Documentation
VyOS Documentation
VyOS Configuration Examples
Policy-Based IPsec VPN to Cisco ASA

Policy-Based IPsec VPN to Cisco ASA

Policy-Based IPsec VPN lets you establish a Site-to-Site tunnel between VyOS and a Cisco ASA firewall, providing secure connectivity between remote locations or hybrid cloud deployments.

Use Case

Applicability

  • Hybrid Cloud: Yandex Cloud / VK Cloud ↔ On-premises Cisco ASA
  • Branch Office: Headquarters (Cisco ASA) ↔ Remote branches (VyOS)
  • Multi-Cloud: Yandex Cloud (VyOS) ↔ another cloud provider
  • Legacy Integration: Integration with existing Cisco infrastructure

Benefits of Policy-Based VPN

  1. Wide Compatibility: Support for legacy Cisco devices
  2. Granular Control: Traffic selection by subnet pairs
  3. Simple Configuration: Easier than Route-Based for simple scenarios
  4. NAT Traversal: Works behind NAT

Network Topology

Basic Topology

┌────────────────────────────────────────────────┐
│  On-Premises Datacenter                        │
│                                                │
│  ┌──────────────────┐                          │
│  │  Cisco ASA 5516  │                          │
│  │  Outside: 203.0.113.1/30                    │
│  │  Inside: 192.168.1.1/24                     │
│  └──────────┬───────┘                          │
│             │                                  │
│         LAN │ 192.168.1.0/24                   │
│   ┌─────────┴──────────┐                       │
│   │ Servers, Workstations│                     │
│   └────────────────────┘                       │
└────────────────────────────────────────────────┘
                │
                │ Internet
                │ IPsec Tunnel
                │
┌────────────────────────────────────────────────┐
│  Yandex Cloud / VK Cloud                       │
│                                                │
│  ┌──────────────────┐                          │
│  │  VyOS Gateway    │                          │
│  │  eth0: 198.51.100.1/30 (public)            │
│  │  eth1: 10.10.1.1/24 (private)              │
│  └──────────┬───────┘                          │
│             │                                  │
│         VPC │ 10.10.1.0/24                     │
│   ┌─────────┴──────────┐                       │
│   │ Cloud VMs          │                       │
│   └────────────────────┘                       │
└────────────────────────────────────────────────┘

VPN Parameters

ParameterValue
VPN TypePolicy-Based IPsec
IKE VersionIKEv2
Phase 1 EncryptionAES-256
Phase 1 HashSHA-256
Phase 1 DH Group14 (2048-bit)
Phase 2 EncryptionAES-256
Phase 2 HashSHA-256
Phase 2 PFSDH Group 14
AuthenticationPre-Shared Key

Requirements

VyOS Requirements

  • VyOS 1.4 (Sagitta) or newer
  • Public IP address (elastic IP in the cloud)
  • IPsec support (strongSwan)

Cisco ASA Requirements

  • Cisco ASA 5500-X, ASA 5506-X or newer
  • ASA Software 9.x or newer
  • Public IP address
  • IKEv2 support

Network Requirements

  • UDP 500 (IKE) open on both firewalls
  • UDP 4500 (NAT-T) if behind NAT
  • ESP (IP protocol 50) allowed
  • MTU awareness (1400 recommended for the tunnel)

VyOS Configuration

IKE Group (Phase 1)

configure

# IKE Group
set vpn ipsec ike-group IKE-CISCO lifetime '28800'
set vpn ipsec ike-group IKE-CISCO key-exchange 'ikev2'
set vpn ipsec ike-group IKE-CISCO proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-CISCO proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-CISCO proposal 1 dh-group '14'

commit

ESP Group (Phase 2)

configure

# ESP Group
set vpn ipsec esp-group ESP-CISCO lifetime '3600'
set vpn ipsec esp-group ESP-CISCO mode 'tunnel'
set vpn ipsec esp-group ESP-CISCO pfs 'dh-group14'
set vpn ipsec esp-group ESP-CISCO proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-CISCO proposal 1 hash 'sha256'
set vpn ipsec esp-group ESP-CISCO compression 'disable'

commit

Site-to-Site Peer

configure

# Peer (Cisco ASA public IP)
set vpn ipsec site-to-site peer 203.0.113.1 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret 'YourStrongPreSharedKey123!'
set vpn ipsec site-to-site peer 203.0.113.1 ike-group 'IKE-CISCO'
set vpn ipsec site-to-site peer 203.0.113.1 local-address '198.51.100.1'

