How To Establish IPSec VPN Tunnel between Cyberoam and Cisco ASA using Preshared key How To Establish IPSec VPN Tunnel Between Cyberoam and Cisco ASA using Preshared Key Product: The information in this article is based on Cyberoam Version 10.00 onwards and Cisco ASA. Applicable to Version: 10.00 onwards This article describes a detailed configuration example that demonstrates how to set up a Site-to-Site IPSec VPN connection between Cyberoam and Cisco ASA using preshared key to authenticate VPN peers. Throughout the article we will use the default VPN policy provided by Cyberoam and network parameters as shown in the diagram below. This document has 2 sections: Cisco ASA Configuration Cyberoam Configuration
Cisco ASA Configuration The entire configuration is to be done from Web Admin Console. Access Web Admin Console with user having Administrator profile. Step 1: Configuration Wizard Go to Configuration VPN VPN Wizard to configure Site-to-Site VPN Tunnels and then click on Launch VPN Wizard. Step 2: Configure VPN Tunnel Type Follow the On-Screen steps after clicking on Launch VPN Wizard. Select the VPN Tunnel Type as Site-to- Site and VPN Tunnel Interface as outside and click Next.
Step 3: Configuring Remote Site Peer Parameters Create a Remote Site Peer configuration as shown below and then Click Next. Parameters Value Peer IP Address 202.134.168.202 WAN IP/Public IP address of the Cyberoam Authentication Method Pre-shared Key Pre-shared Key 0123456789 Tunnel Group Name (As per your requirement. Same as configured in the Cyberoam) CR_2_ASA
Step 4: Configuring IKE Policy Parameters Configure Internet Key Exchange (IKE) Parameters and then Click Next. Parameters Encryption Authentication Diffie-Hellman Group Value 3DES MD5 2
Step 5: Creating IPSec Rule Select the encryption and authentication algorithms and configure Perfect Forwarding Secrecy (PFS) for this IPSec VPN Tunnel and then Click Next. Parameters Encryption Authentication Perfect Forwarding Secrecy (PFS) Diffie-Hellman Group Value 3DES MD5 Enable 2
Step 6: Configuring IPSec Parameters Create/Identify hosts and networks to be used in the IPSec Tunnel. Parameters Value Source Settings Type IP Address IP Address 172.50.50.0 LAN of Cisco ASA Netmask 255.255.255.0 Destination Settings Type IP Address IP Address 172.16.16.0 LAN of Cyberoam Netmask 255.255.255.0
Click and a screen will appear as shown in the below screenshot. Then Click on Add button to Add a new Network Object. Create Network Object for Cisco ASA Parameters Value Name CiscoASA_LAN IP Address 172.50.50.0 Netmask 255.255.255.0
Create Network Object for Cyberoam Parameters Value Name CR_LAN IP Address 172.16.16.0 Netmask 255.255.255.0
Select the Network Object for Source and Destination and Click OK. It will be placed in the appropriate field and Then Click Next. Step 6: Summary of VPN Tunnel Created A Site-to-Site VPN Tunnel will be created with the attributes as shown in the below screen:
Click Finish and the VPN Tunnel will be created successfully.
Cyberoam Configuration The entire configuration is to be done from Web Admin Console. Access Web Admin Console with user having Administrator profile. Step 1: Create IPSec connection Go to VPN IPSec Connection and click on Add button to create Connection with the following values: Parameters General Settings Name Connection Type Policy Action on VPN Restart Value CR_2_ASA Site to Site DefaultHeadOffice Respond Only Authentication Details Authentication Type Preshared Key Confirm Preshared Key Preshared Key Specify the preshared key to be used. Forward this key to the remote peer (SonicWall) as same preshared key should be used by both the peers. At the remote end, client will have to specify this key for authentication. In SonicWall, preshared key is called Shared Secret or Preshared Secret. Specify preshared key again for confirmation Local Network Details
202.134.168.202 Local WAN Port Select WAN port which acts as end-point to the tunnel 172.16.16.0/24 Local Subnet Select Local LAN Address. Remote Network Details Remote VPN Sever 202.134.168.208 Remote Subnet 172.50.50.0/24 Click on OK and the IPSec Connection CR_2_ASA will be added successfully.
Step 2: Activate Connection Go to VPN IPSec Connection and click under Status against the CR_2_ASA connection to activate the connection. under Status indicates that the connection is successfully activated. Note At a time only one connection can be active if both the types of connection - Digital Certificate and Preshared Key - are created with the same source and destination. In such situation, at the time of activation, you will receive error Unable to activate connection hence you need to deactivate all other connections. Document Version 1.0 30/06/2011 The Corporate and individual names, data and other configuration & network parameters images in this document are for demonstration purposes only and does not reflect the real data.