> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix Gateway to Cisco ASA

> This document describes how to build an IPsec tunnel based Site2Cloud connection between an Aviatrix Gateway and Cisco ASA Firewall.

This document describes how to build an IPsec tunnel based Site2Cloud connection
between an Aviatrix Gateway and Cisco ASA Firewall.

The network setup is as follows:

<img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/threedot.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=36963cd7f65aa469c6d5fe2021fa71a7" alt="Network setup diagram" width="24" height="34" data-path="images/guides/connectivity/vpn/threedot.png" />

**VPC/VNet-AVX (with Aviatrix Gateway)**

*VPC/VNet CIDR: 10.0.0.0/16*

*VPC/VNet Public Subnet CIDR: 10.0.1.0/24*

*VPC/VNet Private Subnet CIDR: 10.0.2.0/24*

**On-Prem (with Cisco ASA Firewall)**

*On-Prem Network CIDR: 10.10.0.0/16*

## Creating an External Connection

1. In Aviatrix CoPilot, launch an
   [Aviatrix Transit Gateway](https://legacy.docs.aviatrix.com/documentation/latest/network/transit-gateway-about.html?expand=true)
   at the subnet (public subnet for AWS, GCP, or OCI) of VPC/VNet-AVX. Collect
   the Gateway's public IP addresses (52.8.12.122 in this example).

2. Navigate to Networking > Connectivity > External Connections (S2C) to create
   a Site2Cloud connection using the values for one of the below options:

   * [Static Route-Based](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-static-route-based-unmapped.html)
   * [Static Policy-Based](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-static-policy-based-unmapped.html)

   Substitute the following values:

   * Remote Device Type: Generic
   * Algorithms: turn Off
   * Remote Device IP: Public IP of ASA WAN port
   * Remote Subnet CIDR(s): 10.10.0.0/16 (VPC2 private subnet)
   * Local Subnet CIDR(s): 10.0.2.0/24 (VPC1 private subnet)

3. After the connection is created, select the vertical ellipsis menu for that
   connection and select **Download Configuration**.

4. In the Download Configuration dialog, select **Cisco** from the **Vendor**
   dropdown menu.

5. Select **ASA 5500 Series** from the **Platform** dropdown menu.

6. Select the proper ASA Software version from **Software** drop down list
   depending on your ASA running OS.

7. Click **Download**.

8. Save the configuration file as a reference for configuring your ASA.

   The following is an excerpt of an ASA sample configuration based on the
   Site2Cloud configuration above.

   <img src="https://mintcdn.com/aviatrix-14b37c43/1zOMu4WXCFpEtXhJ/images/guides/connectivity/vpn/document-cisco.png?fit=max&auto=format&n=1zOMu4WXCFpEtXhJ&q=85&s=77092e9b6bf210e5c49a569b6ba59805" alt="ASA sample configuration excerpt" width="8032" height="11104" data-path="images/guides/connectivity/vpn/document-cisco.png" />

### Configuring Cisco ASA

1. Either SSH into the ASA or connect to it directly through its console port.
2. Issue the **configure terminal** command in privileged **EXEC** mode to start
   global configuration mode. The prompt changes to the following :

```
hostname(config)#
```

3. Enter the CLIs as per the downloaded configuration. Note that you may need to
   modify these CLIs to fit your ASA configuration.

## Verifying the Connection Status

In CoPilot, go to the Diagnostics > Cloud Routes > External Connections tab to
confirm the Status and Tunnel Status of the external connection.

## Troubleshooting

You can use the Diagnostic Tools (under Diagnostics in the left navigation menu)
to troubleshoot any connection issues.

For support, please open a support ticket at
[Aviatrix Support Portal](https://support.aviatrix.com).

## Related Topics

* [About External Connection Settings](https://legacy.docs.aviatrix.com/documentation/latest/network/externaldevice-settings.html)