SlideShare a Scribd company logo

Easy vpn

Hồ Đắc Biên, profile picture
Hồ Đắc Biên

This document provides instructions for configuring security on an appliance for remote access using Cisco Easy VPN. It discusses introducing Easy VPN, the connection process, supported clients and servers, modes of operation, and configuring the Easy VPN server for extended authentication. Key steps include creating ISAKMP and IPsec policies, defining a group policy with DNS/WINS settings, and configuring authentication methods like XAuth.

1 of 45
Downloaded 191 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
Configuring Security Appliance Remote Access Using Cisco Easy VPN Lesson 12 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-1
Outline  Introduction to Easy VPN  How Easy VPN Connection Process  Overview of Cisco VPN Client  Configuring Cisco VPN Client as Easy VPN Remote  Working with the Cisco VPN Client  Configuring Users and Groups  Configuring the Easy VPN Server for Extended Authentication  Summary © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-2
Introduction to Cisco Easy VPN © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-3
Cisco Easy VPN Cisco Easy VPN Remote Cisco Easy VPN Servers Cisco VPN Client > 3.x Cisco 800 and 900 Series Router Cisco IOS Release > 12.2(8)T Router Cisco 1700 and 1800 Series Router Cisco 2800 and 3800 Series Router Cisco PIX Firewall Software Version > 6.2 Cisco PIX Firewall 501 and 506 Cisco ASA 5500 Series Cisco ASA 5505 Security Appliance © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-4
Features of Cisco Easy VPN Server  Server support for Cisco Easy VPN Remote clients was introduced with the release of the Cisco PIX Firewall Software version 6.2 and Cisco IOS 12.2(8)T.  It allows remote end users to communicate using IPsec with supported adaptive security appliance VPN gateways.  Centrally managed IPsec policies are pushed to the clients by the server, minimizing configuration by the end users. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-5
Supported Cisco Easy VPN Servers Cisco Easy VPN Servers Cisco VPN Client > 3.x Cisco 800 and 900 Series Router Cisco IOS Release > 12.2(8)T Router Cisco 1700 and 1800 Series Router Cisco 2800 and 3800 Series Router Cisco PIX Firewall Software Version > 6.2 Cisco PIX 501 and 506 Security Appliance Cisco ASA 5500 Series Cisco ASA 5505 Adaptive Security Appliance © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-6
Supported Cisco Easy VPN Remote Clients Cisco Easy VPN Remote Cisco VPN Client > 3.x Cisco 800 and 900 Series Router Cisco IOS Release > 12.2(8)T Router Cisco 1700 and 1800 Series Router Cisco 2800 and 3800 Series Router Cisco PIX Firewall Software Version> 6.2 Cisco PIX 501 and 506 Security Appliance Cisco ASA 5500 Series Cisco ASA 5505 Adaptive Security Appliance © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-7
Cisco Easy VPN Remote Modes of Operation Cisco Easy VPN Remote supports two modes of operation:  Client mode – Specifies that NAT or PAT be used. – Enables the client to automatically configure NAT or PAT translations and the ACLs that are needed to implement the VPN tunnel. – Supports split tunneling.  Network Extension mode – Specifies that the hosts at the client end of the VPN connection use fully routable IP addresses. – NAT or PAT is not used. – Supports split tunneling. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-8
Cisco Easy VPN Remote Client Mode PAT 10.0.0.0/24 192.168.1.2 192.168.1.1 10.0.1.2 VPN Tunnel 192.168.1.3 ASA 5505 ASA 5520 Adaptive Adaptive Security Security Appliance Appliance (Cisco Easy (Cisco Easy VPN VPN Remote) Server) © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-9
Cisco Easy VPN Remote Network Extension Mode 172.16.30.0/24 172.16.10.5 172.16.10.1 10.0.1.2 VPN Tunnel 172.16.10.6 Cisco 1811 Router (Cisco Easy VPN Remote) ASA 5520 10.0.2.2 (Cisco Easy VPN Server) ASA 5505 172.16.20.5 (Cisco Easy VPN 172.16.20.1 Remote) 172.16.20.6 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-10
How Cisco Easy VPN Connection Process © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-11
