CloudBridge® Connector interoperability – Cisco ASA
You can configure a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco ASA appliance to connect two datacenters or extend your network to a cloud provider. The NetScaler appliance and the Cisco ASA appliance form the end points of the CloudBridge Connector tunnel and are called peers.
Related information
Example of a CloudBridge Connector tunnel configuration
As an illustration of the traffic flow in a CloudBridge Connector tunnel, consider an example in which a CloudBridge Connector tunnel is set up between the following appliances:
-
NetScaler appliance NS_Appliance-1 in a datacenter designated as Datacenter-1
-
Cisco ASA appliance Cisco-ASA-Appliance-1 in a datacenter designated as Datacenter-2
NS_Appliance-1 and Cisco-ASA-Appliance-1 enable communication between private networks in Datacenter-1 and Datacenter-2 through the CloudBridge Connector tunnel. In the example, NS_Appliance-1 and Cisco-ASA-Appliance-1 enable communication between client CL1 in Datacenter-1 and server S1 in Datacenter-2 through the CloudBridge Connector tunnel. Client CL1 and server S1 are on different private networks.
On NS_Appliance-1, the CloudBridge Connector tunnel configuration includes IPSec profile entity NS_Cisco-ASA_IPSec_Profile, CloudBridge Connector tunnel entity NS_Cisco-ASA_Tunnel, and policy based routing (PBR) entity NS_Cisco-ASA_Pbr.
localized image
Points to consider for a CloudBridge Connector tunnel configuration
Before you begin configuring CloudBridge connector tunnel, make sure that:
-
The following IPSec settings are supported for a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco ASA appliance.
| IPSec Properties | Settings |
|---|---|
| IPSec mode | Tunnel mode |
| IKE version | Version 1 |
| IKE authentication method | Pre-Shared Key |
| IKE encryption algorithm | AES, 3DES |
| IKE hash algorithm | HMAC SHA1, HMAC MD5 |
| ESP encryption algorithm | AES, 3DES |
| ESP hash algorithm | HMAC SHA1, HMAC MD5 |
-
You must specify the same IPSec settings on the NetScaler appliance and the Cisco ASA appliance at the two ends of the CloudBridge Connector tunnel.
-
NetScaler provides a common parameter (in IPSec profiles) for specifying an IKE hash algorithm and an ESP hash algorithm. It also provides another common parameter for specifying an IKE encryption algorithm and an ESP encryption algorithm. Therefore, in the Cisco ASA appliance, you must specify the same hash algorithm and same encryption algorithm in IKE (phase 1 configuration) and ESP (phase 2 configuration).
-
You must configure the firewall at the NetScaler end and Cisco ASA end to allow the following.
-
Any UDP packets for port 500
-
Any UDP packets for port 4500
-
Any ESP (IP protocol number 50) packets
-
Configuring Cisco ASA for the CloudBridge Connector tunnel
To configure a CloudBridge Connector tunnel on a Cisco ASA appliance, use the Cisco ASA command line interface, which is the primary user interface for configuring, monitoring, and maintaining Cisco ASA appliances.
Before you begin the CloudBridge Connector tunnel configuration on a Cisco ASA appliance, make sure that:
-
You have a user account with administrator credentials on the Cisco ASA appliance.
-
You are familiar with the Cisco ASA command line interface.
-
The Cisco ASA appliance is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.
Note
The procedures for configuring CloudBridge Connector tunnel on a Cisco ASA appliance might change over time, depending on the Cisco release cycle. Citrix® recommends that you follow the official Cisco ASA product documentation for Configuring IPSec VPN tunnels, at:
To configure a CloudBridge connector tunnel between a NetScaler appliance and a Cisco ASA appliance, perform the following tasks on the Cisco ASA appliance’s command line:
-
Create an IKE Policy. An IKE policy defines a combination of security parameters to be used during the IKE negotiation (phase 1). For example, parameters such as hash algorithm, encryption algorithm, and authentication method to be used in the IKE negotiation are set in this task.
-
Enable IKE on the outside interface. Enable IKE on the outside interface through which the tunnel traffic will flow to the tunnel peer.
-
Create a tunnel group. A tunnel group specifies the type of tunnel and the pre-shared key. The tunnel type must be set to ipsec-l2l, which stands for IPsec LAN to LAN. A pre-shared key is a text string, which the peers of a CloudBridge Connector tunnel use to mutually authenticate with each other. The pre-shared keys are matched against each other for IKE authentication. Therefore, for the authentication to be successful, you must configure the same pre-shared key on the Cisco ASA appliance and the NetScaler appliance.
-
Define a transform set. A transform set defines a combination of security parameters (phase 2) to be used in the exchange of data over the CloudBridge Connector tunnel after the IKE negotiation is successful.
