Site to Site

Version:

Location in GUI: Secure Connections » Site-to-Site VPN & SD-WAN

Diagram

Classes

vpns (fmc.domains)

Name	Type	Constraint	Mandatory	Default Value
site_to_site	List	`[site_to_site]`	No

site_to_site (fmc.domains.vpns)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
network_topology	Choice	`POINT_TO_POINT`, `HUB_AND_SPOKE`, `FULL_MESH`	Yes
route_based	Boolean	`true`, `false`	Yes
ikev1	Boolean	`true`, `false`	No	`false`
ikev2	Boolean	`true`, `false`	No	`false`
endpoints	List	`[endpoints]`	Yes
ike_settings	Class	`[ike_settings]`	No
ipsec_settings	Class	`[ipsec_settings]`	No
advanced_settings	Class	`[advanced_settings]`	No

endpoints (fmc.domains.vpns.site_to_site)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
peer_type	Choice	`PEER`, `HUB`, `SPOKE`	Yes
extranet_device	Boolean	`true`, `false`	Yes
allow_incoming_ikev2_routes	Boolean	`true`, `false`	No	`true`
backup_interface_logical_name	String		No
backup_interface_public_ip_address	IP		No
backup_local_identity_type	Choice	`ADDRESS`, `AUTO`, `EMAILID`, `HOSTNAME`, `KEYID`	No
backup_local_identity_string	String		No
connection_type	Choice	`ORIGINATE_ONLY`, `ANSWER_ONLY`, `BIDIRECTIONAL`	No	`ORIGINATE_ONLY`
extranet_dynamic_ip	IP		No
extranet_ip_addresses	List	IP	No
interface_logical_name	String		No
interface_ipv6_address	String		No
interface_public_ip_address	IP		No
local_identity_type	Choice	`ADDRESS`, `AUTO`, `EMAILID`, `HOSTNAME`, `KEYID`	No
local_identity_string	String		No
nat_exemption	Boolean	`true`, `false`	No
nat_exemption_inside_interface	String		No
nat_traversal	Boolean	`true`, `false`	No	`true`
override_remote_vpn_filter_access_list	String		No
protected_networks	List	String	No
protected_networks_access_list	String		No
reverse_route_injection	Boolean	`true`, `false`	No	`false`
send_virtual_tunnel_interface_ip_to_peer	Boolean	`true`, `false`	No
vpn_filter_access_list	String		No

ike_settings (fmc.domains.vpns.site_to_site)

Name	Type	Constraint	Mandatory
ikev1_authentication_type	Choice	`MANUAL_PRE_SHARED_KEY`, `AUTOMATIC_PRE_SHARED_KEY`, `CERTIFICATE`	No
ikev1_automatic_pre_shared_key_length	Integer	min: `1`, max: `127`	No
ikev1_certificate	String		No
ikev1_manual_pre_shared_key	String		No
ikev1_policies	List	String	No
ikev2_authentication_type	Choice	`MANUAL_PRE_SHARED_KEY`, `AUTOMATIC_PRE_SHARED_KEY`, `CERTIFICATE`	No
ikev2_automatic_pre_shared_key_length	Integer	min: `1`, max: `127`	No
ikev2_certificate	String		No
ikev2_enforce_hex_based_pre_shared_key	Boolean	`true`, `false`	No
ikev2_manual_pre_shared_key	String		No
ikev2_policies	List	String	No

ipsec_settings (fmc.domains.vpns.site_to_site)

Name	Type	Constraint	Mandatory	Default Value
crypto_map_type	Choice	`STATIC`, `DYNAMIC`	No
do_not_fragment_policy	Choice	`SET`, `COPY`, `CLEAR`, `NONE`	No	`NONE`
ikev1_ipsec_proposals	List	String	No
ikev2_ipsec_proposals	List	String	No
ikev2_mode	Choice	`TUNNEL`, `TRANSPORT_PREFERRED`, `TRANSPORT_REQUIRED`	No	`TUNNEL`
lifetime_duration	Integer	min: `120`, max: `2147483647`	No	`28800`
lifetime_size	Integer	min: `10`, max: `2147483647`	No	`4608000`
perfect_forward_secrecy	Boolean	`true`, `false`	No	`false`
perfect_forward_secrecy_modulus_group	Integer	min: `1`, max: `31`	No
reverse_route_injection	Boolean	`true`, `false`	No	`true`
security_association_strength_enforcement	Boolean	`true`, `false`	No	`false`
tfc	Boolean	`true`, `false`	No	`false`
tfc_burst_bytes	Integer	min: `0`, max: `16`	No	0
tfc_payload_bytes	Integer	min: `0`, max: `1024`	No	0
tfc_timeout	Integer	min: `0`, max: `60`	No	0
validate_incoming_icmp_error_messages	Boolean	`true`, `false`	No	`false`

advanced_settings (fmc.domains.vpns.site_to_site)