# Tunnel definition (Policy-Based)
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 esp-group 'ESP-CISCO'
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 local prefix '10.10.1.0/24'
set vpn ipsec site-to-site peer 203.0.113.1 tunnel 1 remote prefix '192.168.1.0/24'

commit
save

NAT Exclusion

configure

# Exclude VPN traffic from NAT (if Source NAT is used)
set nat source rule 100 description 'Exclude VPN traffic from NAT'
set nat source rule 100 destination address '192.168.1.0/24'
set nat source rule 100 source address '10.10.1.0/24'
set nat source rule 100 exclude

# Source NAT for the rest of Internet traffic
set nat source rule 200 description 'NAT for Internet'
set nat source rule 200 outbound-interface name 'eth0'
set nat source rule 200 source address '10.10.1.0/24'
set nat source rule 200 translation address 'masquerade'

commit
save

Firewall Rules

configure

# Firewall for the WAN interface (allow IPsec)
set firewall ipv4-name WAN_LOCAL default-action 'drop'

# Allow established/related
set firewall ipv4-name WAN_LOCAL rule 1 action 'accept'
set firewall ipv4-name WAN_LOCAL rule 1 state established 'enable'
set firewall ipv4-name WAN_LOCAL rule 1 state related 'enable'

# Allow IKE (UDP 500)
set firewall ipv4-name WAN_LOCAL rule 10 action 'accept'
set firewall ipv4-name WAN_LOCAL rule 10 protocol 'udp'
set firewall ipv4-name WAN_LOCAL rule 10 destination port '500'
set firewall ipv4-name WAN_LOCAL rule 10 description 'Allow IKE'

# Allow NAT-T (UDP 4500)
set firewall ipv4-name WAN_LOCAL rule 20 action 'accept'
set firewall ipv4-name WAN_LOCAL rule 20 protocol 'udp'
set firewall ipv4-name WAN_LOCAL rule 20 destination port '4500'
set firewall ipv4-name WAN_LOCAL rule 20 description 'Allow NAT-T'

# Allow ESP (protocol 50)
set firewall ipv4-name WAN_LOCAL rule 30 action 'accept'
set firewall ipv4-name WAN_LOCAL rule 30 protocol 'esp'
set firewall ipv4-name WAN_LOCAL rule 30 description 'Allow ESP'

# Apply to interface
set firewall interface eth0 in name 'WAN_LOCAL'

commit
save

Cisco ASA Configuration

IKEv2 Policy

! IKEv2 Policy
crypto ikev2 policy 10
 encryption aes-256
 integrity sha256
 group 14
 prf sha256
 lifetime seconds 28800
!

IKEv2 Proposal

! IPsec (ESP) Proposal
crypto ipsec ikev2 ipsec-proposal ESP-VYOS
 protocol esp encryption aes-256
 protocol esp integrity sha-256
!

Tunnel Group

! Tunnel Group (VyOS peer)
tunnel-group 198.51.100.1 type ipsec-l2l
tunnel-group 198.51.100.1 ipsec-attributes
 ikev2 remote-authentication pre-shared-key YourStrongPreSharedKey123!
 ikev2 local-authentication pre-shared-key YourStrongPreSharedKey123!
!

Crypto Map

! Access-list for interesting traffic
access-list VPN-TO-VYOS extended permit ip 192.168.1.0 255.255.255.0 10.10.1.0 255.255.255.0

! Crypto Map
crypto map OUTSIDE-MAP 10 match address VPN-TO-VYOS
crypto map OUTSIDE-MAP 10 set peer 198.51.100.1
crypto map OUTSIDE-MAP 10 set ikev2 ipsec-proposal ESP-VYOS
crypto map OUTSIDE-MAP 10 set pfs group14
crypto map OUTSIDE-MAP 10 set security-association lifetime seconds 3600

! Apply to outside interface
crypto map OUTSIDE-MAP interface outside
!

NAT Exemption (Cisco ASA)

! NAT exemption for VPN traffic
nat (inside,outside) source static OBJ-LAN-192.168.1.0 OBJ-LAN-192.168.1.0 destination static OBJ-VYOS-10.10.1.0 OBJ-VYOS-10.10.1.0 no-proxy-arp route-lookup

! Network Objects
object network OBJ-LAN-192.168.1.0
 subnet 192.168.1.0 255.255.255.0

object network OBJ-VYOS-10.10.1.0
 subnet 10.10.1.0 255.255.255.0
!

Routes

! Static route for the VyOS subnet (optional, if dynamic routing is not used)
route outside 10.10.1.0 255.255.255.0 198.51.100.1
!