-
Create an access List. Crypto access lists are used to define the subnets whose IP traffic will be protected over the CloudBridge tunnel. The source and destination parameters in the access list specify the Cisco appliance side and NetScaler side subnets that are to be protected over the CloudBridge Connector Tunnel. The access list must be set to permit. Any request packet that originates from an appliance in the Cisco appliance side subnet and is destined to an appliance in the NetScaler side subnet, and that matches the source and destination parameters of the access list, is sent across the CloudBridge Connector tunnel.
-
Create a crypto map. Crypto maps define the IPSec parameters for security associations (SAs). They include the following: Crypto access list to identify the subnets whose traffic is to be protected over the CloudBridge tunnel, peer (NetScaler) identification by IP address, and transform set to match the peer security settings.
-
Apply the crypto Map to the outside interface. In this task, you apply the crypto map to the outside interface through which the tunnel traffic will flow to the tunnel peer. Applying the crypto map to an interface instructs the Cisco ASA appliance to evaluate all interface traffic against the crypto map set and to use the specified policy during connection or security association negotiations.
The examples in the following procedures create settings of Cisco ASA appliance Cisco-ASA-Appliance-1 used in Example of CloudBridge Connector Configuration and Data Flow.
To create an IKE policy by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following commands, starting in global configuration mode, in the order shown:
| Command | Example | Command Description |
|---|---|---|
| crypto ikev1 policy priority | Cisco-ASA-appliance-1(config)# crypto ikev1 policy 1 | Enter IKE policy configuration mode and identify the policy to create. (Each policy is uniquely identified by the priority number you assign.) This example configures policy 1. |
| encryption (3des | aes) | Cisco-ASA-appliance-1 (config-ikev1-policy)# encryption 3des | Specify the encryption algorithm. This example configures the 3DES algorithm. |
| hash (sha | md5) | Cisco-ASA-appliance-1 (config- ikev1-policy)# hash sha | Specify the hash algorithm. This example configures SHA. |
| authenticationpre-share | Cisco-ASA-appliance-1 (config- ikev1-policy)# authentication pre-share | Specify the pre-share authentication method. |
| group 2 | Cisco-ASA-appliance-1 (config- ikev1-policy)# group 2 | Specify 1024-bit Diffie-Hellman group identifier (2). |
| lifetime seconds | Cisco-ASA-appliance-1 (config- ikev1-policy)# lifetime 28800 | Specify the security association's lifetime in seconds. This example configures 28800 seconds, which is the default value of lifetime in a NetScaler appliance. |
To enable IKE on the outside interface by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following commands, starting in global configuration mode, in the order shown:
| Command | Example | Command Description |
|---|---|---|
| crypto ikev1 enable outside | Cisco-ASA-appliance-1(config)# crypto ikev1 enable outside | Enable IKEv1 on the interface through which the tunnel traffic flows to the tunnel peer. This example enables IKEv1 on the interface named outside. |
To create a tunnel group by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following commands, starting in global configuration mode, as show in the attached pdf Tunnel Group using Cisco ASA command line:
To create a crypto access list by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following command in global configuration mode, in the order shown:
| Command | Example | Command Description |
|---|---|---|
| access-list access-list-number permit IP source source-wildcard destination destination-wildcard | Cisco-ASA-appliance-1(config)# access-list 111 permit ip 10.20.20.0 0.0.0.255 10.102.147.0 0.0.0.255 | Specify conditions to determine the subnets whose IP traffic is to be protected over the CloudBridge Connector tunnel. This example configures access list 111 to protect traffic from subnets 10.20.20.0/24 (at the Cisco-ASA-Appliance-1 side) and 10.102.147.0/24 (at the NS_Appliance-1 side). |
To define a transform set by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following commands, starting in global configuration mode. See Transform set using ASA command line table pdf.
To create a crypto map by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following commands starting in global configuration mode, in the order shown:
| Command | Example | Command Description |
|---|---|---|
| crypto map map-name seq-num match address access-list-name | Cisco-ASA-appliance-1 (config)# crypto map NS-CISCO-CM 1 match address 111 | Create a crypto map and specify an access list to it. This example configures crypto map NS-CISCO-CM with sequence number 1 and assigns access list 111 to NS-CISCO-CM. |
| crypto map map-name seq-num set peer ip-address | Cisco-ASA-appliance-1 (config)# crypto map NS-CISCO-CM 1 set peer 198.51.100.100 | Specify the peer (NetScaler appliance) by its IP address. This example specifies 198.51.100.100, which is the tunnel endpoint IP address on the NetScaler appliance. |
| crypto map map-name seq-num set ikev1 transform-set transform-set-name | Cisco-ASA-appliance-1 (config)# crypto map NS-CISCO-CM 1 set ikev1 transform-set NS-CISCO-TS | Specify which transform set is allowed for this crypto map entry. This example specifies transform set NS-CISCO-TS. |
To apply a crypto map to an interface by using the Cisco ASA command line
At the Cisco ASA appliance’s command prompt, type the following commands starting in global configuration mode, in the order shown:
| Command | Example | Command Description |
|---|---|---|
| crypto map map-nameinterface interface-name | Cisco-ASA-appliance-1(config)# crypto map NS-CISCO-CM interface outside | Apply the crypto map to the interface through which CloudBridge Connector tunnel traffic will flow. This example applies crypto map NS-CISCO-CM to interface outside. |
Configuring the NetScaler appliance for the CloudBridge Connector tunnel
To configure a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco ASA appliance, perform the following tasks on the NetScaler appliance. You can use either the NetScaler command line or the NetScaler graphical user interface (GUI):
-
Create an IPSec profile.
