [@buhajla1993](https://forum.networklessons.com/u/buhajla1993)\ **Post date:** [April 1, 2020, 9:14pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/24 "2020-04-01T21:14:02Z")
Thank you for your answer! ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [April 15, 2020, 7:27am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/25 "2020-04-15T07:27:59Z")
Hello Andras It seems you responded in a private message. I will post your response and your question here so that you the answer can benefit others as well. > Hello Laz! > > Sorry for disturbing you again, but i got an another question: When we have to do NAT while we configuring Site to Site IPsec VPNs? > > I would be very grateful if you can answer this question. > > Thank you very much! NAT can be used with a site to site IPSec VPN. How it will be used and how it will be implemented depends on what you need to achieve. One such scenario is when you have overlapping internal IP address schemes. For example, you may have the 192.168.1.0/24 subnet at both the local and the remote locations. You can use NAT to translate these addresses into other subnets (192.168.2.0/24 for site 1 and 192.168.3.0/24 for the other for example) so that communication can still take place. An example of this can be found at the following Cisco documentation: > **[Configuration Example of ASA VPN with Overlapping Scenarios](https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/211275-Configuration-Example-of-ASA-VPN-with-Ov.html)** > > This document describes the steps used to translate the VPN traffic that travels over a LAN-to-LAN (L2L) IPsec tunnel between two Adaptive Security Another example is where a site to site VPN is functioning, and you use split tunneling at each site for internet traffic, for which you want to apply NAT. The following Cisco documentation describes this. Although it is an older document, the principles are still the same. > **[Configure Split Tunneling for VPN Clients on the ASA](https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70917-asa-split-tunnel-vpn-client.html)** > > This document describes the process to allow VPN Clients access to the Internet while tunneling into a Cisco ASA 5500 Series Security Appliance. If you have a more specific question, please feel free to ask, you are not disturbing us, that’s what we’re here for, to answer your questions! I hope this has been helpful! Laz ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 20, 2020, 6:48am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/26 "2020-05-20T06:48:16Z")
A post was merged into an existing topic: [Cisco ASA Site-to-Site IPsec VPN Digital Certificates](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/16) ---
**Author:** ![bvesel](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/bvesel/32/1967_2.png) [@bvesel](https://forum.networklessons.com/u/bvesel)\ **Post date:** [May 24, 2020, 7:41pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/27 "2020-05-24T19:41:00Z")
Hello, Great lessons. Thank you very much. There’s a little typo in the topology (ASA1 INSIDE interface number): ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/7/705c536260ec95d3394df7c4a586f98059ef68bf.png) Boris ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 26, 2020, 9:16am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/28 "2020-05-26T09:16:59Z")
Hello Boris Thanks for pointing that out, I’ll let Rene know… Laz ---
**Author:** ![dafr.93](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/ecd19e/32.png) [@dafr.93](https://forum.networklessons.com/u/dafr.93)\ **Post date:** [November 21, 2020, 3:36am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/29 "2020-11-21T03:36:02Z")
Hi Rene, About this kind of topology I understand that in the dynamic peer it has to be configured as aggresive mode: ``` ASA3(config)# crypto map MY_CRYPTO_MAP 10 match address LAN3_LAN1 ASA3(config)# crypto map MY_CRYPTO_MAP 10 set peer 10.10.10.1 ASA3(config)# crypto map MY_CRYPTO_MAP 10 set ikev1 phase1-mode aggressive ASA3(config)# crypto map MY_CRYPTO_MAP 10 set ikev1 transform-set MY_TRANSFORM_SET ``` So I have 2 questions: - Would it be a security problem if it was configured as aggresive mode? - If my dynamic peer is a router instead of ASA it could it be possible to configure it as aggresive mode (if needed) ? Thanks ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [November 23, 2020, 7:37am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/30 "2020-11-23T07:37:34Z")
Hello Daniel > [@dafr.93](#): > > - Would it be a security problem if it was configured as aggressive mode? Main mode uses a six-way handshake where parameters are exchanged in multiple exchanges with encrypted authentication information. Agressive mode on the other hand is considered less secure because it sends the hashed preshared key to the client in a single unencrypted message, a fact that makes this option comparatively more vulnerable. Aggressive mode is obviously faster than main mode and is required for certain cases such as described in this lesson. For this reason, it is vital that the preshared key that is used be complex enough to protect such a connection from brute force attacks. If the preshared key is complex enough, aggressive mode provides sufficient security for most implementations. If however security is paramount in your particular application, you should ensure that the appropriate infrastructure is available to support main mode. > [@dafr.93](#): > > - If my dynamic peer is a router instead of ASA it could it be possible to configure it as aggresive mode (if needed) ? Yes, you can configure aggressive mode on Cisco IOS routers as well as on the ASA. Although this is an old document, you can see how this can be accomplished at the following link: > **[Configuring a Router-to-Router LAN-to-LAN Tunnel with a Router Initiating IKE...](https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/20641-initaggr.html)** > > Cisco IOS? Software Release 12.2(8)T introduces the functionality of the router to initiate Internet Key Exchange (IKE) in aggressive mode. For more information see Bug ID CSCdt30808 in the Bug Toolkit. Before, the router was able to respond to a... I hope this has been helpful! Laz ---
