Configuring VPN's in the Real World

EildorEildor Member Posts: 444
in CCNP
Do people configure VPN's via the GUI, or CLI? It seems like a lot of effort to use the CLI, and much more likely you'll end up making a mistake... how's it done in the "real world"?
· Share on FacebookShare on Twitter

Comments

  • networker050184networker050184 Mod Posts: 11,962 Mod
    Usually CLI if done on routers, some ASA admins like the GUI though. When you are doing it by CLI you are usually going to have a template that you just pop in the IPs and key and it's good to go. No need to manually type it all out every time.
    An expert is a man who has made all the mistakes which can be made.
    · Share on FacebookShare on Twitter
  • EildorEildor Member Posts: 444
    So would you recommend I memorise all of the commands then? Because if I'm going to have to troubleshoot via the CLI I'll need to pretty much know all of the commands.
    · Share on FacebookShare on Twitter
  • Mrock4Mrock4 Banned Posts: 2,359 ■■■■■■■■□□
    Right on with networker, CLI on routers, ASDM on ASA's (I actually love ASDM, despite it's quirkiness with some java versions). It's good to know the CLI either way..so if you get locked out of ASDM for some reason, you're not hopeless!
    · Share on FacebookShare on Twitter
  • powmiapowmia Users Awaiting Email Confirmation Posts: 322
    What's a GUI? icon_scratch.gif
    · Share on FacebookShare on Twitter
  • EildorEildor Member Posts: 444
    GUI as in Graphical User Interface, such as the interface provided by CSM, ASDM, CCP. But you already knew that ;)
    · Share on FacebookShare on Twitter
  • gregorio323gregorio323 Member Posts: 201 ■■■□□□□□□□
    Powmia I think its a service module you pop in a 6509-E? icon_study.gif still searching for the use of it! I'll get back to you on that!
    powmia wrote: »
    What's a GUI? icon_scratch.gif
    · Share on FacebookShare on Twitter
  • Mrock4Mrock4 Banned Posts: 2,359 ■■■■■■■■□□
    powmia wrote: »
    What's a GUI? icon_scratch.gif

    It's that thing that lets you configure a VPN a LOT faster than CLI :)

    I have no shame, I am not an ASA guru, but I have both installed and maintained ASAs, and for installs, CLI would be OK, but for production, maintaining rulesets via CLI would be much more error prone, and frankly a headache, ESPECIALLY if you're using complex rulesets (ie: permit group A ports SERVICE_GROUP_A -> group B ports SERVICE_GROUP_B, etc). I'm a die-hard CLI guy, but I make exceptions with ASA's!
    · Share on FacebookShare on Twitter
  • RouteMyPacketRouteMyPacket Member Posts: 1,104
    What I find funny is that in the handful of times I have configured VPN's on ASA's I have done them via ASDM but never once used the VPN Wizard. I had never seen the wizard until i started down the Security track. lulz

    Speaking of GUI, Cisco putting CCP on their exams is a pathetic joke. Not real world at all..sorry for that rant. lol
    Modularity and Design Simplicity:

    Think of the 2:00 a.m. test—if you were awakened in the
    middle of the night because of a network problem and had to figure out the
    traffic flows in your network while you were half asleep, could you do it?
    · Share on FacebookShare on Twitter
  • gorebrushgorebrush Member Posts: 2,744 ■■■■■■■□□□
    ASDM is actually really slick. The packet tracer type functionality is very useful when troubleshooting too.

    However, nothing beats a CLI IMO TBH.
    · Share on FacebookShare on Twitter
  • powmiapowmia Users Awaiting Email Confirmation Posts: 322
    You can trace the flow of packets through an ASA via CLI too, in fact I didn't know you could do that through the GUI. I do agree, maintaining rules isn't feasible outside of ASDM. I'm stuck in my ways with CLI for everything else though... just a preference, nothing more.
    · Share on FacebookShare on Twitter
  • Master Of PuppetsMaster Of Puppets Member Posts: 1,210
    powmia wrote: »
    You can trace the flow of packets through an ASA via CLI too, in fact I didn't know you could do that through the GUI. I do agree, maintaining rules isn't feasible outside of ASDM. I'm stuck in my ways with CLI for everything else though... just a preference, nothing more.

    Same here. I don't like GUIs. I always use the CLI. Actually, I have used ASDM only a couple of times :D Usually when time is short.
    Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for.
    · Share on FacebookShare on Twitter
  • blueberriesblueberries Banned Posts: 138
    Powmia is playing with you guys.

