Hello James
Thanks for the detailed post! In order to make this work, keep the following in mind:
The difference between site-to-site and hub-and-spoke is that you need to add some extra commands:
- Static routes
- Access-list entries
- Crypto map change on ASA1.
Also you must add one new command on ASA1:
same-security-traffic permit intra-interface
This permits the ASA to receive and transmit packets out of the same interface (OUTSIDE).
@ReneMolenaar has gone to the trouble of labbing this one up and he has come up with the following full configs:
ASA1
hostname ASA1
!
interface GigabitEthernet0/0
nameif INSIDE
security-level 100
ip address 192.168.1.254 255.255.255.0
!
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address 192.168.123.1 255.255.255.0
!
same-security-traffic permit intra-interface
!
access-list ASA1_ASA2 extended permit ip host 192.168.1.1 host 192.168.2.2
access-list ASA1_ASA2 extended permit ip host 192.168.3.3 host 192.168.2.2
access-list ASA1_ASA3 extended permit ip host 192.168.1.1 host 192.168.3.3
access-list ASA1_ASA3 extended permit ip host 192.168.2.2 host 192.168.3.3
!
route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.2 1
route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.3 1
!
crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL
protocol esp encryption aes
protocol esp integrity sha-256
!
crypto ipsec security-association pmtu-aging infinite
crypto map MY_CRYPTO_MAP 10 match address ASA1_ASA2
crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.2 192.168.123.3
crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL
crypto map MY_CRYPTO_MAP 20 match address ASA1_ASA3
crypto map MY_CRYPTO_MAP 20 set peer 192.168.123.3
crypto map MY_CRYPTO_MAP 20 set ikev2 ipsec-proposal MY_PROPOSAL
crypto map MY_CRYPTO_MAP interface OUTSIDE
!
crypto ikev2 policy 10
encryption aes
integrity sha
group 14
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE
!
tunnel-group 192.168.123.2 type ipsec-l2l
tunnel-group 192.168.123.2 ipsec-attributes
ikev2 remote-authentication pre-shared-key CISCO
ikev2 local-authentication pre-shared-key CISCO
tunnel-group 192.168.123.3 type ipsec-l2l
tunnel-group 192.168.123.3 ipsec-attributes
ikev2 remote-authentication pre-shared-key CISCO
ikev2 local-authentication pre-shared-key CISCO
!
: end
ASA2
hostname ASA2
!
interface GigabitEthernet0/0
nameif INSIDE
security-level 100
ip address 192.168.2.254 255.255.255.0
!
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address 192.168.123.2 255.255.255.0
!
access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.1.1
access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.3.3
!
route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1
route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.1 1
!
crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL
protocol esp encryption aes
protocol esp integrity sha-256
!
crypto ipsec security-association pmtu-aging infinite
crypto map MY_CRYPTO_MAP 10 match address ASA2_ASA1
crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1
crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL
crypto map MY_CRYPTO_MAP interface OUTSIDE
!
crypto ikev2 policy 10
encryption aes
integrity sha
group 14
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE
!
tunnel-group 192.168.123.1 type ipsec-l2l
tunnel-group 192.168.123.1 ipsec-attributes
ikev2 remote-authentication pre-shared-key CISCO
ikev2 local-authentication pre-shared-key CISCO
!
: end
ASA3
hostname ASA3
!
interface GigabitEthernet0/0
nameif INSIDE
security-level 100
ip address 192.168.3.254 255.255.255.0
!
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address 192.168.123.3 255.255.255.0
!
access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.1.1
access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.2.2
!
route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1
route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.1 1
!
crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL
protocol esp encryption aes
protocol esp integrity sha-256
!
crypto map MY_CRYPTO_MAP 10 match address ASA3_ASA1
crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1
crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL
crypto map MY_CRYPTO_MAP interface OUTSIDE
!
crypto ikev2 policy 10
encryption aes
integrity sha
group 14
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE
!
tunnel-group 192.168.123.1 type ipsec-l2l
tunnel-group 192.168.123.1 ipsec-attributes
ikev2 remote-authentication pre-shared-key CISCO
ikev2 local-authentication pre-shared-key CISCO
!
: end
Let us know how you get along!
I hope this has been helpful!
Laz