Cisco Easy VPN Remote Connection Process Step 1: The Cisco VPN Client initiates the IKE Phase 1 process. Step 2: The Cisco VPN Client negotiates an IKE SA. Step 3: The Cisco Easy VPN Server accepts the SA proposal. Step 4: The Cisco Easy VPN Server initiates a username/password challenge. Step 5: The mode configuration process is initiated. Step 6: IKE quick mode completes the connection. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-12
Step 1: Cisco VPN Client Initiates IKE Phase 1 Process Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server  Using PSKs? Initiate aggressive mode.  Using digital certificates? Initiate main mode. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-13
Step 2: Cisco VPN Client Negotiates an IKE SA Remote PC with Cisco Easy VPN Remote Client Security Appliance Cisco Easy VPN Server Proposal 1, Proposal 2, Proposal 3  The Cisco VPN Client attempts to establish an SA between peer IP addresses by sending multiple IKE proposals to the Cisco Easy VPN Server.  To reduce manual configuration on the Cisco VPN Client, these IKE proposals include several combinations of the following: – Encryption and hash algorithms – Authentication methods – DH group sizes © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-14
Step 3: Cisco Easy VPN Server Accepts SA Proposal Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server Proposal 1 Proposal checking finds proposal 1 match.  The Cisco Easy VPN Server searches for a match: – The first proposal to match the server list is accepted (highest priority match). – The most secure proposals are always listed at the top of the Cisco Easy VPN Server proposal list (highest priority).  IKE SA is successfully established.  Device authentication ends and user authentication begins. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-15
Step 4: Cisco Easy VPN Server Initiates a Username/Password Challenge Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server Username/Password Challenge AAA Username/Password checking  If the Cisco Easy VPN Server is configured for XAUTH, the VPN Client waits for a username/password challenge: – The user enters a username/password combination. – The username/password information is checked against authentication entities.  All Cisco Easy VPN Servers should be configured to enforce user authentication. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-16
Step 5: Mode Configuration Process Is Initiated Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server Client Requests Parameters System Parameters via Mode Configuration  If the Cisco Easy VPN Server indicates successful authentication, the Cisco VPN Client requests the remaining configuration parameters from the Cisco Easy VPN Server: – Mode configuration starts. – The remaining system parameters (IP address, DNS, split tunneling information, and so on) are downloaded to the Cisco VPN Client.  Remember that the IP address is the only required parameter in a group profile; all other parameters are optional. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-17
Step 6: IKE Quick Mode Completes Connection Remote PC with Cisco Easy VPN Remote Client Quick Mode Security Appliance IPsec SA Cisco Easy VPN Establishment Server VPN Tunnel  After the configuration parameters have been successfully received by the Cisco VPN Client, IKE quick mode is initiated to negotiate IPsec SA establishment.  After IPsec SA establishment, the VPN connection is complete. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-18
Configuring the Easy VPN Server for Extended Authentication © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-19
Cisco Easy VPN Server General Configuration Tasks The following general tasks are used to configure an Cisco Easy VPN Server on a security appliance: Task 1: Create ISAKMP policy for remote Cisco VPN Client access. Task 2: Create IP address pool. Task 3: Define group policy for mode configuration push. Task 4: Create transform set. Task 5: Create dynamic crypto map. Task 6: Assign dynamic crypto map to static crypto map. Task 7: Apply crypto map to security appliance interface. Task 8: Configure Xauth. Task 9: Configure NAT and NAT 0. Task 10: Enable IKE DPD. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-20
