#■目的
AWSとIPSecで接続する場合、Software VPN Routerが必要です。
Software VPN RouterはOSSのLibreswan等を使用することで可能ですが、
企業用途での使用による安定稼働と障害時の保守サポート、セキュリティを考慮すると商用ベンダー製品を使用することが求められます。
ということで、今回は AWS Marketplaceにある Cisco ASAvを使用してみてみます。

#■接続イメージ

#■各種情報

ソース	パラメータ	値
ASAv	${outsideInterfaceName}	management
OCI IPSec Connection	${ipAddress1}	200.200.200.201
OCI IPSec Connection	${sharedSecret1}	ASAvSHAREDSECRET01
OCI IPSec Connection	${ipAddress2}	200.200.200.202
OCI IPSec Connection	$${sharedSecret2}	ASAvSHAREDSECRET02
OCI VCN	${OracleInsideTunnelIPAddress1}	10.0.0.0 255.255.0.0
OCI VCN	${OracleInsideTunnelIPAddress2}	10.0.0.0 255.255.0.0
ASAv VTI	${CpeInsideTunnelIpAddressWithMask1}	192.168.0.101 255.255.255.252
ASAv VTI	${CpeInsideTunnelIpAddressWithMask2}	192.168.0.201 255.255.255.252
ASAv VTI	${tunnelInterfaceName1}	ORACLE-VPN1
ASAv VTI	${tunnelInterfaceName2}	ORACLE-VPN2

#■ ASAvインスタンス作成
##● 「EC2ダッシュボート」画面
[インスタンス作成]ボタンをクリック

・AWS Marketplace　からASAvを検索
AWS Marketplace から、ASAvを検索し、使用するASAvの[選択]ボタンをクリック

・ASAvの内容を確認し[Continue]ボタンをクリック

##● 「手順 2: インスタンスタイプの選択」画面
・インスタンスタイプを選択し、[次の手順：インスタンスお詳細の設定]をクリック
ここでは、c4.largeを選択

##● 「手順 3: インスタンスの詳細の設定」画面
サブネット：Management　Subnetを選択
ネットワークインターフェース： [デバイスの追加]をクリックし、eth1を追加

eth0：Management　Subnet
eth1：LAN Subnet

##● 「手順 4: ストレージの追加」画面
必要なサイズを設定

##● 「手順 5: タグの追加」画面
必要なタグを設定

##● 「手順 6: セキュリティグループの設定」画面
IPSec用の UDP:4500,500 IP:50を通すように設定

##● 「汎用(SSD)から起動する」画面
必要なボリュームを選択し、[次へ]をクリック

##● 「手順 7: インスタンス作成の確認」画面
内容に問題がないことを確認し、[起動]をクリック

##● 「既存のキーペアを選択するか、新しいキーペアを作成します。」画面
使用するキーペアを選択し、[インスタンスの作成]をクリック

##● 「作成ステータス」画面
内容を確認し、[インスタンスの表示]をクリック

#■ ASAvインスタンス追加設定
##● Elastic IPSec設定
Public IPを作成し、Management Subnetのインターフェースeth0に設定します

・Elastic IP 画面から、[新しいアドレスの割り当て]をクリック

・[割り当て]をクリック

・割り当てられたPublic IPを確認し、[閉じる]をクリック

・[アクション]から[アドレスの関連付け]をクリック

・作成したPublic IPを選択し、[関連付け]をクリック

##● ネットワークインターフェースの追加設定
eth0とeth1のネットワークインターフェースの送信元/送信先の変更チェックを無効にしてRutingできるようにします。

①ネットワークインターフェース画面の[送信元/送信先の変更チェック]をクリック

②[無効]を選択し、[次へ]をクリック

##● ルートテーブルの編集
①対象ルートテーブルを選択し、[ルートテーブルの編集]をクリック

②Network Interfaceをクリック

③ASAvのLAN Subnet側のインターフェースを選択し設定

#■ ASAv初期設定
IPSec設定するまでの必要な設定を行います

##●ASAvへssh接続

[ec2-user@ip-172-31-1-10 ~]$ ssh -i ASAv.pem admin@100.100.100.101
    The authenticity of host '100.100.100.101 (100.100.100.101)' can't be established.
    RSA key fingerprint is SHA256:q5DFmkA+UtEGvr0/LtdNUqIE.
    RSA key fingerprint is MD5:dd:bb:be:ef:cf:64:ce:8d.
    Are you sure you want to continue connecting (yes/no)? yes
    Warning: Permanently added '100.100.100.101' (RSA) to the list of known hosts.
    User admin logged in to ciscoasa
    Logins over the last 1 days: 1.
    Failed logins since the last login: 0.
    Type help or '?' for a list of available commands.
    ciscoasa>

