Cisco ASA Site-to-Site VPN (IPsec IKEv2)
Site-to-site IPsec VPN configuration between two Cisco ASA firewalls using IKEv2 — the modern, more secure replacement for IKEv1.
What is it?
A site-to-site IPsec VPN creates an encrypted tunnel between two locations — for example, headquarters and a branch office. All traffic between the two sites flows through the tunnel, encrypted and protected from interception. IKEv2 (Internet Key Exchange version 2) is the modern standard — it's faster to negotiate, more resilient to network interruptions, and more secure than IKEv1. The ASA handles both the IKEv2 negotiation (Phase 1) and the IPsec data encryption (Phase 2) automatically.
When to use
- ·Connecting branch offices to headquarters over the internet
- ·Securing communication between a cloud environment (AWS, Azure) and your on-premises network
- ·Replacing expensive MPLS circuits with internet + VPN for WAN connectivity
- ·Connecting partner networks with specific traffic requirements
When NOT to use
- ·Remote users working from home — use AnyConnect (SSL VPN) instead
- ·When latency is critical and you have budget — MPLS provides guaranteed QoS that VPN cannot
- ·When both sites use dynamic public IPs — consider DMVPN on IOS instead
How it compares
Prerequisites
- →Both ASA firewalls must have static public IP addresses (or use dynamic crypto maps for dynamic IPs)
- →Both sides must agree on the same IKEv2 policy parameters (encryption, integrity, DH group)
- →NAT exemption must be configured if the ASA is also doing NAT — otherwise VPN traffic gets NATted before the crypto ACL matches
- →The outside interface must allow UDP 500 and UDP 4500 inbound from the peer IP
- →Both sites must have non-overlapping internal IP ranges
Config Generator
Use a descriptive name for the remote site
Prevents the ASA from NATting VPN traffic
Verification commands
show crypto ikev2 saVerify IKEv2 Phase 1 (IKE SA) is established
ExpectedShould show the peer IP with state 'READY'. If empty, Phase 1 failed.
show crypto ipsec saVerify IPsec Phase 2 (data tunnel) is established and passing traffic
ExpectedShows encaps/decaps counters — these should be incrementing if traffic is flowing. Check 'pkts encrypt' and 'pkts decrypt'.
show vpn-sessiondb l2lShow active site-to-site VPN sessions with bytes transferred
ExpectedLists active tunnels with remote IP, protocol, and data counters
Debug commands
debug crypto ikev2 protocol 255Debug IKEv2 negotiation — shows Phase 1 exchange step by step
WarningVery verbose. Capture output quickly and run 'no debug all' immediately after. Do not use in production during business hours.
debug crypto ipsec 255Debug IPsec Phase 2 negotiation
WarningVerbose. Use 'no debug all' after.
Common mistakes & fixes
Further learning
Recommended books to go deeper on this topic.
Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services
Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · Site-to-site IPsec, IKEv1/v2, crypto maps, tunnel interfaces
IKEv2 IPsec Virtual Private Networks — Understanding and Deploying IKEv2, IPsec VPNs, and FlexVPN in Cisco IOS
Graham Bartlett, Amjad Inamdar · Cisco Press · The definitive IKEv2 and FlexVPN reference — crypto fundamentals, keyring, profiles, DVTI, spoke-to-spoke
CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide
Joseph Muniz, Steven Chimes, James Risler · Cisco Press · The only Cisco-approved SVPN study guide — covers DMVPN, FlexVPN, GETVPN, AnyConnect, and IKEv2 in depth
Network Security Technologies and Solutions
Yusuf Bhaiji · Cisco Press · CCIE Professional Development · Comprehensive CCIE Security reference — IPsec, IKE, VPN, AAA, PKI, firewalls all in one volume
CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide
Omar Santos · Cisco Press · Required for CCNP/CCIE Security — covers VPN, cryptography, network security architecture