Site-to-Site VPN configuration for FDM-Managed

• Configuration Name: Enter a unique topology name.

  We recommend naming your topology to indicate that it is an FDM-managed device VPN, and its topology type.

• Peer 1: Click the FDM tab and select an FDM-managed device.

• Peer 2: Click the FDM tab and select an FDM-managed device.

  If you choose an extranet device, select Static and specify an IP address or select Dynamic for extranet devices with DHCP assigned IP. The IP Address displays the IP address for static interface or DHCP Assigned for the dynamic interface.

  Note

  If one or both endpoint devices have dynamic IP addresses, see Configure Site-to-Site VPN Connections with Dynamically-Addressed Peers for additional instructions.

• VPN Access Interface: Select the interface to establish a connection between peer 1 and peer 2.

• Routing: Click Add Networks and select one or more protected networks to establish a site-to-site tunnel between the protected networks of peer 1 and peer 2

• (Optional) NAT Exempt Interface: Select NAT Exempt for peer 1 and peer 2 to exempt the VPN traffic from NAT policies on the local VPN access interface. It must be configured manually for individual peers. If you do not want NAT rules to apply to the local network, select the interface that hosts the local network. This option works only if the local network resides behind a single routed interface (not a bridge group member). If the local network is behind more than one routed interface or one or more bridge group members, you must manually create the NAT exempt rules.

Note

IKE policies are global to a device and apply to all VPN tunnels associated with it. Therefore, adding or deleting policies affect all VPN tunnels in which this device is participating.

1. Select either or both options as appropriate.

   Note

   By default, IKEV Version 2 is enabled.

2. Click Add IKEv2 Policies to select the IKEv2 policies for peer 1 and peer 2.

3. The Local Pre-Shared Key and Remote Pre-Shared Key for the participating devices are auto-genreated. Preshared keys are secret key strings configured on each peer in the connection. These keys are used by IKE during the authentication phase.

4. Click IKE Version 1 to enable it.

5. Click Add IKEv1 Policies to select the IKEv1 policies for peer 1 and peer 2.

6. The IPEv1 Pre-Shared Key is auto-generated.

For more information on the IPSec settings, see the IPsec proposal and IKE policy objects.

1. Click Add IKEv2 IPSec Proposals and select the IKEv2 proposals you want for peer 1 and peer 2.

2. Choose the Diffie-Hellman Group for Perfect Forward Secrecy. For more information, see Deciding Which Diffie-Hellman Modulus Group to Use.

3. Click Next.

Read the configuration and then click Submit if you're satisfied.

Configure AC policies for permitting bidirectional traffic between the protected networks behind both peers. These policies help the packets to traverse to the intended destination without being dropped.

Note

You must create AC policies for incoming and outgoing traffic on both peers.

1. In the Security Cloud Control navigation bar at the left, click Policies and select the option that you want.

2. Create policies for incoming and outgoing traffic on both peers.

   The following example shows steps for creating AC policies on both peers.

   Consider two FDM-managed devices 'FTD_BGL_972' and 'FTD_BGL_973' with Site-To-Site VPN connection between two protected networks 'boulder-network' and 'sanjose-network' respectively.

   Creating the AC policy for permitting incoming traffic:

   The policy 'Permit_incoming_VPN_traffic_from_973' is created on the 'FTD_BGL_972' device for allowing incoming traffic from the peer ('FTD_BGL_973').

   

   • Source Zone: Set the zone of the peer device from which the network traffic originates. In this example, the traffic is originating from FTD_BGL_973 and reaching FTD_BGL_972.

   • Source Network: Set the protected network of the peer device from which the network traffic originates. In this example, traffic is originating from 'sanjose-network' which is the protected network behind the peer device (FTD_BGL_973).

   • Destination Network: Set the protected network of the device on which the network traffic arrives. In this example, traffic is arriving at 'boulder-network' which is the protected network behind the peer device (FTD_BGL_972). Note: The remaining fields can have the default value ("Any").

   • Set Action to Allow for allowing the traffic subject to the intrusion and other inspection settings in the policy.

   Creating the AC policy for permitting outgoing traffic:

   The policy 'Permit_outgoing_VPN_traffic_to_973' is created on the 'FTD_BGL_972' device for permitting outgoing traffic to the peer ('FTD_BGL_973').

   

   • Source Network: Set the protected network of the peer device from which the network traffic originates. In this example, traffic is originating from 'boulder-network' which is the protected network behind the peer device (FTD_BGL_972).

