# Cisco ASA Site-to-Site IPsec VPN Digital Certificates **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 19, 2016, 4:40pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828 "2016-12-19T16:40:18Z")\ **Posts on this page:** 1\ **Showing post:** 20
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [June 25, 2021, 5:16am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/20 "2021-06-25T05:16:21Z")
Hello James Thanks for the detailed post! In order to make this work, keep the following in mind: The difference between site-to-site and hub-and-spoke is that you need to add some extra commands: - Static routes - Access-list entries - Crypto map change on ASA1. Also you must add one new command on ASA1: `same-security-traffic permit intra-interface` This permits the ASA to receive and transmit packets out of the same interface (OUTSIDE). @ReneMolenaar has gone to the trouble of labbing this one up and he has come up with the following full configs: **ASA1** ``` hostname ASA1 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.1.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.1 255.255.255.0 ! same-security-traffic permit intra-interface ! access-list ASA1_ASA2 extended permit ip host 192.168.1.1 host 192.168.2.2 access-list ASA1_ASA2 extended permit ip host 192.168.3.3 host 192.168.2.2 access-list ASA1_ASA3 extended permit ip host 192.168.1.1 host 192.168.3.3 access-list ASA1_ASA3 extended permit ip host 192.168.2.2 host 192.168.3.3 ! route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.2 1 route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.3 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto ipsec security-association pmtu-aging infinite crypto map MY_CRYPTO_MAP 10 match address ASA1_ASA2 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.2 192.168.123.3 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP 20 match address ASA1_ASA3 crypto map MY_CRYPTO_MAP 20 set peer 192.168.123.3 crypto map MY_CRYPTO_MAP 20 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.2 type ipsec-l2l tunnel-group 192.168.123.2 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO tunnel-group 192.168.123.3 type ipsec-l2l tunnel-group 192.168.123.3 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end ``` **ASA2** ``` hostname ASA2 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.2.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.2 255.255.255.0 ! access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.1.1 access-list ASA2_ASA1 extended permit ip host 192.168.2.2 host 192.168.3.3 ! route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1 route OUTSIDE 192.168.3.0 255.255.255.0 192.168.123.1 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto ipsec security-association pmtu-aging infinite crypto map MY_CRYPTO_MAP 10 match address ASA2_ASA1 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.1 type ipsec-l2l tunnel-group 192.168.123.1 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end ``` **ASA3** ``` hostname ASA3 ! interface GigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.3.254 255.255.255.0 ! interface GigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.123.3 255.255.255.0 ! access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.1.1 access-list ASA3_ASA1 extended permit ip host 192.168.3.3 host 192.168.2.2 ! route OUTSIDE 192.168.1.0 255.255.255.0 192.168.123.1 1 route OUTSIDE 192.168.2.0 255.255.255.0 192.168.123.1 1 ! crypto ipsec ikev2 ipsec-proposal MY_PROPOSAL protocol esp encryption aes protocol esp integrity sha-256 ! crypto map MY_CRYPTO_MAP 10 match address ASA3_ASA1 crypto map MY_CRYPTO_MAP 10 set peer 192.168.123.1 crypto map MY_CRYPTO_MAP 10 set ikev2 ipsec-proposal MY_PROPOSAL crypto map MY_CRYPTO_MAP interface OUTSIDE ! crypto ikev2 policy 10 encryption aes integrity sha group 14 prf sha lifetime seconds 86400 crypto ikev2 enable OUTSIDE ! tunnel-group 192.168.123.1 type ipsec-l2l tunnel-group 192.168.123.1 ipsec-attributes ikev2 remote-authentication pre-shared-key CISCO ikev2 local-authentication pre-shared-key CISCO ! : end ``` Let us know how you get along! I hope this has been helpful! Laz --- _[View the full topic](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828)._