##●特権 EXEC モード開始
ASAvの設定するため、特権 EXEC モード開始
初期パスワードはNullなので、あとで変更します

    ciscoasa> enable
        Password:
    ciscoasa# configure terminal
    ciscoasa(config)#

##●初期running-config確認

ciscoasa(config)# show running-config
  : Saved

  :
  : Serial Number: TESTASAV910
  : Hardware:   ASAv, 4096 MB RAM, CPU Xeon E5 series 2900 MHz, 1 CPU (2 cores)
  :
  ASA Version 9.10(1)11
  !
  hostname ciscoasa
  enable password ***** pbkdf2
  names
  no mac-address auto

  !
  interface GigabitEthernet0/0
  shutdown
  no nameif
  security-level 0
  ip address dhcp setroute
  !
  interface Management0/0
  nameif management
  security-level 100
  ip address dhcp setroute
  !
  ftp mode passive
  pager lines 23
  mtu management 1500
  no failover
  icmp unreachable rate-limit 1 burst-size 1
  no asdm history enable
  arp timeout 14400
  no arp permit-nonconnected
  arp rate-limit 8192
  timeout xlate 3:00:00
  timeout pat-xlate 0:00:30
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
  timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  timeout floating-conn 0:00:00
  timeout conn-holddown 0:00:15
  timeout igp stale-route 0:01:10
  user-identity default-domain LOCAL
  aaa authentication ssh console LOCAL
  aaa authentication login-history
  no snmp-server location
  no snmp-server contact
  crypto ipsec security-association pmtu-aging infinite
  crypto ca trustpoint _SmartCallHome_ServerCA
  no validation-usage
  crl configure
  crypto ca trustpool policy
  auto-import
  crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca 0509
      12d40vsi 41203230 f0wea7a0 02424d31 few09223 cmas39v9 23908sdv 123287b6
      28sd7hv0 30090603 55040613 iropwefj 19301706 0355040a 13105175 6f566164
      103v8v7v 696d6974 6564311b 30190603 55040313 1251756f 56616469 7320526f
      cd9200u9 97718153 31a99ff6 qw90d8g8 e1a3931d cc8a265a 0938d0ce d70d8016
      109vd8b8 874c8d8a a5d54697 f22c10b9 dseeiuvv 01506943 9ef4b2ef 6df8ecda
      48d40vsi 30090603 55040313 02424d31 few09223 cmas39v9 23908sdv 123287b6
      6564311b 30090603 55040613 iropwefj 19301706 0355040a 13105175 6f566164
      6564311b 696d6974 6564311b 30190603 55040313 1251756f 56616469 7320526f
      0355040a 97718153 31a99ff6 qw90d8g8 e1a3931d cc8a265a 0938d0ce d70d8016
      0355040a 874c8d8a a5d54697 f22c10b9 dseeiuvv 01506943 9ef4b2ef 6df8ecda
      cc8a265a df918f54 2a0b25c1 2619c452 230ev8b9 18r23c38 woqpfi9b
    quit
  telnet timeout 5
  ssh stricthostkeycheck
  ssh 0.0.0.0 0.0.0.0 management
  ssh timeout 30
  ssh version 1 2
  ssh key-exchange group dh-group1-sha1
  console timeout 0
  threat-detection basic-threat
  threat-detection statistics access-list
  no threat-detection statistics tcp-intercept
  dynamic-access-policy-record DfltAccessPolicy
  username admin privilege 15
  username admin attributes
  service-type admin
  ssh authentication publickey 1a:de:80:4d:02:3c:32:b9:e5:bd:0f:ef hashed
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  policy-map type inspect dns preset_dns_map
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection
  policy-map global_policy
  class inspection_default
    inspect ip-options
    inspect netbios
    inspect rtsp
    inspect sunrpc
    inspect tftp
    inspect xdmcp
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect esmtp
    inspect sqlnet
    inspect sip
    inspect skinny
  policy-map type inspect dns migrated_dns_map_2
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection
  policy-map type inspect dns migrated_dns_map_1
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection
  !
  service-policy global_policy global
  prompt hostname context
  call-home
  profile License
    destination address http https://tools.cisco.com/~
    destination transport-method http
  profile CiscoTAC-1
    no active
    destination address http https://tools.cisco.com/~
    destination address email asavtest@cisco.com
    destination transport-method http
    subscribe-to-alert-group diagnostic
    subscribe-to-alert-group environment
    subscribe-to-alert-group inventory periodic monthly
    subscribe-to-alert-group configuration periodic monthly
    subscribe-to-alert-group telemetry periodic daily
  Cryptochecksum:e39a65w4bdr9f68b7shy6b5d0e03
  : end

