Cisco Secure Access Help

PDF

Cisco Secure Access Help

Configure Tunnels with Cisco Adaptive Security Appliance

Updated: August 24, 2026

Want to summarize with AI?

Log in

Understand how to connect a Cisco Adaptive Security Appliance (ASA) firewall to Cisco Secure Access using one or two IKEv2 IPsec tunnels via Virtual Tunnel Interfaces (VTI).

This guide walks you through connecting a Cisco Adaptive Security Appliance (ASA) firewall to Cisco Secure Access using one or two IKEv2 IPsec tunnels via Virtual Tunnel Interfaces (VTI).

Before you begin

Table 1. Cisco Secure Access requirements
Requirement Details
Cisco Secure Access account A valid, active account
Organization ID Refer to Find Your Organization ID
Network Tunnel Group Must be pre-configured in Secure Access. Refer to Add a Network Tunnel Group
Tip

When adding a network tunnel group, select the data center closest to your ASA's geographic location to minimize latency.

Table 2. Cisco ASA requirements
Requirement Details
Hardware Cisco ASA firewall
Licensing Security K9 license and ASA Base or Security Plus license
Software ASA 9.x with IKEv2 support (refer to ASA version and NAT and IKEv2 identity below)
Table 3. Network requirements
Requirement Details
UDP port 500 Open outbound (IKE negotiation)
UDP port 4500 Open outbound (NAT Traversal)
Outbound connectivity No firewall blocks to Cisco Secure Access data center IPs

Your ASA software version determines how IKEv2 identity is handled and whether the ASA can operate behind NAT.

Table 4. ASA version and NAT and IKEv2 identity
ASA 9.16 and Earlier ASA 9.17 and Later
NAT support Not supported — ASA must not be behind NAT Supported — ASA can be behind NAT
IKEv2 identity Automatically uses the interface IPv4 address Supports per-tunnel identity and FQDN identity
External interface IP Must be a static, publicly routable IPv4 address configured directly on the ASA interface No restriction
Secure Access tunnel type Standard configuration Set Tunnel Type to Other and Authentication to FQDN
Additional ASA config None Add to IPsec profile: set ikev2 local-identity email-id <tunnel-identity>@<org-id>.sse.com

On ASA 9.16 and earlier, the ASA automatically uses its external interface IPv4 address as the IKEv2 identity. This identity, combined with the pre-shared key (PSK), authenticates the tunnel. If NAT translates this address, the IKEv2 identity will not match what Secure Access expects, and authentication will fail.

ASA 9.17 introduced the ability to explicitly set a per-tunnel FQDN identity, decoupling the IKEv2 identity from the interface address. This resolves the NAT identity mismatch.

If your ASA is on version 9.16 or earlier and is behind NAT, the tunnel will not establish. Either assign a static public IP directly on the ASA's external interface, or upgrade to ASA 9.17 or later.

Note

The <tunnel-identity> and <org-id> values in the set ikev2 local-identity command are generated when you configure the network tunnel group in Secure Access. Refer to Add a Network Tunnel Group for details.

Procedure

  1. Gather the following from the Cisco Secure Access dashboard after you create your Network Tunnel Group. Refer to Add a Network Tunnel Group for instructions.

    Value Description Used in
    Primary data center IP IP address of the primary Secure Access data center Steps 3, 5
    Secondary data center IP IP address of the secondary Secure Access data center Step 6
    Primary tunnel ID Tunnel identity for the primary tunnel Steps 3, 5
    Secondary tunnel ID Tunnel identity for the secondary tunnel Step 6
    Passphrase Pre-shared key configured for the tunnel group Step 3

  2. Configure the IKEv2 policy

    1. Define the IKEv2 policy settings according to the Supported IPsec Parameters.
    2. Choose the policy number based on your ASA's existing policies. In the following example, the policy number is 10.
    3. Replace outside with the name of the public-facing interface your ASA uses for VPN connectivity, if different.
    crypto ikev2 policy 10
  encryption aes-gcm-256
  integrity null
  group 19
  lifetime seconds 86400
crypto ikev2 enable outside

  3. Configure the Group Policy and Tunnel Group

    1. Configure the group policy and tunnel group for the primary data center connection.
    2. Replace the following placeholders. Refer to Add a Network Tunnel Group.
      Placeholder Replace With
      <Primary data center IP address> IP address of the primary Secure Access data center
      <Portal_Tunnel_Passphrase> The passphrase you configured for the network tunnel group 
      group-policy sse-policy internal
group-policy sse-policy attributes 
   vpn-tunnel-protocol ikev2
 
tunnel-group <Primary data center IP address> type ipsec-l2l
tunnel-group <Primary data center IP address> general-attributes 
  default-group-policy sse-policy
tunnel-group <Primary data center IP address> ipsec-attributes 
  ikev2 remote-authentication pre-shared-key 0 \[Portal_Tunnel_Passphrase\]
  ikev2 local-authentication pre-shared-key 0 \[Portal_Tunnel_Passphrase\]
      Tip
      Validate that the crypto isakmp identity command is set to the default value auto. This ensures the correct ID method is used for ISAKMP peers.

