IPSEC VPN with Cisco ASA


#1

Can Peplink Balance 305 do Site-to-site IPSEC VPN tunnel over the Internet with a Cisco ASA peer Cisco ASA Version 9.1(6)11?

If yes, are there any limitations?

Found that it is possible from the topic below (2 years ago):-

Would need some confirmation on this.

Thanks! Appreciate any help.


#2

We got it working. No issues.

Only thing to note, the ipsec tunnel will not appear in any of the peplink outbound rules setting

U need to set the local ID and remote ID, if the Asa is behind another firewall (ipsec nat issues)

Larry


#3

Great. Good to know.

After establishing the tunnel, is it possible to configure QoS as below and will it work?

QoS > Application > Add > Category “Security/Tunelling, IPSec” > Set Priority “High”

Thanks alot!


#4

Hi

This I did not test. Peplink is mum about this aspect and I cannot get straight answers from support as well.

I am running 5 ipsec link. Peplink to peplink ipsec is more unstable than peplink to cisco and other brands.

U will see a situation where the ipsec link is up and no traffic can get through until you reboot the peplink. Only happen for peplink to peplink


#5

@chesterljs, Qos is not supported in IPSec.

@scl402a, have you further diagnose the unstable issue like perform traceroute to know which hop is dropping the packet? What firmware version you are using for all the Peplink’s IPSec peers?


#6

Version 6 works well. Version 7 too unstable


#7

@TK_Liew

As shown in below screenshot, there is an option for IPsec under QoS > Applications. Do you mean this doesn’t work?


#8

Do allow me to further confirm this. Do you mean:

Remote (v6) <—IPSec—> (v6) HQ = Stable

Remote (v6) <—IPSec—> (v7) HQ = Unstable

Remote (v7) <—IPSec—> (v7) HQ = Stable or unstable?


#9

This Qos for IPSec is for connectivity below.
<------------------------------------IPSec------------------------------------------>
IPSec peer (Remote) —> Peplink —> Internet <— (HQ) IPSec peer

Not for your case which having connectivity below.
Peplink <—IPSec—> Cisco ASA

Hope this clear your doubts.


#10

Ok. Got it.

Thanks.


#11

Hi

Remote v7 to v7 also unstable

All peplink to peplink ipsec unstable when compared to Peplink to CISCO ASA IPSEC

link will show up, but packets not going through until we reboot the peplink (applies for v6 & v7, any combination)


#12

We don’t encounter this issue before. Have you opened ticket on this? If so, please let me the ticket number. Else, please help to open ticket for us to investigate.

Thanks.