Configure IKEv2 Site to Site VPN in Cisco ASA

IKEv2 is a new design protocol doing the same objective of IKEv1 which protect user traffic using IPSec. IKEv2 provides a number of benefits over IKEv1, such as IKEV2 uses less bandwidth and supports EAP authentication where IKEv1 does not.

IKEv2 support three authentication methods :
1. PSK
2. PKI (RSA-Sig)
3. EAP ( initiator only)
Initiator means client while responder is the server

IKEv2 has built-in NAT traversal while IKEv1 use it as optional option.
Process of Packet exchange in IKEv2
IKEv2 generates only 4 messages at all while IKEv1 phase 1 generates in main mode 6 messages and in aggressive mode generates 3 messages.

These four message types are: IKE_SA_INIT, IKE_AUTH, CREATE_CHILD_SA, and Informational.

Phase 1 from IKEv1, which has two functional modes (Main and Aggressive), is known in IKEv2 as IKE_SA_INIT and has a single functional mode requiring two messages to be exchanged. Within a single policy (known as proposal on IOS and policy on ASA), multiple encryption/integrity/PRF/DH groups can be specified in an OR fashion.
After IKE_SA_INIT derives the keying material, mutual authentication is performed through IKE_AUTH, which requires two messages to be exchanged. Phase 2 from IKEv1 (Quick Mode) is known in IKEv2 as CREATE_CHILD_SA. Simply , In IKEv2 there is no Main/Aggressive/Quick Modes

I have prepared separate document for IKEV1 vs IKEv2, you can check.

Steps to create IKEv2 VPN On ASA
1. Creation of Object Group.
2. Encryption Domain
3. Creating Phase 1 proposal.
4. Phase 2 proposal(IPSec Parameters)
5. Tunnel Group
6. Creating Group Policy (if not in default group)
7. Crypto Map

Step-1. Creating Object Group

First of all we create our Local and Remote object group.
object-group network REMOTE-NAME network-object 255.255.255.0 object-group network LOCAL-NAME network-object 255.255.255.0

Step-2 ENCRYPTION DOMAIN

Next, We will create ACL for traffic which we want to encrypt

Note : The previously created object groups are used to define the local and remote endpoints.

access-list ENCRYPTION_DOMAIN_NAME extended permit ip object-group LOCAL_NAME object-group REMOTE_NAME

Step-3 PHASE 1 PROPOSAL

We need to create proposal for phase 1 which will be used to> negotiate phase 1 parameters. You can use below command to check if is there any existing Proposal matches your requirement.
Command
sh run crypto ikev2
You may of spotted that multiple ciphers are defined for each “method”. This is because IKEv2 sends across a single proposal containing multiple ciphers, compared to IKEv1 in which multiple proposals are sent.

crypto ikev2 policy 10 encryption 3des des integrity sha md5 group 5 prf sha lifetime seconds 86400

We have to allow IKEv2 on interface where VPN will get terminate.
crypto ikev2 enable outside

Step-4 PHASE 2 PROPOSAL (Transform-Set)

We need to create Phase 2 proposals which will include Encryption, Integerity etc for IPSec tunnel

crypto ipsec ikev2 ipsec-proposal IKEV2-IPSEC-ESP-AES-SHA1 protocol esp encryption aes protocol esp integrity sha-1

Step-5 TUNNEL GROUP

At this point, the tunnel group is created. Just like IKEv1 the preshared key is defined. However, IKEv2 allows you to use different authentication methods for both local and remote authentication.
we have assumed Peer IP – 172.10.1.1

tunnel-group 172.10.1.1 type ipsec-l2l tunnel-group 172.10.1.1 ipsec-attributes ikev2 remote-authentication pre-shared-key ikev2 local-authentication pre-shared-key

Step-6 Group Policy

At this point, we have to create group policy if it is not set by default, in most cases we create group policy for every new IKEV2 tunnel
we have assumed Peer IP – 172.10.1.1

group-policy GroupPolicy_NAME internal group-policy GroupPolicy_NAME attributes vpn-tunnel-protocol ikev2

Calling Group policy in Tunnel Group
tunnel-group 172.10.1.1 general-attributes default-group-policy GroupPolicy_NAME

Step-7 CRYPTO MAP

Finally, we have to configure Crypto map where we combine encryption domain, Peer IP, Transform-set(Proposal Phase 2) into single crypto map and then Crypto map is assigned to outside interface.

crypto map CRYPTOMAP 100 match address ENCRYPTION_DOMAIN_NAME crypto map CRYPTOMAP 100 set peer 172.10.1.1 crypto map CRYPTOMAP 100 set ikev2 ipsec-proposal IKEV2-IPSEC-ESP-AES-SHA1 crypto map CRYPTOMAP interface outside crypto isakmp identity address