The influence and solution of ASA firewall on IPSec VPN in Middle network

The IPSec VPN realizes the network expansion, the firewall realizes the control and the filtering to the network traffic, therefore has the influence to the IPSec VPN communication.

The default ASA maintains a state session only for UDP/TCP traffic, and therefore discards the ESP traffic that is returned. There are two ways to solve the problem

One uses ACLs to release ESP traffic.

Two applications check IPSec VPN.

Experimental topology

R1 configuration:

Crypto ISAKMP Policy 10
ENCR 3DES
Authentication Pre-share
Group 2
Crypto ISAKMP key Cisco address 192.168.200.2 No-xauth
!
!
Crypto IPSec Transform-set Trans Esp-des Esp-md5-hmac
!
Crypto map R1 IPSEC-ISAKMP
Set Peer 192.168.200.2
Set Transform-set trans
Match Address VPN
!

Interface Loopback0
IP Address 1.1.1.1 255.255.255.0
!
Interface fastethernet0/0
IP address 192.168.100.1 255.255.255.0
Duplex Auto
Speed auto
Crypto map R1

IP Route 0.0.0.0 0.0.0.0 192.168.100.254
!

IP access-list Extended VPN
Permit IP 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

ASA configuration:

Interface ethernet0/0
Nameif outside
Security-level 0
IP address 192.168.100.254 255.255.255.0
!
Interface ETHERNET0/1
Nameif inside
Security-level 100
IP address 192.168.200.254 255.255.255.0