##● interface設定
追加した2つ目のLAN Subnet側のeth１interface(GigabitEthernet0/0)にはIPが設定されないため、次のコマンドで設定します

① GigabitEthernet0/0設定

ciscoasa(config)# interface GigabitEthernet0/0
ciscoasa(config)# security-level 100
ciscoasa(config)# ip address 172.31.1.254 255.255.255.0
ciscoasa(config)# no shutdown

② GigabitEthernet0/0設定確認
・IP確認

ciscoasa(config-pmap-c)# show ip
  System IP Addresses:
  Interface                Name                   IP address      Subnet mask     Method
  GigabitEthernet0/0       LAN                    172.31.1.254    255.255.255.0   CONFIG
  Management0/0            management             172.31.0.254    255.255.255.0   DHCP
  Current IP Addresses:
  Interface                Name                   IP address      Subnet mask     Method
  GigabitEthernet0/0       LAN                    172.31.1.254    255.255.255.0   CONFIG
  Management0/0            management             172.31.0.254    255.255.255.0   DHCP

・Interface確認

ciscoasa(config-pmap-c)# show nameif
  Interface                Name                     Security
  GigabitEthernet0/0       LAN                      100
  Management0/0            management               100

・ACL設定(必要に応じて)

access-list 101 permit ip any any
access-group 101 in int management 
access-group 101 in int LAN

##●HTTPサーバ設定
必要に応じて設定

ciscoasa(config)# http server enable 
ciscoasa(config)# http 0 0 management

##●パスワード設定

ciscoasa(config)# enable password <Password>
ciscoasa(config)# username admin password <Password>

##●設定保存

ciscoasa(config)# write memory
  Building configuration...
  Cryptochecksum: bec0c504 5d2a4283 321aa0e5 4efeced5

  7311 bytes copied in 0.60 secs
  [OK]

##●HTTPサーバ(Cisco ASDM)接続確認
https:///admin/
にブラウザでアクセスして接続できることを確認

#■OCI 設定
##● Customer-Premises Equipment作成
OCIの[Networking] > [ICustomer-Premises Equipment] 画面から[Create Customer-Premises Equipmentn]をクリックし以下内容を設定

・NAME:適当な名前を設定
・DRG：IPsec接続させる作成済みのDRGを設定
・STATIC ROUTE CIDER:CPE側(ASAv)のCIDERを設定
・CPE IKE IDENTIFIER : ASAvのWAN側Private IPを設定

[Create Premises Equipment]をクリックして作成

##●IPSec Connection作成
①OCIの[Networking] > [IPsec Connetion] 画面から[Create IPsec COnnection]をクリックし以下内容を設定

[Create IPsec Connection]をクリックして作成

②作成したIPsec ConnetionのVPN IP Addressを確認

③作成したIPsec ConnetionのShared Secretを確認
・Tunnel1(200.200.200.201)のShared Secret

・Tunnel2(200.200.200.202)のShared Secret

#■ ASAv IPsec設定
Cisco ASAバージョン9.7.1以降では、ルート・ベースの構成がサポートされているので、Route-Basedで設定します

##● IPsec設定
以下内容を実行して設定

crypto ikev1 enable management

crypto ikev1 policy 1
  authentication pre-share
  encryption aes-256
  hash sha
  group 5
  lifetime 28800

crypto ipsec ikev1 transform-set oracle-vcn-transform esp-aes-256 esp-sha-hmac

 crypto ipsec profile oracle-vcn-vpn-policy
   set ikev1 transform-set oracle-vcn-transform
   set pfs group5
   set security-association lifetime seconds 3600