   • Destination Zone: Set the zone of the peer device on which the network traffic arrives. In this example, the traffic is arriving from FTD_BGL_972 and reaching FTD_BGL_973.

   • Destination Network: Set the protected network of the peer on which the network traffic arrives. In this example, traffic is arriving on 'sanjose-network' which is the protected network behind the peer device (FTD_BGL_972). Note: The remaining fields can have the default value ("Any").

   • Set Action to Allow for allowing the traffic subject to the intrusion and other inspection settings in the policy.

After creating AC policies on one device, you must create similar policies on its peer.

For more information, see Configure Routing.

1. Gateway-Select the network object that identifies the IP address for the gateway to the destination network. Traffic is sent to this address.

2. Interface-Select the interface through which you want to send traffic. In this example, the traffic is sent through 'outside' interface.

3. Destination Networks-Select one or network objects, that identify the destination network. In this example, the destination is 'sanjose-network' which is behind peer (FTD_BGL_973).

After configuring routing settings on one device, you must configure similar settings on its peer.

Note

Alternatively, you can perform the following to edit the configuration:

1. Open the VPN page and click Global View button in the filter panel (for more information, see Global View).

   The illustration of all site-to-site VPN tunnels available across all devices appears.

   To edit the configuration, one of the peers must be FDM-managed device.

2. Select a device by clicking the box.

3. Click View details to view its peers.

4. Click the peer device to view the tunnel details.

   You can view the tunnel details, NAT information, and key exchange information pertaining to the device.

   

5. Click Edit in Tunnel Details.

Note

You cannot change the participating devices.

1. Click the blue plus button for the respective device and select new IKEv2 policies. To delete an existing IKEv2 Policy, hover-over the selected policy and click the x icon.

2. Modify the Pre-Shared Key for the participating devices. If the pre-shared keys are different for endpoint devices, click the blue settings button and enter the appropriate pre-shared keys for the devices.

3. Click Next.

1. Click the blue plus button to select new IKEv2 proposals. To delete an existing IKEv2 Proposal, hover-over the selected proposal and click the x icon.

2. Choose the Diffie-Hellman Group for Perfect Forward Secrecy.

3. Click Edit VPN, and then Finish.

1. In the left pane, click Objects.

2. Click the blue plus button to create an object.

3. Click ASA > Network.

4. Identify the Boulder inside network.

5. Enter an object name (for example, boulder-network).

6. Select Create a network object.

7. In the Value section:

   • Select eq and enter a single IP address or a subnet address expressed in CIDR notation.

   • Select range and enter an IP address range. For example, enter the network address as 10.1.1.0/24.

     

8. Click Add.

9. Click the blue plus button to create an object.

10. Define the inside San Jose network.

11. Enter the object name (for example, san-jose).

12. Select Create a network object.

13. In the Value section:

    • Select eq and enter a single IP address or a subnet address expressed in CIDR notation.

    • Select range and enter an IP address range. For example, enter the network address as 10.1.1.0/24.

      

14. Click Add.

1. In the left pane, click Security Devices > All Devices.

2. Use the filter to find the device for which you want to create the NAT rule.

3. In the Management area of the details panel, click NAT .

4. Click > Twice NAT.

   • In section 1, select Static. Click Continue.

   • In section 2, select Source Interface = inside and Destination Interface = outside. Click Continue.

   • In section 3, select Source Original Address = 'boulder-network' and Source Translated Address = 'boulder-network'.

   • Select Use Destination.

   • Select Destination Original Address = 'sanjose-network' and Source Translated Address = 'sanjose-network'. Note: Because you do not want to translate the destination address, you need to configure identity NAT for it by specifying the same address for the original and translated destination addresses. Leave all of the port fields blank. This rule configures identity NAT for both source and destination.

     

   • Select Disable proxy ARP for incoming packets.

   • Click Save.

   • Repeat the process to create equivalent rules for each of the other inside interfaces.

1. Click > Twice NAT.

2. In section 1, select Dynamic. Click Continue.

3. In section 2, select Source Interface = inside and Destination Interface = outside. Click Continue.

4. In section 3, select Source Original Address = 'boulder-network' and Source Translated Address = 'interface'.

   

5. Click Save.

6. Repeat the process to create equivalent rules for each of the other inside interfaces.

• The manual identity NAT rule would be for 'sanjose-network' when the destination is boulder-network. Create new interface objects for the Firewall2 inside and outside networks.

• The manual dynamic interface PAT rule would be for 'sanjose-network' when the destination is "any."