Cisco ASA – Terminating Over 5000 IPSec VPN Connections

Not sure about tinc but IPSEC is almost mandatory. No serious business would trust PPTP.

Not sure how IPSEC affects routing. A tunnel is a tunnel is a tunnel regardless of the encryption. You'll be running into the same issues re: split tunnel or not, getting customers to understand the concept / oh look a particular customer's LAN IP clashes with the VPN pool you've picked, etc.

Sounds like you're aiming at SME market (individual servers, direct login etc.) so that rules out more sophisticated solutions, but I'll list two possible approaches anyway

• some kind of VPN concentrator that allows profiles. All customers login to VPN concentrator then depending on their profile/group/whatever vendor teminology, get permissions to use protocol X to IP Y (ie their own server).

• Cisco ASR1000V virtual routers - each customer gets one, you can then run direct IPSEC tunnels (with VTIs so makes routing appear easy) or even direct MPLS back to the customers so the router appears as just another branch in their topology, then allocate your VNICs VLANs etc. on the inside so they get a nice virtual 'branch'.

• a smaller scale version of the above, we've used monowall to great effect for this purpose (i.e. each customer gets a layer 3 virtual device that acts as a router/firewall, they VPN into this device and get access to their VLANs only), however then each router/firewall needs their own public IP address.

Re: your current approach, you do realise then each server needs a public IP or you have a complicated and convoluted system of NATs where each customer's VPN path gets allocated a single port or similar.

I'd recommend getting a full time networker in to look over any design / proposal you have, it sounds like you're coming at it from a server background.

General Logging

To log IPSec events, you will want to run the following commands:

logging enable
logging emblem ! (optional for Cisco's emblem format)
logging timestamp
logging buffered notifications 

Some of these commands will already be on your ASA as you're sending your buffered log to an FTP server. I won't include the FTP commands due to this. Then you will want to look for the specific codes you're interested in, in the log on the FTP server.

Example IPSec L2L disconnect message:

%ASA-4-113019: Group = 202.XXX.YYY.ZZZ, Username = 202.XXX.YYY.ZZZ, IP = 202.XXX.YYY.ZZZ, Session disconnected. Session Type: LAN-to-LAN, Duration: 1d 1h:13m:46s, Bytes xmt: 372142455, Bytes rcv: 384146009, Reason: Lost Service

Emailed Notifications

First create your list of events you want to catch.

Catch All IPSec List

logging list IPSec_Notifications level notification class vpn

Specific Event List

logging list IPSec_Notifications message 113019
! Replace XXXXXX with next code
logging list IPSec_Notifications message XXXXXX
! Repeat for the rest of the codes you're interested in

Now setup the email settings.

logging mail IPSec_Notifications
logging from-address your-from-address@your-domain.com
logging recipient-address who-should-receive-emails@your-domain.com level notifications
smtp-server X.X.X.X ! Replace with your SMTP server IP

Notes

All of the logging above is limited to notifications and higher level (i.e. level 5, 4, 3, 2 and 1). If you find a code of a lower level, you will need to replace level notifications with level informational or level debugging.

The example event above (ASA-4-113019) is level warnings which you can see from the ASA-4 prefix on the event.