C H A P T E R 36 Configuring Lan-To-Lan Ipsec Vpns - Cisco FirePOWER ASA 5500 series Configuration Manual

Configuring Interfaces
Configuring Interfaces
A security appliance has at least two interfaces, referred to here as outside and inside. Typically, the
outside interface is connected to the public Internet, while the inside interface is connected to a private
network and is protected from public access.
To begin, configure and enable two interfaces on the security appliance. Then, assign a name, IP address
and subnet mask. Optionally, configure its security level, speed, and duplex operation on the security
appliance.
To configure interfaces, perform the following steps, using the command syntax in the examples:
To enter Interface configuration mode, in global configuration mode enter the interface command with
Step 1
the default name of the interface to configure. In the following example the interface is ethernet0.
hostname(config)# interface ethernet0
hostname(config-if)#
To set the IP address and subnet mask for the interface, enter the ip address command. In the following
Step 2
example the IP address is 10.10.4.100 and the subnet mask is 255.255.0.0.
hostname(config-if)# ip address 10.10.4.100 255.255.0.0
hostname(config-if)#
To name the interface, enter the nameif command, maximum of 48 characters. You cannot change this
Step 3
name after you set it. In the following example the name of the ethernet0 interface is outside.
hostname(config-if)# nameif outside
hostname(config-if)##
To enable the interface, enter the no version of the shutdown command. By default, interfaces are
Step 4
disabled.
hostname(config-if)# no shutdown
hostname(config-if)#
To save your changes, enter the write memory command.
Step 5
hostname(config-if)# write memory
hostname(config-if)#
Step 6 To configure a second interface, use the same procedure.
Configuring ISAKMP Policy and Enabling ISAKMP on the
Outside Interface
The Internet Security Association and Key Management Protocol, also called IKE, is the negotiation
protocol that lets two hosts agree on how to build an IPSec security association. Each ISAKMP
negotiation is divided into two sections called Phase1 and Phase 2.
Phase 1 creates the first tunnel, which protects later ISAKMP negotiation messages. Phase 2 creates the
tunnel that protects data travelling across the secure connection.
To set the terms of the ISAKMP negotiations, you create an ISAKMP policy, which includes the
following:
Cisco Security Appliance Command Line Configuration Guide
36-2
Chapter 36 Configuring LAN-to-LAN IPSec VPNs
OL-10088-01