-
Create an IP tunnel that uses IPSec protocol, and associate the IPSec profile with it.
-
Create a PBR rule and associate it with the IP tunnel.
To create an IPSEC profile by using the NetScaler command line:
At the command prompt, type:
-
add ipsec profile <name> -psk <string> -ikeVersion v1 -encAlgo AES -hashAlgo HMAC_SHA1 -perfectForwardSecrecy ENABLE -
show ipsec profile <name>
To create an IPSEC tunnel and bind the IPSEC profile to it by using the NetScaler command line:
At the command prompt, type:
-
add ipTunnel <name> <remote> <remoteSubnetMask> <local> -protocol IPSEC –ipsecProfileName <string> -
show ipTunnel <name>
To create a PBR rule and bind the IPSEC tunnel to it by using the NetScaler command line:
At the command prompt, type:
-
**add pbr** <pbrName> **ALLOW** –**srcIP** <subnet-range> -**destIP** <subnet-range> -
**ipTunnel** <tunnelName> -
**apply pbrs** -
**show pbr** <pbrName>
To create an IPSEC profile by using the GUI:
-
Navigate to System > CloudBridge Connector > IPSec Profile.
-
In the details pane, click Add.
-
In the Add IPSec Profile page, set the following parameters:
-
Name
-
Encryption Algorithm
-
Hash Algorithm
-
IKE Protocol Version
-
Perfect Forward Secrecy (Enable this parameter)
-
-
Configure the IPSec authentication method to be used by the two CloudBridge Connector tunnel peers to mutually authenticate: Select the Pre-shared key authentication method and set the Pre-Shared Key Exists parameter.
-
Click Create, and then click Close.
To create an IP tunnel and bind the IPSEC profile to it by using the GUI:
-
Navigate to System > CloudBridge Connector > IP Tunnels.
-
On the IPv4 Tunnels tab, click Add.
-
In the Add IP Tunnel page, set the following parameters:
-
Name
-
Remote IP
-
Remote Mask
-
Local IP Type (In the Local IP Type drop-down list, select Subnet IP).
-
Local IP (All the configured IP addresses of the selected IP type are in the Local IP drop down list. Select the desired IP from the list.)
-
Protocol
-
IPSec Profile
-
-
Click Create, and then click Close.
To create a PBR rule and bind the IPSEC tunnel to it by using the GUI:
-
Navigate to System > Network > PBR.
-
On the PBR tab, click Add.
-
In the Create PBR page, set the following parameters:
-
Name
-
Action
-
Next Hop Type (Select IP Tunnel)
-
IP Tunnel Name
-
Source IP Low
-
Source IP High
-
Destination IP Low
-
Destination IP High
-
-
Click Create, and then click Close.
The corresponding new CloudBridge Connector tunnel configuration on the NetScaler appliance appears in the GUI. The current status of the CloudBridge connector tunnel is shown in the Configured CloudBridge Connector pane. A green dot indicates that the tunnel is up. A red dot indicates that the tunnel is down.
The following commands create settings of NetScaler appliance NS_Appliance-1 in "Example of a CloudBridge Connector Configuration.":
> add ipsec profile NS_Cisco-ASA_IPSec_Profile -psk examplepresharedkey -ikeVersion v1 –encAlgo AES –hashalgo HMAC_SHA1 –lifetime 315360 -perfectForwardSecrecy ENABLE
Done
> add iptunnel NS_Cisco-ASA_Tunnel 203.0.113.200 255.255.255.255 198.51.100.100 –protocol IPSEC –ipsecProfileName NS_Cisco-ASA_IPSec_Profile
Done
> add pbr NS_Cisco-ASA_Pbr -srcIP 10.102.147.0-10.102.147.255 –destIP 10.20.0.0-10.20.255.255 –ipTunnel NS_Cisco-ASA_Tunnel
Done
> apply pbrs
Done
Monitoring the CloudBridge Connector Tunnel
You can monitor the performance of CloudBridge Connector tunnels on a NetScaler appliance by using CloudBridge Connector tunnel statistical counters. For more information about displaying CloudBridge Connector tunnel statistics on a NetScaler appliance, see Monitoring CloudBridge Connector Tunnels.