Integration with Yandex Cloud

Scenario: VyOS in Yandex Cloud as a VPN Gateway

configure

# Yandex Cloud specifics
# eth0 = external interface (public IP via 1:1 NAT)
# eth1 = internal interface (VPC subnet)

# Interfaces
set interfaces ethernet eth0 address '10.128.0.5/24'
set interfaces ethernet eth0 description 'Yandex Cloud external (NAT to public IP)'

set interfaces ethernet eth1 address '10.10.1.1/24'
set interfaces ethernet eth1 description 'Yandex Cloud VPC subnet'

# IPsec configuration
# local-address = internal IP (Yandex Cloud will NAT it to the public IP)
set vpn ipsec site-to-site peer 203.0.113.1 local-address '10.128.0.5'

# NAT exclusion (important for Yandex Cloud)
set nat source rule 100 destination address '192.168.1.0/24'
set nat source rule 100 source address '10.10.1.0/24'
set nat source rule 100 exclude

# Routes (optional)
set protocols static route 192.168.1.0/24 next-hop '203.0.113.1' distance '10'

commit
save

Yandex Cloud Security Group

In the Yandex Cloud Console, create a Security Group for VyOS:

Ingress Rules:

  • UDP 500 from Cisco ASA IP (203.0.113.1)
  • UDP 4500 from Cisco ASA IP (203.0.113.1)
  • ESP (protocol 50) from Cisco ASA IP (203.0.113.1)

Egress Rules:

  • UDP 500 to Cisco ASA IP
  • UDP 4500 to Cisco ASA IP
  • ESP (protocol 50) to Cisco ASA IP

Integration with VK Cloud

Configuration for VK Cloud

configure

# VK Cloud is similar to Yandex Cloud
# eth0 = management (internal IP, NAT to Floating IP)
# eth1 = VPC subnet

set interfaces ethernet eth0 address '10.0.1.5/24'
set interfaces ethernet eth0 description 'VK Cloud external (NAT to Floating IP)'

set interfaces ethernet eth1 address '10.10.1.1/24'
set interfaces ethernet eth1 description 'VK Cloud VPC subnet'

# IPsec local-address = internal IP
set vpn ipsec site-to-site peer 203.0.113.1 local-address '10.0.1.5'

# MTU for the VK Cloud overlay
set interfaces ethernet eth0 mtu '1450'
set interfaces ethernet eth1 mtu '1450'

# MSS clamping for TCP
set firewall interface eth0 in ipv4-adjust-mss '1360'
set firewall interface eth0 out ipv4-adjust-mss '1360'

commit
save

VK Cloud Security Groups

Similar to Yandex Cloud, create a Security Group:

  • Allow UDP 500, 4500 and ESP from the Cisco ASA IP

Configuration Verification

VyOS - IPsec Verification

# IPsec status
show vpn ipsec status

# Expected output:
# IPsec Process Running: yes
# IKE SAs: 1 established
# IPsec SAs: 1 established

# IPsec SA details
show vpn ipsec sa

# Should show:
# Peer: 203.0.113.1
# State: up
# Tunnels: 1 active
# Local subnet: 10.10.1.0/24
# Remote subnet: 192.168.1.0/24

# IKE SA
show vpn ike sa

# Security Associations
show vpn ipsec sa detail

VyOS - Traffic Verification

# Ping through the tunnel (from VyOS to Cisco ASA inside)
ping 192.168.1.1 count 4

# Traceroute
traceroute 192.168.1.1

# IPsec statistics
show vpn ipsec sa statistics

# Bytes in/out should be increasing

Cisco ASA - Verification

! IPsec status
show crypto ikev2 sa

! Output:
! IKEv2 SAs:
! Session-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1

! IPsec SA
show crypto ipsec sa peer 198.51.100.1

! Output:
! interface: outside
! Crypto map tag: OUTSIDE-MAP, seq num: 10, local addr: 203.0.113.1
! access-list VPN-TO-VYOS extended permit ip 192.168.1.0 255.255.255.0 10.10.1.0 255.255.255.0
! local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
! remote ident (addr/mask/prot/port): (10.10.1.0/255.255.255.0/0/0)
! current_peer: 198.51.100.1
! #pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150
! #pkts decaps: 140, #pkts decrypt: 140, #pkts verify: 140

! Ping from ASA to VyOS inside
ping 10.10.1.1

Debugging

VyOS:

# Enable IPsec debugging
sudo swanctl --log

# Live IPsec logs
sudo journalctl -u strongswan -f

# IKE negotiation details
sudo ipsec statusall

Cisco ASA:

! Debug IKEv2
debug crypto ikev2 platform 127
debug crypto ikev2 protocol 127

! Debug IPsec
debug crypto ipsec 127

! Clear and re-establish the tunnel (for testing)
clear crypto ikev2 sa
clear crypto ipsec sa peer 198.51.100.1

Troubleshooting

Issue 1: IKE Phase 1 does not establish

Symptoms:

show vpn ike sa
# Empty, no SA

Causes and solutions:

  1. Pre-Shared Key mismatch:

    # VyOS - check the PSK
show configuration commands | grep pre-shared-secret

# Cisco ASA - check
show running-config tunnel-group 198.51.100.1

  2. Firewall blocks UDP 500:

    # VyOS - check the firewall
show firewall ipv4-name WAN_LOCAL

# Cisco ASA - check ACL
show access-list outside_access_in

  3. Crypto parameters mismatch:

    # VyOS - show IKE parameters
show vpn ipsec ike-group IKE-CISCO

# Cisco ASA
show running-config crypto ikev2 policy

Issue 2: Phase 1 OK, but Phase 2 (IPsec SA) does not establish

Symptoms:

show vpn ike sa  # Shows SA
show vpn ipsec sa  # Empty

Causes:

  1. ESP parameters mismatch:

    # VyOS
show vpn ipsec esp-group ESP-CISCO

# Cisco ASA
show running-config crypto ipsec ikev2 ipsec-proposal

  2. Traffic selectors mismatch:

    # VyOS - check local/remote prefix
show configuration commands | grep "tunnel 1"

# Must match the Cisco ACL
# Cisco ASA
show access-list VPN-TO-VYOS

Issue 3: Tunnel UP, but no connectivity

Symptoms:

show vpn ipsec sa  # State: up
ping 192.168.1.1  # Network unreachable

Causes and solutions:

  1. NAT is not excluded:

    # VyOS - check NAT rules
show nat source rules

# There must be an exclude rule for VPN traffic
# Add it
set nat source rule 100 source address '10.10.1.0/24'
set nat source rule 100 destination address '192.168.1.0/24'
set nat source rule 100 exclude
commit

  2. No route:

    # VyOS - check routing
show ip route 192.168.1.0/24

# There must be a route through the VPN
# If missing, a policy-based VPN should create it automatically

# Cisco ASA - check routes
show route

  3. Firewall blocks VPN traffic:

    # VyOS - create a zone for the VPN
set firewall zone VPN interface 'eth1'
set firewall zone WAN interface 'eth0'
set firewall zone VPN from WAN firewall name 'VPN-IN'

# Allow traffic from the VPN zone
set firewall ipv4-name VPN-IN default-action 'accept'
commit

Issue 4: Tunnel flapping (up/down)

Causes:

  1. DPD (Dead Peer Detection) too aggressive:

    # VyOS - increase the DPD timeout
set vpn ipsec site-to-site peer 203.0.113.1 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.1 dpd action 'restart'
set vpn ipsec site-to-site peer 203.0.113.1 dpd interval '30'
set vpn ipsec site-to-site peer 203.0.113.1 dpd timeout '120'
commit

  2. Keepalive traffic:

    # Periodically send ICMP through the tunnel
# Cron job for keepalive ping
set system task-scheduler task vpn-keepalive executable path '/usr/bin/ping'
set system task-scheduler task vpn-keepalive executable arguments '-c 1 192.168.1.1'
set system task-scheduler task vpn-keepalive interval '60'
commit

Best Practices

1. Crypto Parameters

Recommended:

  • IKE: AES-256, SHA-256, DH Group 14+
  • ESP: AES-256, SHA-256, PFS Group 14+
  • Lifetime: IKE 8h, IPsec 1h

2. NAT Considerations

# Always exclude VPN traffic from NAT
set nat source rule 100 exclude

# MSS clamping for TCP over VPN
set firewall interface eth0 in ipv4-adjust-mss '1360'

3. Firewall Security

# Restrict IKE to the Cisco peer only
set firewall ipv4-name WAN_LOCAL rule 10 source address '203.0.113.1'

# Rate limiting for IKE
set firewall ipv4-name WAN_LOCAL rule 10 recent count '10'
set firewall ipv4-name WAN_LOCAL rule 10 recent time 'minute'

4. Monitoring

# Monitor VPN status
watch -n 5 'show vpn ipsec sa'

# Log IPsec events
set system syslog global facility all level 'info'

# Alert on tunnel failure (custom script)
set system task-scheduler task check-vpn executable path '/config/scripts/check-vpn.sh'
set system task-scheduler task check-vpn interval '300'

5. Redundancy

For production, a redundant VPN is recommended:

# Secondary peer (a second Cisco ASA or a second VyOS)
set vpn ipsec site-to-site peer 203.0.113.2 ...

# Adjust the metric for failover
set protocols static route 192.168.1.0/24 next-hop 203.0.113.2 distance '20'

References

Reviewed by OpenNix LLC · Last updated on
Redundant VPN to Microsoft AzureRoute-Based IPsec VPN to Palo Alto