tunnel-group 200.200.200.201 type ipsec-l2l
tunnel-性 200.200.200.201 ipsec-attributes
  ikev1 pre-shared-key ASAvSHAREDSECRET01

tunnel-group 200.200.200.202 type ipsec-l2l
tunnel-group 200.200.200.202 ipsec-attributes
 ikev1 pre-shared-key ASAvSHAREDSECRET02

interface tunnel1
  nameif ORACLE-VPN1
  ip address 192.168.0.101 255.255.255.252
  tunnel source interface management
  tunnel destination 200.200.200.201
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile oracle-vcn-vpn-policy

interface tunnel2
  nameif ORACLE-VPN2
  ip address 192.168.0.201 255.255.255.252
  tunnel source interface management
  tunnel destination 200.200.200.202
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile oracle-vcn-vpn-policy


route ORACLE-VPN1 10.0.0.0 255.255.0.0 192.168.0.102 1 track 100
route ORACLE-VPN2 10.0.0.0 255.255.0.0 192.168.0.202 100


sla monitor 10
  type echo protocol ipIcmpEcho 200.200.200.201 interface management
  frequency 5
  sla monitor schedule 10 life forever start-time now

track 1 rtr 10 reachability

##● IPsec設定確認
###・IPsec IKEフェーズ１確認
2つのIKE PeerのStateがMM_ACTIVEになっていればOK

ciscoasa(config)# show crypto isakmp sa

  IKEv1 SAs:

    Active SA: 2
      Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
  Total IKE SA: 2

  1   IKE Peer: 200.200.200.202
      Type    : L2L             Role    : initiator
      Rekey   : no              State   : MM_ACTIVE
  2   IKE Peer: 200.200.200.201
      Type    : L2L             Role    : initiator
      Rekey   : no              State   : MM_ACTIVE

  There are no IKEv2 SAs

###・IPsec IKEフェーズ２確認
以下の「 X 」の値がカウントされていることを確認

# pkts encaps: X, #pkts encrypt: X, #pkts digest: X
# pkts decaps: X, #pkts decrypt: X, #pkts verify: X


###・show crypto ipsec sa
ciscoasa(config)# show crypto ipsec sa
  interface: ORACLE-VPN1
      Crypto map tag: __vti-crypto-map-4-0-1, seq num: 65280, local addr: 172.31.0.254

        local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
        remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
        current_peer: 200.200.200.202


        #pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 14, #pkts comp failed: 0, #pkts decomp failed: 0
        #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
        #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
        #TFC rcvd: 0, #TFC sent: 0
        #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
        #send errors: 0, #recv errors: 0

        local crypto endpt.: 172.31.0.254/4500, remote crypto endpt.: 200.200.200.202/4500
        path mtu 1500, ipsec overhead 82(52), media mtu 1500
        PMTU time remaining (sec): 0, DF policy: copy-df
        ICMP error validation: disabled, TFC packets: disabled
        current outbound spi: 6CEB899A
        current inbound spi : 67C67143

      inbound esp sas:
        spi: 0x67C67143 (1741058371)
          SA State: active
          transform: esp-aes-256 esp-sha-hmac no compression
          in use settings ={L2L, Tunnel,  NAT-T-Encaps, PFS Group 5, IKEv1, VTI, }
          slot: 0, conn_id: 193, crypto-map: __vti-crypto-map-4-0-1
          sa timing: remaining key lifetime (kB/sec): (4374000/3089)
          IV size: 16 bytes
          replay detection support: Y
          Anti replay bitmap:
            0x00000000 0x00000001
      outbound esp sas:
        spi: 0x6CEB899A (1827375514)
          SA State: active
          transform: esp-aes-256 esp-sha-hmac no compression
          in use settings ={L2L, Tunnel,  NAT-T-Encaps, PFS Group 5, IKEv1, VTI, }
          slot: 0, conn_id: 193, crypto-map: __vti-crypto-map-4-0-1
          sa timing: remaining key lifetime (kB/sec): (4373998/3089)
          IV size: 16 bytes
          replay detection support: Y
          Anti replay bitmap:
            0x00000000 0x00000001

  interface: ORACLE-VPN2
      Crypto map tag: __vti-crypto-map-5-0-2, seq num: 65280, local addr: 172.31.0.254

        local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
        remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
        current_peer: 200.200.200.201


