Permit tcp object CAMPUS_NETWORK object BRANCH01_NETWORK Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)Ĭrypto map tag: BRANCH1, seq num: 1, local addr 134.95.56.17 Use the show crypto isakmp sa command to shows the Internet Security Association Management Protocol (ISAKMP) security associations (SAs) which have been negociated between the two firewalls and the show crypto ipsec sa command to check IPSEC security associations and monitor encrypted traffic statistics ASA-CAMPUS-VPN#show crypto isakmp sa Tunnel-group 134.95.56.17 ipsec-attributesĬheck the IPSEC tunnel establishment using show commands Route outside 172.16.0.0 255.255.128.0 134.95.56.17 1Īccess-list PRIVATE_TRAFFIC extended permit tcp object BRANCH01_NETWORK object CAMPUS_NETWORKĪccess-list PRIVATE_TRAFFIC extended permit icmp object BRANCH01_NETWORK object CAMPUS_NETWORKĪccess-list ENTERPRISE_PRIVATE-TRAFFIC extended permit icmp object CAMPUS_NETWORK object BRANCH_NETWORKĬrypto map BRANCH1 1 match address PRIVATE_TRAFFICĬrypto map BRANCH1 1 set peer 134.95.56.17

The traffic wiill be blocked by the ASA if this access-list is not configured and applied to the inside vlan interface.īranch office n☁ - ASA 5505 remote device configuration The ENTERPRISE_PRIVATE-TRAFFIC access-group is important to allow the IP traffic through the firewall from remote subnets to the inside subnets. Route inside 172.16.0.0 255.255.128.0 172.16.254.253 1Īccess-list BRANCH01_TRAFFIC extended permit tcp object CAMPUS_NETWORK object BRANCH01_NETWORKĪccess-list BRANCH01_TRAFFIC extended permit icmp object CAMPUS_NETWORK object BRANCH01_NETWORKĪccess-list ENTERPRISE_PRIVATE-TRAFFIC extended permit tcp object PRIVATE_NETWORK object PRIVATE_NETWORKĪccess-list ENTERPRISE_PRIVATE-TRAFFIC extended permit icmp object BRANCH_NETWORK object CAMPUS_NETWORKĪccess-group ENTERPRISE_PRIVATE-TRAFFIC out interface insideĬrypto ipsec ikev1 transform-set L2L esp-aes esp-sha-hmacĬrypto map BRANCH1 1 match address BRANCH01_TRAFFICĬrypto map BRANCH1 1 set peer 134.95.56.18Ĭrypto map BRANCH1 1 set security-association lifetime seconds 86400Ĭrypto map BRANCH1 1 set ikev1 transform-set L2L Update : Corrected error in ' crypto ipsec ikev1' command interface Vlan1 Campus network - ASA 5505 IPSEC VPN headend device configuration.

Cisco asa 5505 update