    Setting up a decent vpn in CLI is child's play, especially something as simple as a GRE tunnel with IPSEC. DMVPN design gets really fun, and it only needs an extra command or three.
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    CLI for site to site; ASDM/GUI for RA. VPN isn't what you have to worry about; its when you get a PIX or pre 8.3 ASA and have to upgrade it - you'll see what I mean lol.
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    powmia wrote: »
    What's a GUI? icon_scratch.gif


    Really, I would think that someone with their CCIE would know what a GUI is.

    GUI:

    Glowing Underwear Inside
    · Share on FacebookShare on Twitter
  • powmiapowmia Users Awaiting Email Confirmation Posts: 322
    Ahhh, so that's what's powering our SDN controllers!
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    powmia wrote: »
    Ahhh, so that's what's powering our SDN controllers!

    Lets not use that term, people will start freakin' out. IDK what setup your referring to but if it has the words _CS with a bank of W/N in it I found scripting CLI is still quicker for a lot of tasks.

    Templates are nice though =/
    · Share on FacebookShare on Twitter
  • ZartanasaurusZartanasaurus Member Posts: 2,008 ■■■■■■■■■□
    I do it in ASDM, but I should learn to do it in CLI. I do almost everything ASA related in ASDM because that's how I learned to operate the ASA initially. I do nat configurations at the CLI though.
    Currently reading:
    IPSec VPN Design 44%
    Mastering VMWare vSphere 5​ 42.8%
    · Share on FacebookShare on Twitter
  • TheNewITGuyTheNewITGuy Member Posts: 169 ■■■■□□□□□□
    CLI mostly but the ASDM interface allows you to quickly create them too if you dont use the wizard. If you go into "Connection Profiles" under Configuration/VPN area and create a new one it does 90% of the work for you. I hate the wizard especially with the default DM_INLINE_1 crap it uses.
    · Share on FacebookShare on Twitter
  • aaron0011aaron0011 Member Posts: 330
    Majority of the VPNs we do are EZVPN from ASAs to ISRs and we do them via CLI. As networker mentioned above, we have templates built to plug in for time savings and to eliminate manual entry errors.
    · Share on FacebookShare on Twitter
  • RouteMyPacketRouteMyPacket Member Posts: 1,104
    I'm going to be looking at a huge ASA migration tomorrow, CLI or ASDM is the question. I mean it's over 9,000 ACL's, 31,000 Objects among other things. lulz
    Modularity and Design Simplicity:

    Think of the 2:00 a.m. test—if you were awakened in the
    middle of the night because of a network problem and had to figure out the
    traffic flows in your network while you were half asleep, could you do it?
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    ASA to ASA? What versions?
    · Share on FacebookShare on Twitter
  • RouteMyPacketRouteMyPacket Member Posts: 1,104
    5550's to 5585's v8.4 looks like
    Modularity and Design Simplicity:

    Think of the 2:00 a.m. test—if you were awakened in the
    middle of the night because of a network problem and had to figure out the
    traffic flows in your network while you were half asleep, could you do it?
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    v8.4 5550? <-- if so I see now that you're being truly sarcastic =D
    · Share on FacebookShare on Twitter
  • RouteMyPacketRouteMyPacket Member Posts: 1,104
    ?

    5585's will run 8.4
    Modularity and Design Simplicity:

    Think of the 2:00 a.m. test—if you were awakened in the
    middle of the night because of a network problem and had to figure out the
    traffic flows in your network while you were half asleep, could you do it?
    · Share on FacebookShare on Twitter
  • megatran808megatran808 Member Posts: 53 ■■■□□□□□□□
    I've only done CLI VPN configuration on ASA and routers. Hardly used ASDM. I think it really depends on the work place. Just gotten used to using the CLI.
    "Love your Job, but never fall in love with your company....because you never know when your company stops loving you!"
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    RouteMyPacket wrote: »
    ?

    5585's will run 8.4

    I was asking if the 5550 was 8.4 already.
    · Share on FacebookShare on Twitter
  • RouteMyPacketRouteMyPacket Member Posts: 1,104
    No, 5550's 8.2(3) to 5585's 8.4(6)
    Modularity and Design Simplicity:

    Think of the 2:00 a.m. test—if you were awakened in the
    middle of the night because of a network problem and had to figure out the
    traffic flows in your network while you were half asleep, could you do it?
    · Share on FacebookShare on Twitter
  • xXErebuSxXErebuS Member Posts: 230
    Have you done a pre 8.3 to 8.3+ before?
    · Share on FacebookShare on Twitter
  • EildorEildor Member Posts: 444
    Interesting... thanks guys!
    · Share on FacebookShare on Twitter
  • KrekenKreken Member Posts: 284
    On ASA, I used ASDM, on router - cli.
    · Share on FacebookShare on Twitter
Sign In or Register to comment.