        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
        #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
        #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
        #TFC rcvd: 0, #TFC sent: 0
        #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
        #send errors: 0, #recv errors: 0

        local crypto endpt.: 172.31.0.254/4500, remote crypto endpt.: 200.200.200.201/4500
        path mtu 1500, ipsec overhead 82(52), media mtu 1500
        PMTU time remaining (sec): 0, DF policy: copy-df
        ICMP error validation: disabled, TFC packets: disabled
        current outbound spi: 957EE5E5
        current inbound spi : 9A0C3747

      inbound esp sas:
        spi: 0x9A0C3747 (2584491847)
          SA State: active
          transform: esp-aes-256 esp-sha-hmac no compression
          in use settings ={L2L, Tunnel,  NAT-T-Encaps, PFS Group 5, IKEv1, VTI, }
          slot: 0, conn_id: 199, crypto-map: __vti-crypto-map-5-0-2
          sa timing: remaining key lifetime (kB/sec): (4374000/3489)
          IV size: 16 bytes
          replay detection support: Y
          Anti replay bitmap:
            0x00000000 0x00000001
      outbound esp sas:
        spi: 0x957EE5E5 (2508121573)
          SA State: active
          transform: esp-aes-256 esp-sha-hmac no compression
          in use settings ={L2L, Tunnel,  NAT-T-Encaps, PFS Group 5, IKEv1, VTI, }
          slot: 0, conn_id: 199, crypto-map: __vti-crypto-map-5-0-2
          sa timing: remaining key lifetime (kB/sec): (4374000/3489)
          IV size: 16 bytes
          replay detection support: Y
          Anti replay bitmap:
            0x00000000 0x00000001

###・アクティブ・セッション確認

ciscoasa(config)# show crypto engine connections active

###・VTIインタフェース確認

ciscoasa(config)# show nameif
  Interface                Name                     Security
  GigabitEthernet0/0       LAN                      100
  Management0/0            management               100
  Tunnel1                  ORACLE-VPN1                0
  Tunnel2                  ORACLE-VPN2                0

###・VTIインタフェース IP確認

ciscoasa(config)# show ip
  System IP Addresses:
  Interface                Name                   IP address      Subnet mask     Method
  GigabitEthernet0/0       LAN                    172.31.1.254    255.255.255.0   CONFIG
  Management0/0            management             172.31.0.254    255.255.255.0   DHCP
  Tunnel1                  ORACLE-VPN1            169.254.101.1   255.255.255.252 manual
  Tunnel2                  ORACLE-VPN2            169.254.102.1   255.255.255.252 manual
  Current IP Addresses:
  Interface                Name                   IP address      Subnet mask     Method
  GigabitEthernet0/0       LAN                    172.31.1.254    255.255.255.0   CONFIG
  Management0/0            management             172.31.0.254    255.255.255.0   DHCP
  Tunnel1                  ORACLE-VPN1            169.254.101.1   255.255.255.252 manual
  Tunnel2                  ORACLE-VPN2            169.254.102.1   255.255.255.252 manual

##● running-config確認

ciscoasa(config)# show running-config
  : Saved

  :
  : Serial Number: TESTASAV910
  : Hardware:   ASAv, 4096 MB RAM, CPU Xeon E5 series 2900 MHz, 1 CPU (2 cores)
  :
  ASA Version 9.10(1)11
  !
  hostname ciscoasa
  enable password ***** pbkdf2
  passwd ***** encrypted
  names
  no mac-address auto