Task 1: Create ISAKMP Policy for Remote VPN Client Access Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ISAKMP Pre-Share DES SHA Group 2 asa1(config)# isakmp enable outside asa1(config)# isakmp policy 20 asa1(config-isakmp-policy)# authentication pre-share asa1(config-isakmp-policy)# encryption des asa1(config-isakmp-policy)# hash sha asa1(config-isakmp-policy)# group 2 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-21
Task 2: Create IP Address Pool Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 MYPOOL 10.0.11.1-10.0.11.254 ciscoasa(config)# ip local pool poolname first-address—last-address [mask mask]  Creates an optional local address pool if the remote client is using the remote server as an external DHCP server asa1(config)# ip local pool MYPOOL 10.0.11.1-10.0.11.254 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-22
Task 3: Define Group Policy for Mode Configuration Push Task 3 contains the following steps: Step 1: Set the tunnel group type. Step 2: Configure the IKE PSK. Step 3: Specify the local IP address pool. Step 4: Configure the group policy type. Step 5: Enter the group-policy attributes submode. Step 6: Specify the DNS servers. Step 7: Specify the WINS servers. Step 8: Specify the DNS domain. Step 9: Specify idle timeout. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-23
Step 1: Set the Tunnel Group Type Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config)# tunnel-group name type type  Names the tunnel group  Defines the type of VPN connection that is to be established asa1(config)# tunnel-group TRAINING type ipsec-ra © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-24
Step 2: Configure IKE Pre-Shared Key Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 Push to Client ciscoasa(config)# tunnel-group name [general-attributes | ipsec-attributes]  Enters tunnel-group ipsec-attributes submode to configure the key ciscoasa(config-tunnel-ipsec)# pre-shared-key key  Associates a PSK with the connection policy asa1(config)# tunnel-group TRAINING ipsec-attributes asa1(config-tunnel-ipsec)# pre-shared-key cisco123 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-25
Step 3: Specify Local IP Address Pool Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 Push to Client ciscoasa(config)# tunnel-group name [general-attributes | ipsec-attributes]  Enters tunnel-group general-attributes submode to configure the address pool ciscoasa(config-tunnel-general)# address-pool [interface name] address_pool1 [...address_pool6]  Associates an address pool with the connection policy asa1(config)# tunnel-group TRAINING general-attributes asa1(config-tunnel-general)# address-pool MYPOOL © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-26
Step 4: Configure the Group Policy Type Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config)# group-policy {name internal [from group-policy name]} asa1(config)# group-policy TRAINING internal © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-27
Step 5: Enter the Group-Policy Attributes Subcommand Mode Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 Push VPN Group to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config)# group-policy {name} attributes asa1(config)# group-policy TRAINING attributes asa1(config-group-policy)# © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-28
Step 6: Specify DNS Servers Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# dns-server {value ip_address [ip_address] | none} asa1(config-group-policy)# dns-server value 10.0.0.15 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-29
Step 7: Specify WINS Servers Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# wins-server value {ip_address} [ip_address] | none asa1(config-group-policy)# wins-server value 10.0.0.15 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-30
Step 8: Specify DNS Domain Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# default-domain {value domain-name | none} asa1(config-group-policy)# default-domain value cisco.com © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-31
Step 9: Specify Idle Timeout Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# vpn-idle-timeout {minutes | none} asa1(config-group-policy)# vpn-idle-timeout 600 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-32