**Author:** ![zeeshan.yousuf](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/50afbb/32.png) [@zeeshan.yousuf](https://forum.networklessons.com/u/zeeshan.yousuf)\ **Post date:** [January 18, 2021, 1:01pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/31 "2021-01-18T13:01:16Z")
Hi Laz/Rene, Hope you are doing well. I have a specific requirement for hub to spoke vpns involving Cisco CSR (hub) and juniper srx320 (spoke). Assuming spokes are getting dynamic pppoe public IP and hub is static public IP. What kind of VPN setup would be most suitable considering running dynamic routing protocol over the VPN and easy to scale in future from administrative management view point. currently I’m able to setup hub/spoke topology using SVTI with dynamic routing protocol. Can this be further simplified considering spokes are a dynamic peer? Many thanks Zeeshan ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 20, 2021, 5:16am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/32 "2021-01-20T05:16:56Z")
Hello Zeeshan The best situation for what you are describing would be to use [Cisco’s DMVPN feature](https://networklessons.com/vpn/introduction-to-dmvpn), which automatically and dynamically adds spokes, and includes the capability of employing a routing protocol as well. However, from the little research, I have done, Juniper is not compatible with Cisco in order to employ this feature. Alternatives include the use of GETVPN, a feature that documentation of both vendors states that they support, however, until you actually try to employ interoperability between different vendors you cannot be sure. I can’t comment on the success of this beyond what documentation is available. For GETVPN implementation on Cisco devices, take a look at the following lesson: [https://networklessons.com/cisco/ccie-enterprise-infrastructuregroup-encrypted-transport-vpn-getvpn](https://networklessons.com/cisco/ccie-enterprise-infrastructuregroup-encrypted-transport-vpn-getvpn) VTI is also a very useful solution, and yes, there is a Dynamic VTI option about which you can learn more here: [https://networklessons.com/cisco/ccie-enterprise-infrastructureipsec-vti-virtual-tunnel-interface](https://networklessons.com/cisco/ccie-enterprise-infrastructureipsec-vti-virtual-tunnel-interface) But once again, interoperability between vendors can only conclusively be determined by trying it out yourself. I hope this has been helpful! Laz ---
**Author:** ![ZIRANHAMA](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/45deac/32.png) [@ZIRANHAMA](https://forum.networklessons.com/u/ZIRANHAMA)\ **Post date:** [April 11, 2021, 7:38pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/33 "2021-04-11T19:38:32Z")
Hi, will this setup also work if my outside interface let’s say on-site B is getting its IP address from DHCP which is a 4G router, will I need to configure the IP address DHCP set route command? Many Thanks ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [April 13, 2021, 7:27am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827/34 "2021-04-13T07:27:38Z")
Hello Ziran This depends upon how your setup is configured. For your site B, you are using a 4G router as the outside internet-facing interface. From my understanding, your ASA is behind the 4G router, and is getting its outside interface IP address via DHCP from the 4G router. I am assuming that the 4G router is performing NAT in order to give the ASA access to the Internet. The `IP address DHCP set route` command is used in order to set the next-hop IP address for a particular interface. This will resolve the default routing capabilities and configuration of the ASA. In the lesson, all ASAs are directly connected to the same outside network and are directly accessible. However, the configuration will work for any dynamic peer that is behind a NAT device, such as your 4G router. For the creation of a dynamic peer where the ASA is behind any device that is operating NAT, then you must enable NAT-T. This is further described in the following two documents: > **[Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6 -...](https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/vpn_ike.html#35652)** > > Configuring IPSec and ISAKMP > **[Configure ASA-to-ASA Dynamic-to-Static IKEv1/IPsec](https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119007-config-asa9x-ike-ipsec-00.html)** > > This document describes how to enable the ASA to accept dynamic IPsec site-to-site VPN connections from any dynamic peer. I hope this has been helpful! Laz [Previous page](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn-dynamic-peers/827.md?page=1)