  !
  interface GigabitEthernet0/0
  nameif LAN
  security-level 100
  ip address 172.31.1.254 255.255.255.0
  !
  interface Management0/0
  nameif management
  security-level 100
  ip address dhcp setroute
  !
  interface Tunnel1
  nameif ORACLE-VPN1
  ip address 169.254.101.1 255.255.255.252
  tunnel source interface management
  tunnel destination 200.200.200.201
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile oracle-vcn-vpn-policy
  !
  interface Tunnel2
  nameif ORACLE-VPN2
  ip address 169.254.102.1 255.255.255.252
  tunnel source interface management
  tunnel destination 200.200.200.202
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile oracle-vcn-vpn-policy
  !
  ftp mode passive
  pager lines 23
  mtu management 1500
  mtu LAN 1500
  no failover
  icmp unreachable rate-limit 1 burst-size 1
  no asdm history enable
  arp timeout 14400
  no arp permit-nonconnected
  arp rate-limit 8192
  route ORACLE-VPN1 10.0.0.0 255.255.0.0 10.0.0.1 1 track 1
  route ORACLE-VPN2 10.0.0.0 255.255.0.0 10.0.0.1 100
  timeout xlate 3:00:00
  timeout pat-xlate 0:00:30
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
  timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  timeout floating-conn 0:00:00
  timeout conn-holddown 0:00:15
  timeout igp stale-route 0:01:10
  user-identity default-domain LOCAL
  aaa authentication ssh console LOCAL
  aaa authentication login-history
  http server enable
  http 0.0.0.0 0.0.0.0 management
  no snmp-server location
  no snmp-server contact
  sla monitor 10
  type echo protocol ipIcmpEcho 200.200.200.202 interface management
  frequency 5
  sla monitor schedule 10 life forever start-time now
  crypto ipsec ikev1 transform-set oracle-vcn-transform esp-aes-256 esp-sha-hmac
  crypto ipsec profile oracle-vcn-vpn-policy
  set ikev1 transform-set oracle-vcn-transform
  set pfs group5
  set security-association lifetime seconds 3600
  crypto ipsec security-association pmtu-aging infinite
  crypto ca trustpoint _SmartCallHome_ServerCA
  no validation-usage
  crl configure
  crypto ca trustpool policy
  auto-import
  crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca 0509
      12d40vsi 41203230 f0wea7a0 02424d31 few09223 cmas39v9 23908sdv 123287b6
      28sd7hv0 30090603 55040613 iropwefj 19301706 0355040a 13105175 6f566164
      103v8v7v 696d6974 6564311b 30190603 55040313 1251756f 56616469 7320526f
      cd9200u9 97718153 31a99ff6 qw90d8g8 e1a3931d cc8a265a 0938d0ce d70d8016
      109vd8b8 874c8d8a a5d54697 f22c10b9 dseeiuvv 01506943 9ef4b2ef 6df8ecda
      48d40vsi 30090603 55040313 02424d31 few09223 cmas39v9 23908sdv 123287b6
      6564311b 30090603 55040613 iropwefj 19301706 0355040a 13105175 6f566164
      6564311b 696d6974 6564311b 30190603 55040313 1251756f 56616469 7320526f
      0355040a 97718153 31a99ff6 qw90d8g8 e1a3931d cc8a265a 0938d0ce d70d8016
      0355040a 874c8d8a a5d54697 f22c10b9 dseeiuvv 01506943 9ef4b2ef 6df8ecda
      cc8a265a df918f54 2a0b25c1 2619c452 230ev8b9 18r23c38 woqpfi9b
    quit
  crypto ikev1 enable management
  crypto ikev1 policy 1
  authentication pre-share
  encryption aes-256
  hash sha
  group 5
  lifetime 28800
  !
  track 1 rtr 10 reachability
  telnet timeout 5
  ssh stricthostkeycheck
  ssh 0.0.0.0 0.0.0.0 management
  ssh timeout 30
  ssh version 1 2
  ssh key-exchange group dh-group1-sha1
  console timeout 0
  threat-detection basic-threat
  threat-detection statistics access-list
  no threat-detection statistics tcp-intercept
  dynamic-access-policy-record DfltAccessPolicy
  username admin password ***** pbkdf2 privilege 15
  username admin attributes
  service-type admin
  ssh authentication publickey 1a:de:80:85:4d:02:3c:32:b9:e5:bd:0f:ef hashed
  tunnel-group 200.200.200.202 type ipsec-l2l
  tunnel-group 200.200.200.202 ipsec-attributes
  ikev1 pre-shared-key *****
  tunnel-group 200.200.200.201 type ipsec-l2l
  tunnel-group 200.200.200.201 ipsec-attributes
  ikev1 pre-shared-key *****
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  policy-map type inspect dns preset_dns_map
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection
  policy-map global_policy
  class inspection_default
    inspect ip-options
    inspect netbios
    inspect rtsp
    inspect sunrpc
    inspect tftp
    inspect xdmcp
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect esmtp
    inspect sqlnet
    inspect sip
    inspect skinny
  policy-map type inspect dns migrated_dns_map_2
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection
  policy-map type inspect dns migrated_dns_map_1
  parameters
    message-length maximum client auto
    message-length maximum 512
    no tcp-inspection
  !
  service-policy global_policy global
  prompt hostname context
  call-home reporting anonymous prompt 2
  call-home
  profile License
    destination address http https://tools.cisco.com/~
    destination transport-method http
  profile CiscoTAC-1
    no active
    destination address http https://tools.cisco.com/~
    destination address email asavtest@cisco.com
    destination transport-method http
    subscribe-to-alert-group diagnostic
    subscribe-to-alert-group environment
    subscribe-to-alert-group inventory periodic monthly
    subscribe-to-alert-group configuration periodic monthly
    subscribe-to-alert-group telemetry periodic daily
  Cryptochecksum:e39a65w4bdr9f68b7shy6b5d0e03
  : end

