How to configure Policy Based VPN on Cisco FTD

In previous entries of my Cisco FTD blog series, I explored the deployment of Cisco Firepower Threat Defense (FTD) and Firepower Management Center (FMC) in OCI, along with the configuration steps of a site-to-site VPN in route-based mode. This time, I’ll guide you through a different approach on how to configure a site-to-site VPN using policy-based mode on Cisco FTD.

If you’re new to VPN setups with FTD or missed the earlier parts of this series, I recommend checking out my previous blog posts, to get familiar with the core requirements and initial setup.

In writing this blog, I had the pleasure of working with my colleague Raffi Shahbazian, whose insights were invaluable in refining the steps for this blog. A big thank you for your support.

With that being said, let’s dive into how policy-based VPN can be used between Cisco FTD and OCI.

Agenda

OCI – Create IPsec Connection.
Cisco – Create a VPN Connection.
Verification.

Create IPsec Connection

Log in to the OCI dashboard, navigate to the networking section, from the Customer Connectivity list click on Site-to-Site VPN, Create IPSec connection.

Choose the proper name, compartment, and Dynamic Routing Gateway.

Continue with tunnel1 configuration, check the screenshot below.

Note: You don’t need to add routes to your on-prem network with policy-based VPN, so no static routes required to be added here.

Note: The customer-premises equipment (CPE) vendor could be Cisco policy-based or other.

Note: Click Show advanced options if you need to customized phase one (ISAKMP) and phase two (IPSec) tunnel config. Please check the screenshot below.

Click Create IPsec Connection.

The IPsec connection is created and displayed on the page. The connection is in the provisioning state for a short period.

Now, click on Open CPE configuration helper, create content, and download configuration.

Note: You need to save the Oracle public IP address, and Shared secret.

Create a VPN Connection

Connect to you Cisco FMC, navigate to Devices, VPN, and Site to Site VPN.

Select + Site to Site VPN to add a new IPSec VPN connection.

Most of the configuration will be under the Create New VPN Topology section.

However, prior to configuring the VPN Topology section, we’ll need to define the extended access-lists that will be used by the policy-based VPN for the ISAKMP (phase 1) and IPSec Policy (Phase 2).

Extended Access-Lists

To configure the extended access-lists that will be used by the policy-based VPN, we’ll need to navigate to the Objects -> Object Management -> Access Lists -> Extended -> Add Extended Access List. We’ll need two extended access-lists:

One to identify OCI to On-Premises traffic. The other to identify On-Premises to OCI traffic.

In my case, I have created the following extended access-lists: oci-to-on-premises and on-premises-any.

ISAKMP and IPSec Policy

To configure the IKE and IPSec Policy, we’ll need to navigate to the Objects -> Object Management -> VPN. Depending on which version of IKE you are using, you will need to create the proposals for the respective IKE version. In my case, I am using IKEv2 and will use the IKv2 Policy and IKEv2 IPsec Proposal to manage the cipher suites.