! (1) Allow S2S VPN tunnels between the ASA and the Azure gateway public IP address ! > Most firewall devices deny all traffic by default. ! > on the inside interface or vlan e.g., 10.51.0.1/24 ! > address on the outside interface or vlan ! (*) Must be unique names in the device configuration ! - => Replace it with the actual nexthop IP address ! - => Replace it with appropriate netmasks ! - => Replace it with a private IP address if applicable ! on-premises network, specifies network prefixes, device public IP, BGP info, etc. ! - * => LocalNetworkGateway - the Azure resource that represents the ! - Interface names - default are 'outside' and 'inside' ! Replace the following place holders with your actual values: Sample script ! Sample ASA configuration for connecting to Azure VPN gateway Virtual network and on-premises network address prefixes.Virtual network and local network gateway names: VNetName and LNGName.Replace the following placeholder values with actual values for your configuration:.

Ensure that the cryptographic algorithms are supported on your device.

Ensure all names and policy numbers are unique on your device.

Identify the routes for your inside/private and outside/public networks.

Specify the interface configuration for both inside and outside interfaces.

Replace the placeholder values in the script with the device settings for your configuration.

Other parameters, such as TCP MSS clampingД¬omplete the following steps before you use the sample script.

IPsec policy and parameters (phase 2 or quick mode).

IKE policy and parameters (phase 1 or main mode).

The S2S VPN tunnel configuration consists of the following parts: The script provides a sample that is based on the configuration and parameters that are described in the previous sections. Consult your VPN device specifications to verify the algorithms that are supported for your VPN device models and firmware versions. At the time of publication, ASA models 5505, 5510, 5520, 5540, 5550, and 5580 do not support these algorithms. This support requirement applies to newer ASA devices. Support for IPsec Encryption with AES-GCM and IPsec Integrity with SHA-256, SHA-384, or SHA-512, requires ASA version 9.x. Support for DH Group and PFS Group beyond Group 5 requires ASA version 9.x. Support for IKEv2 requires ASA version 8.4 and later. * On some devices, IPsec Integrity must be a null value when the IPsec Encryption algorithm is AES-GCM. The following table lists the IPsec/IKE algorithms and parameters that are used in the sample. This section lists the parameters for the sample. Virtual network and VPN gateway information You can optionally configure the BGP across the VPN tunnel.ДЇor step-by-step instructions to build the Azure configurations, see Single VPN tunnel setup. This configuration consists of a single S2S VPN tunnel between an Azure VPN gateway and an on-premises VPN device.

If you specify an exact combination of algorithms and key strengths, be sure to use the corresponding specifications on your VPN devices. You can optionally specify an exact combination of cryptographic algorithms and key strengths for a specific connection, as described in About cryptographic requirements.

Cisco asa virtual appliance download