#■ OCI側IPSec動作確認
##●IPSecステータスがUPしていることを確認

#■IPSec接続疎通確認

##● ping疎通確認
・AWS Instance -> OCI Instance

[root@ip-172-31-1-10 ~]# ping 10.0.0.2 -c 10
  PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
  64 bytes from 10.0.0.2: icmp_seq=1 ttl=63 time=4.34 ms
  64 bytes from 10.0.0.2: icmp_seq=2 ttl=63 time=4.47 ms
  64 bytes from 10.0.0.2: icmp_seq=3 ttl=63 time=4.50 ms
  64 bytes from 10.0.0.2: icmp_seq=4 ttl=63 time=4.46 ms
  64 bytes from 10.0.0.2: icmp_seq=5 ttl=63 time=4.40 ms
  64 bytes from 10.0.0.2: icmp_seq=6 ttl=63 time=4.48 ms
  64 bytes from 10.0.0.2: icmp_seq=7 ttl=63 time=5.12 ms
  64 bytes from 10.0.0.2: icmp_seq=8 ttl=63 time=4.41 ms
  64 bytes from 10.0.0.2: icmp_seq=9 ttl=63 time=4.10 ms
  64 bytes from 10.0.0.2: icmp_seq=10 ttl=63 time=4.14 ms

  --- 10.0.0.2 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9014ms
  rtt min/avg/max/mdev = 4.106/4.447/5.122/0.276 ms

・OCI Instance -> AWS Instance

[root@oci-inst01 ~]# ping 172.31.1.10 -c 10
  PING 172.31.1.10 (172.31.1.10) 56(84) bytes of data.
  64 bytes from 172.31.1.10: icmp_seq=1 ttl=254 time=4.07 ms
  64 bytes from 172.31.1.10: icmp_seq=2 ttl=254 time=4.16 ms
  64 bytes from 172.31.1.10: icmp_seq=3 ttl=254 time=4.02 ms
  64 bytes from 172.31.1.10: icmp_seq=4 ttl=254 time=4.17 ms
  64 bytes from 172.31.1.10: icmp_seq=5 ttl=254 time=4.33 ms
  64 bytes from 172.31.1.10: icmp_seq=6 ttl=254 time=4.14 ms
  64 bytes from 172.31.1.10: icmp_seq=7 ttl=254 time=4.31 ms
  64 bytes from 172.31.1.10: icmp_seq=8 ttl=254 time=4.09 ms
  64 bytes from 172.31.1.10: icmp_seq=9 ttl=254 time=10.3 ms
  64 bytes from 172.31.1.10: icmp_seq=10 ttl=254 time=3.91 ms

  --- 172.31.1.10 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9011ms
  rtt min/avg/max/mdev = 3.914/4.758/10.352/1.869 ms

##● ssh接続確認

・OCI Instance -> AWS Instance

[opc@oci-inst01 ~]$ ssh -i ASAv.pem ec2-user@172.31.1.10 hostname
    ec2-inst01

・AWS Instance -> OCI Instance

[ec2-user@ip-172-31-1-10 ~]$ ssh -i id_rsa opc@10.0.0.2 hostname
    oci-inst01

#■Appendix
##●マニュアル
・Cisco ASA Route-Based

・Cisco 適応型セキュリティ仮想アプライアンス（ASAv）クイックスタートガイド

##●White Paper
・[Deploying VPN IPsec Tunnels with Cisco ASA/ASAv VTI - Oracle Cloud]
(https://cloud.oracle.com/iaas/whitepapers/deploy_vpn_ipsec_on_oci_asa_with_vti_11.pdf)