Home > Articles > Cisco

📄 Contents

  1. ASA Easy VPN (EZVPN) Concepts
  2. ASA Easy VPN (EZVPN) Configuration
  • Print
  • + Share This
From the author of ASA Easy VPN (EZVPN) Configuration

ASA Easy VPN (EZVPN) Configuration

The configuration of the Easy VPN server side is very similar to a "typical" remote access server configuration using group policy. Table 1 reviews the steps that are required to perform this configuration.

Table 1: ASA IKEv1 Easy VPN Server Configuration<

1

Create and enter IKEv1 policy configuration mode.

Note: The lower the policy-priority, the higher the priority with a valid range from 1-65535.

asa(config)#crypto ikev1 policy policy-priority

2

Configure an authentication method (default: pre-share).

asa(config-ikev1-policy)#authentication {pre-share | rsa-sig}

3

Configure an encryption method (default: 3des).

asa(config-ikev1-policy)#encryption {des | 3des | aes | aes-192 | aes-256}

4

Configure a hash method (default: sha).

asa(config-ikev1-policy)#hash {md5 | sha}

5

Configure a Diffie-Hellman (DH) group (default: 2).

asa(config-ikev1-policy)#group {1 | 2 | 5}

6

Configure the IKE SA lifetime (Default: 86400 seconds (24 hours)).

asa(config-ikev1-polocy)#lifetime lifetime

7

Enable IKEv1 on an interface

Note: This is the interface that goes out to the IPsec destination.

asa(config)#crypto ikev1 enable interface-name

8

Create a IKEv1 Transform set.

Notes:

encryption-method can be esp-des, esp-3des, esp-aes, esp-aes-192, esp-aes-256, or esp-null

authentication-method can be esp-md5-hmac, esp-sha-hmac or esp-none.

asa(config)#crypto ipsec ikev1 transform-set set-name encryption-method authentication-method

9

Create a dynamic map that links together the previously created transform set and the crypto map (which will be configured next).

asa(config)#crypto dynamic-map dynamic-map-name sequence-number set ikev1 transform-set set-name

10

Create a Crypto map and match based on the previously created dynamic map.

asa(config)#crypto map map-name sequence-number ipsec-isakmp dynamic dynamic-map-name

11

Apply the crypto map to an interface.

asa(config)#crypto map map-name interface interface

12

Create an internal group policy.

asa(config)#group-policy policy-name internal

13

Enter group policy attribute configuration mode.

asa(config)#group-policy policy-name attributes

14

Enable the use of the Easy VPN Network Emulation mode.

asa(config-group-policy)#nem enable

15

(optional) Create an access-list to specify the traffic that will be to be encrypted within the IPsec tunnel to the central network.

Note: This is a very simplified version of an ACL; for further details on ACLs. see the "ASA Access Lists Concepts and Configuration" article.

asa(config)#access-list acl-name extended {permit | deny} protocol source-network source-netmask destination-network destination-netmask

16

(optional) Enable the use of split tunnel.

Note: the mode shown will tunnel only specified traffic.

asa(config-group-policy)#split-tunnel-policy tunnelspecified

17

(optional) Specify the name of an access list that specifies the traffic to be tunneled.

asa(config-group-policy)#split-tunnel-network-list access-list-name

18

Define a username and password that will be used by the remote client to log in.

asa(config)#username username password password

19

Specify the tunnel group type.

asa(config)#tunnel-group tunnel-group-name type remote-access

20

Enter IPsec tunnel general attribute configuration mode.

asa(config)#tunnel-group tunnel-group-name general-attributes

21

Specify the default group policy to be used.

asa(config-tunnel-general)#default-group-policy policy-name

22

Enter IPsec tunnel IPsec attribute configuration mode.

asa(config)#tunnel-group tunnel-group-name ipsec-attributes

23

Configure the IPsec tunnel pre-shared key or certificate trustpoint.

asa(config-tunnel-ipsec)#ikev1 pre-shared-key pre-shared-key

The client configuration, as opposed to the server configuration, is very simple and is shown in Table 2:

Table 2: ASA IKEv1 Easy VPN Client Configuration

1

Configure the IP addresses to the Easy VPN server (or servers).

asa(config)#vpnclient server server-ip-address [server-ip-address2...server-ip-address10]

2

Configure the Easy VPN mode.

asa(config)#vpnclient mode {client-mode | network-extension-mode}

3

Configure the IPsec VPN group credentials.

Note: The tunnel-group-name and pre-shared-key come from the configuration of the Easy VPN server.

asa(config)#vpnclient vpngroup tunnel-group-name password pre-shared-key

4

Configure the login credentials.

Note: These were configured with the username statement in the VPN server configuration.

asa(config)#vpnclient username username password password

5

(optional) When using split tunneling, configure to enable automatic IPsec tunnel initiation.

asa(config)#vpnclient nem-st-autoconnect

6

Enable the Easy VPN client.

asa(config)#vpnclient enable

Summary

The configuration of a VPN can be daunting, and getting it to work as expected can be very challenging. Cisco's Easy VPN feature allows at least the client configuration to be as easy as possible and enables the relatively small ASA 5505 to become a well-secured, easily configured hardware client.

There are a number of possible ways that a VPN can be configured on modern networks, and this is certainly a good option in certain situations and should be considered as one of the possibilities.

  • + Share This
  • 🔖 Save To Your Account