CCNP Security VPN 642-647 Quick Reference

Chapter 2. Deploying Cisco ASA IPsec VPN Solutions

This chapter covers site-to-site virtual private network (VPN) and Easy VPN solutions on Cisco Adaptive Security Appliance (ASA). Although IP Security (IPsec) VPN termination on Cisco ASA does not require additional licensing, the number of supported concurrent IPsec sessions on each box is limited by platform model, ranging from 10 to 10,000.

Tunnels established between any two IPsec peers are created on demand as follows:

1. When interesting traffic (matched in the crypto ACL) is detected in the buffer of the interface where the crypto map is applied, the process is triggered.
2. Internet Key Exchange (IKE) Phase 1 negotiation for the management tunnel starts, and one IKE security association (SA) ...