Cisco ASA Site-to-Site IKEv2 IPSEC VPN

Hello Cemil

If you create multiple VPNs on an ASA, you can use the same phase 1 policy for all of them assuming the policy is valid and configured on the other end of each VPN as well. Note that you don’t actually choose the policy, but the polices are defined with their priority numbers. You can assign up to 20 IKE policies. How they are applied is described in this Cisco documentation like so:

When IKE negotiations begin, the peer that initiates the negotiation sends all of its policies to the remote peer, and the remote peer tries to find a match. The remote peer checks all of the peer’s policies against each of its configured policies in priority order (highest priority first) until it discovers a match.

A match exists when both policies from the two peers contain the same encryption, hash, authentication, and Diffie-Hellman parameter values. For IKEv1, the remote peer policy must also specify a lifetime less than or equal to the lifetime in the policy the initiator sent. If the lifetimes are not identical, the ASA uses the shorter lifetime. For IKEv2 the lifetime is not negotiated but managed locally between each peer, making it possible to configure lifetime independently on each peer. If no acceptable match exists, IKE refuses negotiation and the SA is not established.

So for each VPN you create, the policies are examined one at a time until a match is made between the two endpoints.

I hope this has been helpful!

Laz