Cisco 300-730 SVPN cheat sheet

Cisco ASA/IOS site-to-site uses IPsec with IKEv1 or IKEv2; IKEv2 is preferred for MOBIKE, built-in NAT traversal, and asymmetric authentication flexibility.

IKEv2 proposal must match on encryption, integrity/hash, PRF, DH group, and authentication method; a mismatch fails at IKE_SA_INIT (Phase 1) before any IPsec SA is built.

IPsec transform set (IOS) or Phase 2 proposal (ASA) defines ESP encryption and hash; AH provides integrity only and cannot traverse NAT.

Crypto ACL (IOS) or interesting traffic ACL (ASA) defines which packets are encrypted; ASA uses the ACL in both directions, IOS crypto map ACL is matched on outbound only.

NAT-T is auto-detected on UDP 4500; ESP over UDP 4500 is used when a PAT device sits between peers, so permit UDP 500 and 4500 bidirectionally.

SVTI (IOS) is a point-to-point tunnel interface with static or dynamic (IKEv2) peers; DVTI uses a virtual-template for hub-and-spoke with per-spoke SVTIs.

ASA policy-based site-to-site binds crypto map to interface; route-based uses VTI interfaces and traffic is selected by routing, not ACL.

Perfect Forward Secrecy on Phase 2 forces a new DH exchange per rekey; if PFS is set on one peer it must be set on the other with the same group.

FlexVPN (IKEv2) supports spoke-to-spoke shortcuts via NHRP and per-peer authorization; requires matching IKEv2 profiles and aaa authorization for the shortcut.

AnyConnect/SSL VPN uses TLS on TCP 443 by default; DTLS on UDP 443 provides lower-latency data channel when enabled and permitted.

ASA AnyConnect requires: enable outside, webvpn enable outside, a trustpoint with a valid cert, a connection profile/group-policy, and an address pool.

Group-policy controls split tunneling (split-tunnel-policy tunnelspecified with an ACL), DTLS, and client protocols; connection profile binds authentication and group-policy.

Clientless (webvpn) only supports browser-based apps (bookmarks, port forwarding); AnyConnect client is required for full tunnel and IPsec IKEv2.

AnyConnect IKEv2 (FlexVPN/IOS) uses IKEv2 with EAP; certificates or EAP-MSCHAPv2 for user auth; requires an IKEv2 profile and authorization policy.

Split exclude (split-exclude) sends only listed destinations outside the tunnel; split include (tunnelspecified) tunnels only the listed destinations.

Certificate auth requires the client trust the issuing CA; ASA presents the trustpoint cert and validates the client cert against a configured trustpoint for client-cert auth.

RADIUS/LDAP via aaa-server group with protocol radius or ldap; authorization attributes (e.g., framed-IP, group-policy) can be returned by the AAA server.

Always-On VPN and SBL (Start Before Logon) are Windows client features configured in the AnyConnect profile XML, not on the ASA.

IKEv1 debug: debug crypto isakmp (IOS) / debug crypto ikev1 (ASA); IKEv2: debug crypto ikev2; IPsec: debug crypto ipsec. Disable after use to avoid CPU impact.

show crypto isakmp sa / show crypto ikev2 sa shows Phase 1 state; MM_ACTIVE or READY indicates IKE complete; QM_IDLE indicates IPsec SAs established.

show crypto ipsec sa shows encaps/decaps counters; non-zero encaps with zero decaps on the peer indicates traffic not arriving or ACL/NAT dropping it.

Common Phase 1 failure causes: proposal mismatch, preshared key mismatch, wrong peer address, or UDP 500 blocked; check logs for NO_PROPOSAL_CHOSEN or INVALID_ID_INFORMATION.

Common Phase 2 failure causes: transform/proposal mismatch, PFS mismatch, ACL mismatch, or proxy-ID mismatch; look for NO_PROPOSAL_CHOSEN at Quick Mode.

NAT exemption (ASA: nat (inside,outside) source static ... destination static ...) is required so VPN traffic is not translated before encryption.

Packet tracer on ASA: packet-tracer input inside tcp detailed shows each ACL, NAT, and crypto stage decision.

Syslog: logging enable, logging trap informational; capture with capture interface match ip host host for packet-level verification.

show vpn-sessiondb detail anyconnect / svc shows active sessions, assigned IP, and tunnel details; use to confirm client connectivity and policy assignment.

IPsec ESP provides confidentiality and integrity; AH provides integrity/authentication only and is incompatible with NAT because it hashes the IP header.

IKEv1 Phase 1 modes: main mode (6 messages, identity protected) and aggressive mode (3 messages, identity exposed, preshared key hash exposed to offline attack).

IKEv2 uses 4 messages for the initial exchange (IKE_SA_INIT + IKE_AUTH), supports MOBIKE for IP roaming, and has built-in dead peer detection.

DH groups: group 14 (2048-bit MODP) is a common minimum; group 19/20 (ECP) are preferred for modern deployments; group 1/2 are deprecated.

Encryption recommendations: AES (CBC or GCM); AES-GCM combines encryption and integrity, so the hash/PRF is only used for IKE, not for ESP integrity in GCM mode.

Hashing: SHA-1 is legacy; SHA-256/SHA-384 preferred. Integrity in ESP uses HMAC-SHA; PRF in IKEv2 derives keys and must match on both peers.

Perfect Forward Secrecy ensures compromise of one key does not expose past or future SAs; without PFS, rekeys derive from the existing key material.

TLS for AnyConnect uses certificates for server auth; client auth can be certificate, or user credentials via AAA; DTLS uses the same keys as TLS but over UDP.

Lifetime values: IKE SA and IPsec SA lifetimes should be set so IPsec lifetime is shorter than or equal to IKE lifetime to avoid rekey race conditions.