Task 4: Create Transform Set Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 Transform Set DES SHA-HMAC ciscoasa(config)# crypto ipsec transform-set transform-set-name transform1 [transform2]] asa1(config)# crypto ipsec transform-set REMOTEUSER1 esp-des esp-sha-hmac © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-33
Task 5: Create Dynamic Crypto Map Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# crypto dynamic-map dynamic-map-name dynamic-seq-num set transform-set transform-set-name1 [… transform-set- name9] asa1(config)# crypto dynamic-map RMT-DYNA-MAP 10 set transform-set REMOTEUSER1 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-34
Task 6: Assign Dynamic Crypto Map to Static Crypto Map Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# crypto map map-name seq-num ipsec-isakmp dynamic dynamic- map-name asa1(config)# crypto map RMT-USER-MAP 10 ipsec-isakmp dynamic RMT-DYNA-MAP © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-35
Task 7: Apply Dynamic Crypto Map to Security Appliance Outside Interface Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# crypto map map-name interface interface-name asa1(config)# crypto map RMT-USER-MAP interface outside © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-36
Task 8: Configure XAUTH Task 8 contains the following steps: Step 1: Enable AAA login authentication. Step 2: Define AAA server IP address and encryption key. Step 3: Enable IKE XAUTH for the tunnel group. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-37
Step 1: Enable AAA Login Authentication Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# aaa-server server-tag protocol server-protocol asa1(config)# aaa-server MYTACACS protocol tacacs+ asa1(config-aaa-server-group)# © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-38
Step 2: Define AAA Server IP Address and Encryption Key Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# aaa-server server-tag [(interface-name)] host server-ip [key] [timeout seconds] asa1(config)# aaa-server MYTACACS (inside) host 10.0.0.15 cisco123 timeout 5 asa1(config-aaa-server-host)# © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-39
Step 3: Enable IKE Xauth for Tunnel Group Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 XAUTH ciscoasa(config-tunnel-general)# authentication-server-group [(interface name)] server group [LOCAL | NONE] asa1(config)# tunnel-group TRAINING general-attributes asa1(config-tunnel-general)# authentication-server-group MYTACACS © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-40
Task 9: Configure NAT and NAT 0 Remote Client Outside Inside 172.26.26.1 10.0.0.0 Server Internet 10.0.0.15 192.168.1.5 Encrypted — No Translation Clear Text — Translation asa1(config)# access-list 101 permit ip 10.0.0.0 255.255.255.0 10.0.11.0 255.255.255.0 asa1(config)# nat (inside) 0 access-list 101 asa1(config)# nat (inside) 1 0.0.0.0 0.0.0.0 0 0 asa1(config)# global (outside) 1 interface  Matches ACL: Encrypted data and no translation (NAT 0)  Does not match ACL: Clear text and translation (PAT) © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-41
Task 10: Enable IKE DPD Remote Client Outside Inside 172.26.26.1 10.0.0.0 Server Internet 10.0.0.15 192.168.1.5 1) DPD Send: Are you there? 2) DPD Reply: Yes, I am here. ciscoasa(config-tunnel-ipsec)# isakmp keepalive [threshold seconds] [retry seconds] [disable]  Configures the IKE DPD parameters asa1(config)# tunnel-group TRAINING ipsec-attributes asa1(config-tunnel-ipsec)# isakmp keepalive threshold 30 retry 10 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-42
Summary  Cisco Easy VPN features greatly enhance deployment of remote access solutions for Cisco IOS software customers.  The Cisco Easy VPN Server adds several new commands to Cisco PIX Security Appliance Software Version 6.3 and later versions.  The Cisco VPN Client enables software-based VPN remote access. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-43
Lab Visual Objective Student PC VPN Client Web FTP RBB Security Appliance 172.26.26.0 192.168.P.0 10.0.P.0 .150 .1 .2 .1 .10 172.26.26.P © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-44
© 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-45

