Configuring a VTI Tunnel on ASA

Altı sonra doldurulacak.

https://integratingit.wordpress.com/2018/06/09/configuring-a-vti-tunnel-between-asa-firewall-and-ios-router/

https://theworldsgonemad.net/2021/vti-vpn-asa-to-asr/

https://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629.html#:~:text=VIRTUAL%20TUNNEL%20INTERFACES,ensure%20delivery%20to%20specific%20destinations.

https://community.fortinet.com/t5/FortiGate/Configuration-Example-IPsec-VPN-between-a-FortiGate-unit-and/ta-p/193371#:~:text=Configuration%20Example%3A%20IPsec%20VPN%20between%20a%20FortiGate%20unit%20and,router%20using%20VTI%20with%20OSPF&text=This%20configuration%20example%20is%20a,Pre%2DShared%20Key%20for%20security.

https://networklessons.com/cisco/ccie-routing-switching-written/ipsec-static-virtual-tunnel-interface

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Route-based-VPN-can-establish-an-IPsec-tunnel-with/ta-p/246669

https://www.gns3network.com/how-to-setup-ipsec-tunnel-between-palo-alto-and-fortigate-firewall/

Cisco ASA IPsec setup

Cisco ASA has a different way setting up Phase1/Phase2 parameters for an IPsec tunnel. Where other vendors have specific menu/commands to enter the specific Phase1/Phase2 parameters, here we have groups of commands to accomplish basically the same thing.

PHASE 1

Enter your acceptable Phase1 parameters which will be offered for negotiation with the other ipsec peer.

For IKEv1:

#crypto ikev1 policy 10
   encryption 3des
   hash sha
   group 2
   lifetime 28800

#crypto ikev1 policy 20
   authentication rsa-sig
   encryption aes-256
   hash sha
   group 5
   lifetime 86400

   authentication pre-share

or for IKEv2:

#crypto ikev2 policy 2

   encryption aes-256

   integrity sha

   group 14

   prf sha

   lifetime seconds 86400

Then you setup the "tunnel-group" for attributes and most importantly pre-shared key (or certificate)

#tunnel-group 182.11.104.167 type ipsec-l2l

#tunnel-group 182.11.104.167 general-attributes

   default-group-policy Turkcell_GroupPolicy2

#tunnel-group 182.11.104.167 ipsec-attributes

   ikev1 pre-shared-key *****

PHASE 2

#crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

#crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

#crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

#crypto ipsec ikev2 ipsec-proposal STRONGPROPOSAL

   protocol esp encryption aes-256

   protocol esp integrity sha-1

#crypto ipsec ikev2 ipsec-proposal WEAKPROPOSAL 

   protocol esp encryption 3des

   protocol esp integrity sha-1

Here's where we define the interesting traffic and 

IKEv1 example cryptomap entry:

crypto map outside_map1 1 match address outside_cryptomap

crypto map outside_map1 1 set pfs group5

crypto map outside_map1 1 set peer 182.11.104.167

crypto map outside_map1 1 set ikev1 transform-set ESP-AES-256-SHA

crypto map outside_map1 1 set security-association lifetime seconds 28800

an IKEv2 example cryptomap entry:

crypto map internet_map0 1 match address internet_cryptomap

crypto map internet_map0 1 set peer 182.11.104.167

crypto map internet_map0 1 set ikev2 ipsec-proposal AES256-SHA1

crypto map internet_map0 interface internet

Running ASA and ASDM using GNS3/Qemu

Finally got ASA and ASDM to work nicely with GNS3.
Here's my setup:

GNS3 v0.7
Qemu (The one that comes with GNS3 v0.7)
ASA 802-k8 (files needed for Qemu are: asa802-k8.initrd.gz & asa802-k8.kernel)
ASDM 6.0(2)
Fiddler (Instructions to configure it are here)

To get ASDM to connect with ASA, you must use Fiddler to intercept the HTTPS stream and modify it to correct some of Qemu's shortcomings.
Then set your JRE to use fiddler as proxy.
All instructions can be found in the lengthy discussion at hacki.at. Make sure to read pages 17,18,+

Steps for migrating from PIX to ASA

You should be running v7.x on your PIX so that your configuration can be converted properly. Two ways of going about this:

* Tool-Assisted Conversion (Link)
* Manual Conversion

I'll covert the manual method here.
Upgrading your PIX to v7.x

1. Get copies of your config and version/license info

# show running
# write net
# show version

2a. If BIOS is earlier than 4.2, use Monitor Mode instead of copy tftp flash

Reboot and press BREAK or ESC during boot to enter Monitor Mode

monitor>interface
monitor>address
monitor>server
monitor>gateway
monitor>ping
monitor>file
monitor>tftp

PIX will automatically boot, but the software upgrade is only done in Memory, you MUST you go through the steps below to complete the upgrade!

2b. Upgrade System software

#enable
#copy tftp: flash:
Address or name of remote host []? 10.1.6.44
Source filename []? pix701.bin
Destination filename [pix701.bin]?

3. Now you have upgraded your software and your config was auto converted to v7.x
You should go through and check the changes made, which could be very different from your older pix config.

4. Use this config in your ASA appliance. Do this either with the Copy/Paste method, or via a tftp/ftp config file transfer.



Ref: Migration from PIX 500 Series Security Appliances to ASA 5500 Series Adaptive Security Appliances