  4. Configure the IPsec Proposal and Profile (Primary tunnel)

    1. Define the IPsec proposal and profile according to the Supported IPsec Parameters.
    2. Replace <Primary tunnel ID> with the tunnel identity for your primary tunnel from the Secure Access dashboard.
    crypto ipsec ikev2 ipsec-proposal Secure-Access-Ipsec-Proposal
  protocol esp encryption aes-gcm-256
  protocol esp integrity sha-1

crypto ipsec profile Secure-Access-Primary
  set ikev2 ipsec-proposal Secure-Access-Ipsec-Proposal
  !
  !Note: below command applies for v9.17+ only
  set ikev2 local-identity email-id <Primary tunnel ID>
    Note
    The set ikev2 local-identity command applies to ASA 9.17 and later only. Omit this line for ASA 9.16 and earlier.

  5. Create the Virtual Tunnel Interface (Primary tunnel)

    1. Create a VTI for the primary tunnel.
    2. Replace the following placeholders:
      Placeholder Replace With
      <Primary data center IP address> IP address of the primary Secure Access data center
      <VTI IP address> <subnet mask> An unused IP address and subnet not assigned to any existing VLAN, subnet, or interface in your network (for example, 169.254.1.1 255.255.255.252) 
      interface Tunnel1
   nameif vti
   ip address <VTI IP address> <subnet mask>
   tunnel source interface outside
   tunnel destination <Primary data center IP address>
   tunnel mode ipsec ipv4
   tunnel protection ipsec profile Secure-Access-Primary

  6. Configure the Secondary tunnel

    To add a secondary tunnel for redundancy, repeat Steps 3 through 5 with the following changes:

    Parameter Primary tunnel Secondary tunnel
    Data center IP Primary data center IP Secondary data center IP
    Tunnel ID Primary tunnel ID Secondary tunnel ID
    IPsec profile name Secure-Access-Primary Secure-Access-Secondary
    VTI interface name Tunnel1 / vti-primary Tunnel2 / vti-secondary
    VTI IP address From one unused subnet From a different unused subnet
    Note
    The group policy (sse-policy) and IPsec proposal (Secure-Access-Ipsec-Proposal) created in Steps 2 and 3 can be reused. You must create a separate IPsec profile and VTI for the secondary tunnel.

  7. Configure policy-based routing (PBR)

    1. Configure PBR to direct internal traffic through the tunnel interface to Secure Access.
    2. In the following example:

      • LAN subnet: 192.168.20.0/24

      • LAN interface: GigabitEthernet1/2

      • Next-hop IP: An IP address in the same subnet assigned to the primary VTI

    access-list ACL-sse line 1 extended permit ip 192.168.20.0 255.255.255.0 any4
 
route-map sse-PBR permit 10
  match ip address ACL-sse
  set ip next-hop x.x.x.2
 
interface GigabitEthernet1/2
  policy-route route-map sse-PBR

  8. Verify the tunnel

    1. Check IKEv2 and IPsec status: Run the following commands from the ASA CLI. 
      show crypto ikev2 sa detail
show crypto ipsec sa detail
    2. Simulate traffic with packet tracer: Use the packet-tracer command to confirm that traffic from the inside interface routes through the tunnel. 
      packet-tracer input inside tcp <source IP> <source port> <destination IP> <destination port> detailed

      Example:

      packet-tracer input inside tcp 192.168.20.13 3520 72.163.4.161 443 detailed
    In a successful configuration, the output includes the following key phases:
    Phase Type Expected result What it confirms
    1 ACCESS-LIST ALLOW Traffic is permitted on the inside interface
    2 PBR-LOOKUP ALLOW Policy-based routing matches the route map and identifies the VTI as the egress interface
    5 VPN (encrypt) ALLOW Traffic is selected for encryption on the VTI
    6 VPN (ipsec-tunnel-flow) ALLOW IPsec tunnel flow is established
    9 FLOW-CREATION ALLOW A new traffic flow is created and dispatched

    The final Result section should show:

    output-interface: vti
Action: allow
    Note
    If any phase shows DROP or if the output interface is not vti, review your PBR configuration, tunnel group settings, and IPsec profile.

After completing this guide, your ASA will:

  • Establish two authenticated IKEv2 IPsec tunnels to Secure Access

  • Route designated internal traffic through the tunnel via policy-based routing

  • Authenticate using a pre-shared key combined with IKEv2 identity

  • Connect to the nearest Cisco Secure Access data center(s)