Issue Description
How to build IPSEC VPN between USG6000 and CISCO ASA.
USG6000 version: V100R001C30SPC900
ASA5510 version: 8.2
USG6000 (115.192.185.102) - (125.77.254.53) ASA5510 ipsec interconnection reference.
Handling ProcessUSG configuration:
acl number 3500
rule 5 permit ip source 10.4.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 10 permit ip source 10.4.1.0 0.0.0.255 destination 10.1.0.0 0.0.255.255
rule 15 permit ip source 10.4.1.0 0.0.0.255 destination 10.2.0.0 0.0.255.255
rule 20 permit ip source 10.4.1.0 0.0.0.255 destination 10.3.0.0 0.0.255.255
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
sa duration 28800 //USG is 86400 by default.
ike peer a
pre-shared-key Yealink!123
ike-proposal 1
undo version 2 //suggest to use V1 to build IPSEC with other vendor
remote-address 125.77.254.53
ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm 3des
ipsec policy map1 10 isakmp
security acl 3500
pfs dh-group2
ike-peer a
proposal 1
nat-policy
rule name ipsec
rule 5 permit ip source 10.4.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 10 permit ip source 10.4.1.0 0.0.0.255 destination 10.1.0.0 0.0.255.255
rule 15 permit ip source 10.4.1.0 0.0.0.255 destination 10.2.0.0 0.0.255.255
rule 20 permit ip source 10.4.1.0 0.0.0.255 destination 10.3.0.0 0.0.255.255
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
sa duration 28800 //USG is 86400 by default.
ike peer a
pre-shared-key Yealink!123
ike-proposal 1
undo version 2 //suggest to use V1 to build IPSEC with other vendor
remote-address 125.77.254.53
ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm 3des
ipsec policy map1 10 isakmp
security acl 3500
pfs dh-group2
ike-peer a
proposal 1
nat-policy
rule name ipsec
source-zone trust
source-address 10.4.1.0 24
destination-zone untrust
destination-address 10.1.0.0 16
destination-address 10.2.0.0 16
destination-address 10.3.0.0 16
destination-address 192.168.1.0 24
action no-nat
GigabitEthernet0/0/0
ip address 115.192.185.102 255.255.255.0
ipsec policy map1 auto-neg
action no-nat
GigabitEthernet0/0/0
ip address 115.192.185.102 255.255.255.0
ipsec policy map1 auto-neg
ASA configuration:
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 28800
crypto isakmp key Yealink!123 address 115.192.185.102 //configure pre-share key
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac （equal USG ipsec proposal）
access-list HZhuawei permit ip 192.168.1.0 255.255.0.0 10.4.1.0 255.255.255.0
access-list HZhuawei permit ip 10.1.0.0 255.255.0.0 10.4.1.0 255.255.255.0
access-list HZhuawei permit ip 10.2.0.0 255.255.0.0 10.4.1.0 255.255.255.0
access-list HZhuawei permit ip 10.3.0.0 255.255.0.0 10.4.1.0 255.255.255.0
crypto map outside_map0 30 match address HZhuawei
crypto map outside_map0 30 set peer 115.192.185.102
crypto map outside_map0 30 set transform-set ESP-3DES-SHA
crypto map outside_map0 30 set pfs group2
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 28800
crypto isakmp key Yealink!123 address 115.192.185.102 //configure pre-share key
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac （equal USG ipsec proposal）
access-list HZhuawei permit ip 192.168.1.0 255.255.0.0 10.4.1.0 255.255.255.0
access-list HZhuawei permit ip 10.1.0.0 255.255.0.0 10.4.1.0 255.255.255.0
access-list HZhuawei permit ip 10.2.0.0 255.255.0.0 10.4.1.0 255.255.255.0
access-list HZhuawei permit ip 10.3.0.0 255.255.0.0 10.4.1.0 255.255.255.0
crypto map outside_map0 30 match address HZhuawei
crypto map outside_map0 30 set peer 115.192.185.102
crypto map outside_map0 30 set transform-set ESP-3DES-SHA
crypto map outside_map0 30 set pfs group2
SolutionUSG6000 (115.192.185.102) - (125.77.254.53) ASA5510 ipsec interconnection reference.
