VPN IPSEC between PFSense and Cisco ASA 5505

pipoto

Hi,

Does everyone's ever built an IPSEC VPN between a PFSense 1.2.3 release and a CISCO ASA 5505 ?
If Yes, can you give me the way to configure it, even possible by the ASDM interface ?

On the PFSense Side, I think this Tuto is well explained :
http://doc.pfsense.org/index.php/IPsec_between_pfSense_and_Cisco_IOS

But for the CISCO, I prefer to ask for somebody's help :)

Thanks in advance
Kevin.

jimp

The ASA side is a bit different, but there are Cisco docs which cover it, and it's also covered in the book.

There are dozens (maybe hundreds, or thousands) of docs on Cisco.com that cover IPsec configuration on their equipment. It's just a standard IPsec site-to-site (or lan-to-lan as they call it) tunnel. If you make sure the settings on the ASA match that of pfSense, it should work.

pipoto

Yes Thanks, I have tested this this afternoon, and it works.
But Very Slowly !

The ping is OK in both side.

Have an idea ?
Thanks !

jimp

That depends on what you mean by "slow" and what protocols are involved.

Some things will be slower over a VPN by the very nature of a VPN, if the ping time is OK across the tunnel it may have more to do with the bandwidth you're trying to push on the hardware you have. It's easy to max out a CPU on low-power hardware with IPsec.

pipoto

Thahks for your answer.
The hard is not in cause, because it is a Virtual Machine with enough CPU and memory assigned, and no cpu averload are noticed.

Lines are SDSL 2M, and the bandwith max on my VPN Ipsec is about 0,5M.
I have tried a Hash in MD5 and SHA without any difference.

Have an idea ?

jimp

Try using a different encryption method such as AES-128 which would be faster than 3DES.

Are you also monitoring the CPU and such on the ASA? I wouldn't think that little of traffic would tax it though.

It may also be the protocol you are using. Some things might be fast, such as http downloads, while others would be slow (SMBv1 windows shares).