More Related Content

PPTX
Основные понятия и аспекты построения отказоустойчивых Site-to-Site VPN на ASA
Cisco Russia
 
PPT
Vpn site to site
IT Tech
 
PPT
Vpn(4)
Suraj Kumar
 
PPT
CCNA Security 010-configuring cisco asa
Ahmed Habib
 
PDF
[Cisco Connect 2018 - Vietnam] Anh duc le reap the benefits of sdn with cisco...
Nur Shiqim Chok
 
DOCX
Cisco asa 5500 x series migration options-asa 5555-x, asa 5525-x & asa 55...
IT Tech
 
PPT
Understanding and Troubleshooting ASA NAT
Cisco Russia
 
PPTX
SITE TO SITE IPSEC VPN TUNNEL B/W CISCO ROUTERS
NetProtocol Xpert
 
Основные понятия и аспекты построения отказоустойчивых Site-to-Site VPN на ASA
Cisco Russia
 
Vpn site to site
IT Tech
 
Vpn(4)
Suraj Kumar
 
CCNA Security 010-configuring cisco asa
Ahmed Habib
 
[Cisco Connect 2018 - Vietnam] Anh duc le reap the benefits of sdn with cisco...
Nur Shiqim Chok
 
Cisco asa 5500 x series migration options-asa 5555-x, asa 5525-x & asa 55...
IT Tech
 
Understanding and Troubleshooting ASA NAT
Cisco Russia
 
SITE TO SITE IPSEC VPN TUNNEL B/W CISCO ROUTERS
NetProtocol Xpert
 

What's hot (20)

PDF
20141102 VyOS 1.1.0 and NIFTY Cloud New Features
雄也 日下部
 
PDF
Using packet-tracer, capture and other Cisco ASA tools for network troublesho...
Cisco Russia
 
PPT
CCNA Security 012- cryptographic systems
Ahmed Habib
 
PDF
Fortinet Ansible Solution Part 2
Salim Haniff
 
PDF
DEFCON 23 - Etienne Martineau - inter vm data exfiltration
Felipe Prado
 
PPTX
ASA Multiple Context Training
Tariq Bader
 
PDF
[2015-11월 정기 세미나]K8s on openstack
OpenStack Korea Community
 
PPT
CCNA Security 011- implementing ios-based ips
Ahmed Habib
 
PPTX
Cisco asa cx firwewall
Anwesh Dixit
 
PPTX
Ccna sv2 instructor_ppt_ch8
Babaa Naya
 
PDF
Cisco 900 Series Integrated Services Routers Datasheet
美兰 曾
 
PDF
Brksec 2101 deploying web security
Alfredo Boiero Sanders
 
PDF
02 - IDNOG04 - Sheryl Hermoso (APNIC) - IPv6 Deployment at APNIC
Indonesia Network Operators Group
 
PPTX
Introduction to nexux from zero to Hero
Dhruv Sharma
 
PDF
CCNAv5 - S2: Chapter10 DHCP
Vuz Dở Hơi
 
PDF
CCNAv5 - S2: Chapter2 Basic Switching Concepts and Configuration
Vuz Dở Hơi
 
PPSX
vSRX
MarketingArrowECS_CZ
 
PDF
Troubleshooting Firewalls (2012 San Diego)
Cisco Security
 
PDF
Дизайн отказоустойчивых локальных сетей
Cisco Russia
 
PDF
CCNAv5 - S3: Chapter8 EIGRP Advanced Configurations and Troubleshooting
Vuz Dở Hơi
 
20141102 VyOS 1.1.0 and NIFTY Cloud New Features
雄也 日下部
 
Using packet-tracer, capture and other Cisco ASA tools for network troublesho...
Cisco Russia
 
CCNA Security 012- cryptographic systems
Ahmed Habib
 
Fortinet Ansible Solution Part 2
Salim Haniff
 
DEFCON 23 - Etienne Martineau - inter vm data exfiltration
Felipe Prado
 
ASA Multiple Context Training
Tariq Bader
 
[2015-11월 정기 세미나]K8s on openstack
OpenStack Korea Community
 
CCNA Security 011- implementing ios-based ips
Ahmed Habib
 
Cisco asa cx firwewall
Anwesh Dixit
 
Ccna sv2 instructor_ppt_ch8
Babaa Naya
 
Cisco 900 Series Integrated Services Routers Datasheet
美兰 曾
 
Brksec 2101 deploying web security
Alfredo Boiero Sanders
 
02 - IDNOG04 - Sheryl Hermoso (APNIC) - IPv6 Deployment at APNIC
Indonesia Network Operators Group
 
