{"id":53,"date":"2023-10-13T18:53:17","date_gmt":"2023-10-13T18:53:17","guid":{"rendered":"https:\/\/mycomputerland.com\/?p=53"},"modified":"2023-10-16T18:39:51","modified_gmt":"2023-10-16T18:39:51","slug":"configuring-site-to-site-vpn-between-cisco-asa-and-usg-pro","status":"publish","type":"post","link":"https:\/\/mycomputerland.com\/index.php\/2023\/10\/13\/configuring-site-to-site-vpn-between-cisco-asa-and-usg-pro\/","title":{"rendered":"Configuring Site-to-Site VPN Between Cisco ASA and USG Pro"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

Configuring a Site-to-Site VPN between a Cisco ASA firewall and a Ubiquiti USG Pro (Unified Security Gateway) involves several steps. This guide assumes that you have basic knowledge of both devices and have administrative access to both the Cisco ASA and USG Pro interfaces. Make sure to replace placeholders with your specific network details.<\/p>\n

Here are the general steps to configure the VPN:<\/p>\n

Cisco ASA Configuration:<\/h3>\n
    \n
  1. Log in to the Cisco ASA’s web interface or connect to it using SSH or Telnet.<\/li>\n
  2. Navigate to Configuration mode using the following commands:\n
    \n
    <\/div>\n
    enable<\/span>
    \nconfigure terminal
    \n<\/code><\/div>\n<\/div>\n<\/li>\n
  3. Define the ISAKMP (Internet Security Association and Key Management Protocol) policy. This is the phase 1 configuration:\n
    \n
    crypto isakmp policy 10
    \n encr aes
    \n authentication pre-share
    \n group 2
    \n hash<\/span> sha
    \n lifetime 86400
    \n<\/code><\/div>\n<\/div>\n

    Customize the encryption, authentication, group, hash, and lifetime settings according to your security requirements.<\/li>\n

  4. Create the pre-shared key for authentication:\n
    \n
    crypto isakmp key YOUR_SHARED_SECRET address<\/span> USG_PRO_PUBLIC_IP
    \n<\/code><\/div>\n<\/div>\n

    Replace YOUR_SHARED_SECRET<\/code> with a strong shared secret key and USG_PRO_PUBLIC_IP<\/code> with the public IP address of the USG Pro.<\/li>\n

  5. Define the transform-set for phase 2 (IPsec) configuration:\n
    \n
    crypto ipsec transform-set MY_TRANSFORM_SET esp-aes esp-sha-hmac
    \n<\/code><\/div>\n<\/div>\n

    Customize the encryption and authentication algorithms as needed.<\/li>\n

  6. Create a crypto map:\n
    \n
    crypto map<\/span> MY_CRYPTO_MAP 10<\/span> match<\/span> address VPN_ACL
    \ncrypto map<\/span> MY_CRYPTO_MAP 10<\/span> set<\/span> peer USG_PRO_PUBLIC_IP
    \ncrypto map<\/span> MY_CRYPTO_MAP 10<\/span> set<\/span> transform-set<\/span> MY_TRANSFORM_SET
    \n<\/code><\/div>\n<\/div>\n

    Replace VPN_ACL<\/code> with an access control list specifying the traffic to be encrypted, and USG_PRO_PUBLIC_IP<\/code> with the public IP address of the USG Pro.<\/li>\n

  7. Apply the crypto map to the outside interface:\n
    \n
    interface<\/span> outside
    \n crypto map<\/span> MY_CRYPTO_MAP
    \n<\/code><\/div>\n<\/div>\n<\/li>\n
  8. Save your configuration:\n
    \n
    write memory
    \n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ol>\n

    Ubiquiti USG Pro Configuration:<\/h3>\n
      \n
    1. Log in to the USG Pro’s web interface.<\/li>\n
    2. Navigate to the “Settings” and then “Networks” section.<\/li>\n
    3. Create a new network for the remote ASA site:\n
        \n
      • Click “Create New Network.”<\/li>\n
      • Set the name and subnet according to your network design.<\/li>\n
      • Set the purpose to “Remote Subnet.”<\/li>\n<\/ul>\n<\/li>\n
      • Navigate to the “Settings” and then “VPN” section.<\/li>\n
      • Create a new Site-to-Site VPN configuration:\n
          \n
        • Click “Create New VPN.”<\/li>\n
        • Choose “Site-to-Site VPN.”<\/li>\n
        • Enter the remote ASA’s public IP address and the pre-shared key.<\/li>\n<\/ul>\n<\/li>\n
        • Under “Local Subnets” and “Remote Subnets,” select the appropriate network objects created earlier.<\/li>\n
        • Save the configuration.<\/li>\n
        • Under “Site-to-Site VPN,” click “Connect” to establish the VPN tunnel.<\/li>\n<\/ol>\n

          This should configure a site-to-site VPN between your Cisco ASA and Ubiquiti USG Pro. Ensure that your firewall rules and routing are appropriately configured to allow traffic through the VPN tunnel. Test the connectivity and monitor the VPN status to ensure it’s functioning as expected.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

          Configuring a Site-to-Site VPN between a Cisco ASA firewall and a Ubiquiti USG Pro (Unified Security Gateway) involves several steps. This guide assumes that you have basic knowledge of both devices and have administrative access to both the Cisco ASA and USG Pro interfaces. Make sure to replace placeholders with your specific network details. Here […]<\/p>\n","protected":false},"author":1,"featured_media":54,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,7],"tags":[27,26,28],"class_list":{"0":"post-53","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cisco","8":"category-networking","9":"tag-cisco-asa","10":"tag-site-to-site-vpn","11":"tag-usg-pro"},"_links":{"self":[{"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/posts\/53"}],"collection":[{"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/comments?post=53"}],"version-history":[{"count":2,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/posts\/53\/revisions"}],"predecessor-version":[{"id":57,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/posts\/53\/revisions\/57"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/media\/54"}],"wp:attachment":[{"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/media?parent=53"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/categories?post=53"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycomputerland.com\/index.php\/wp-json\/wp\/v2\/tags?post=53"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}