Name	Type	Constraint	Mandatory	Default Value
ike_keepalive	Choice	`DISABLED`, `ENABLED`, `ENABLED_INFINITE`	No	`ENABLED`
ike_keepalive_threshold	Integer	min: `10`, max: `3600`	No	`10`
ike_keepalive_retry_interval	Integer	min: `1`, max: `10`	No	`2`
ike_identity_sent_to_peers	Choice	`IP_ADDRESS`, `HOST_NAME`, `AUTO_OR_DN`	No	`AUTO_OR_DN`
ike_peer_identity_validation	Choice	`DO_NOT_CHECK`, `REQUIRED`, `IF_SUPPORTED_BY_CERT`	No	`REQUIRED`
ike_aggressive_mode	Boolean	`true`, `false`	No	`false`
ike_notification_on_tunnel_disconnect	Boolean	`true`, `false`	No	`false`
ikev2_cookie_challenge	Choice	`CUSTOM`, `ALWAYS`, `NEVER`	No	`CUSTOM`
ikev2_threshold_to_challenge_incoming_cookies	Integer	min: `0`, max: `100`	No	`50`
ikev2_number_of_sas_allowed_in_negotiation	Integer	min: `1`, max: `100`	No	`100`
ikev2_maximum_number_of_sas_allowed	Integer		No
ipsec_fragmentation_before_encryption	Boolean	`true`, `false`	No	`true`
ipsec_path_maximum_transmission_unit_aging_reset_interval	Integer	min: `10`, max: `30`	No
spoke_to_spoke_connectivity_through_hub	Boolean	`true`, `false`	No	`false`
nat_keepalive_message_traversal_interval	Integer	min: `10`, max: `3600`	No	`20`
vpn_idle_timeout_value	Integer	min: `1`, max: `35791394`	No	`30`
sgt_propagation_over_virtual_tunnel_interface	Boolean	`true`, `false`	No
bypass_access_control_policy_for_decrypted_traffic	Boolean	`true`, `false`	No	`false`
cert_use_certificate_map_configured_in_endpoint_to_determine_tunnel	Boolean	`true`, `false`	No	`false`
cert_use_ou_to_determine_tunnel	Boolean	`true`, `false`	No	`true`
cert_use_ike_identity_to_determine_tunnel	Boolean	`true`, `false`	No	`true`
cert_use_peer_ip_address_to_determine_tunnel	Boolean	`true`, `false`	No	`true`

Examples

Pre-requisites:

fmc:
  domains:
    - name: Global
      objects:

        networks:
          - name: MyNetworkName1
            prefix: 10.10.10.0/24
          - name: MyNetworkName2
            description: My Network 2 Description
            prefix: 10.10.20.0/24

        security_zones:
          - name: MySecurityZoneName1

        ikev2_policies:
          - name: MyIKEv2Policy1
            dh_groups:
              - 14
              - 24
            encryption_algorithms:
              - AES-256
              - AES-GCM-256
            integrity_algorithms:
              - SHA-256
              - SHA-384
            lifetime: 28800
            priority: 1
            prf_algorithms:
              - SHA-256

        ikev2_ipsec_proposals:
          - name: MyIKEv2IPSecProposal1
            esp_encryptions:
              - AES-256
              - AES-GCM-192
            esp_hashes:
              - SHA-256
              - SHA-384

Site-to-site VPN:

fmc:
  domains:
    - name: Global
      vpns:
        site_to_site:

          - name: MySiteToSiteVPNName1
            network_topology: POINT_TO_POINT
            route_based: false
            ikev2: true
            ike_settings:
              ikev2_authentication_type: MANUAL_PRE_SHARED_KEY
              ikev2_enforce_hex_based_pre_shared_key: false
              ikev2_manual_pre_shared_key: MykeyHere
              ikev2_policies:
                - MyIKEv2Policy1
            endpoints:
              - name: external-1
                extranet_device: true
                peer_type: PEER
                extranet_ip_addresses:
                  - 10.254.252.10
                protected_networks:
                  - MyNetworkName1
              - name: MyDeviceName1
                extranet_device: false
                peer_type: PEER
                interface_logical_name: OUTSIDE
                local_identity_type: HOSTNAME
                connection_type: BIDIRECTIONAL
                protected_networks:
                  - MyNetworkName2
                nat_traversal: true
                nat_exemption: true
                nat_exemption_inside_interface: MySecurityZoneName1
            ipsec_settings:
              crypto_map_type: STATIC
              ikev2_ipsec_proposals:
                - MyIKEv2IPSecProposal1
            advanced_settings:
              bypass_access_control_policy_for_decrypted_traffic: false