Introduction to nexux from zero to Hero
Dhruv Sharma
 
CCNAv5 - S2: Chapter10 DHCP
Vuz Dở Hơi
 
CCNAv5 - S2: Chapter2 Basic Switching Concepts and Configuration
Vuz Dở Hơi
 
vSRX
MarketingArrowECS_CZ
 
Troubleshooting Firewalls (2012 San Diego)
Cisco Security
 
Дизайн отказоустойчивых локальных сетей
Cisco Russia
 
CCNAv5 - S3: Chapter8 EIGRP Advanced Configurations and Troubleshooting
Vuz Dở Hơi
 
Ad

Viewers also liked (20)

PPSX
Ike
shashi712
 
PPTX
Internet Key Exchange Protocol
Prateek Singh Bapna
 
PDF
Internet Key Exchange (ikev2) Protocol
Netwax Lab
 
PDF
Protocole IKE/IPsec
Thomas Moegli
 
PDF
Russian Transportation Systems
Valerie Ivanova
 
PPTX
3 Ways to use Social to Rally Volunteers and Build an Engaged Community
Derek Laney
 
PDF
Happiness Advocacy, or How Positive Psychology Will Save Us From Zombies
Annie Passanisi
 
PPTX
Are You Smarter Than A GEAR UP Student?
National Council for Community and Education Partnerships (NCCEP)
 
PPTX
Photos Urban Investment Network Summit Amsterdam
lizwaller1
 
PPT
Seven Freedom Memorials of Washington D.C.
Kazim Alam
 
PPT
Front entrance display 2.23.11
mrsreno1
 
XLS
Huyagaa sudalgaa
Sumiya_bu
 
PDF
ULI United Kingdom and EIB Conference, Birmingham, April 17th, 2013
lizwaller1
 
PPTX
Helping Make Revenue Rockstars
Derek Laney
 
PPTX
City Site Visits and Leadership Dinner 23/11/2011
lizwaller1
 
PPT
Structure of dna
kelliot23
 
PDF
ULI Europe Young Leaders Masterclass 2012
lizwaller1
 
PPTX
Building a Multi-Country Social Media Program (AdTech Singapore)
Derek Laney
 
PPT
The Freedom Memorials of Washington D.C.
Kazim Alam
 
PPT
Glosario
yohanarojasluna
 
Ike
shashi712
 
Internet Key Exchange Protocol
Prateek Singh Bapna
 
Internet Key Exchange (ikev2) Protocol
Netwax Lab
 
Protocole IKE/IPsec
Thomas Moegli
 
Russian Transportation Systems
Valerie Ivanova
 
3 Ways to use Social to Rally Volunteers and Build an Engaged Community
Derek Laney
 
Happiness Advocacy, or How Positive Psychology Will Save Us From Zombies
Annie Passanisi
 
Are You Smarter Than A GEAR UP Student?
National Council for Community and Education Partnerships (NCCEP)
 
Photos Urban Investment Network Summit Amsterdam
lizwaller1
 
Seven Freedom Memorials of Washington D.C.
Kazim Alam
 
Front entrance display 2.23.11
mrsreno1
 
Huyagaa sudalgaa
Sumiya_bu
 
ULI United Kingdom and EIB Conference, Birmingham, April 17th, 2013
lizwaller1
 
Helping Make Revenue Rockstars
Derek Laney
 
City Site Visits and Leadership Dinner 23/11/2011
lizwaller1
 
Structure of dna
kelliot23
 
ULI Europe Young Leaders Masterclass 2012
lizwaller1
 
Building a Multi-Country Social Media Program (AdTech Singapore)
Derek Laney
 
The Freedom Memorials of Washington D.C.
Kazim Alam
 
Glosario
yohanarojasluna
 
Ad

Similar to Easy vpn (20)

PDF
Brkcrt 1160 c3-rev2
Solomon Abavire Kobina,
 
DOCX
Cisco isr 900 series highlights, platform specs, licenses, transition guide
IT Tech
 
PDF
ISR1100_and_ISR1100X_Series_Workshop_Session_III.pdf
SebastianMolinaFerna
 
DOCX
Cisco asa5540, best guard for enterprise
IT Tech
 
DOCX
Cisco rv110 w wireless n vpn firewall
IT Tech
 
PDF
BRKSEC-2021 Firewall Architectures in the Data Centre and Internet Edge.pdf
AntonioIsipJr1
 
PDF
Cisco asr 1000 series embedded services processors data sheet.
Amanda Meng
 
PDF
Cisco SDN/NVF Innovations (SDN NVF Day ITB 2016)
SDNRG ITB
 
PDF
Cisco Firewall secure firewall configuration
vadiraja6
 
PDF
cisco-nim-es2-8-datasheet.pdf
Hi-Network.com
 
DOCX
Cisco asa firewall
IT Tech
 
PDF
Presentation cisco plus tech datacenter virtualisering
xKinAnx
 
PPT
CCNA Icnd110 s03l02
computerlenguyen
 
PDF
CCNAv5 - S4: Chapter 7: Securing Site-to-site Connectivity
Vuz Dở Hơi
 
PPT
Icnd210 s02l04
computerlenguyen
 
PPT
icon Cisco 2006.ppt
Hector Cortes
 
PDF
Presentation cisco prime for ip ngn technical education series introduction...
xKinAnx
 
PDF
PLNOG 8: Gaweł Mikołajczyk - Securing the Cloud Infrastructure - from Hyperv...
PROIDEA
 
PPTX
4. VPN4. VPN4. VPN4. VPN4. VPN4. VPN.pptx
FutureTechnologies3
 
PDF
6500overview
ferturcios
 
Brkcrt 1160 c3-rev2
Solomon Abavire Kobina,
 
Cisco isr 900 series highlights, platform specs, licenses, transition guide
IT Tech
 
ISR1100_and_ISR1100X_Series_Workshop_Session_III.pdf
SebastianMolinaFerna
 
Cisco asa5540, best guard for enterprise
IT Tech
 
Cisco rv110 w wireless n vpn firewall
IT Tech
 
BRKSEC-2021 Firewall Architectures in the Data Centre and Internet Edge.pdf
AntonioIsipJr1
 
Cisco asr 1000 series embedded services processors data sheet.
Amanda Meng
 
Cisco SDN/NVF Innovations (SDN NVF Day ITB 2016)
SDNRG ITB
 
Cisco Firewall secure firewall configuration
vadiraja6
 
cisco-nim-es2-8-datasheet.pdf
Hi-Network.com
 
Cisco asa firewall
IT Tech
 
Presentation cisco plus tech datacenter virtualisering
xKinAnx
 
CCNA Icnd110 s03l02
computerlenguyen
 
CCNAv5 - S4: Chapter 7: Securing Site-to-site Connectivity
Vuz Dở Hơi
 
Icnd210 s02l04
computerlenguyen
 
icon Cisco 2006.ppt
Hector Cortes
 
Presentation cisco prime for ip ngn technical education series introduction...
xKinAnx
 
PLNOG 8: Gaweł Mikołajczyk - Securing the Cloud Infrastructure - from Hyperv...
PROIDEA
 
4. VPN4. VPN4. VPN4. VPN4. VPN4. VPN.pptx
FutureTechnologies3
 
6500overview
ferturcios
 

Easy vpn

  • 1. Configuring Security Appliance Remote Access Using Cisco Easy VPN Lesson 12 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-1
  • 2. Outline  Introduction to Easy VPN  How Easy VPN Connection Process  Overview of Cisco VPN Client  Configuring Cisco VPN Client as Easy VPN Remote  Working with the Cisco VPN Client  Configuring Users and Groups  Configuring the Easy VPN Server for Extended Authentication  Summary © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-2
  • 3. Introduction to Cisco Easy VPN © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-3
  • 4. Cisco Easy VPN Cisco Easy VPN Remote Cisco Easy VPN Servers Cisco VPN Client > 3.x Cisco 800 and 900 Series Router Cisco IOS Release > 12.2(8)T Router Cisco 1700 and 1800 Series Router Cisco 2800 and 3800 Series Router Cisco PIX Firewall Software Version > 6.2 Cisco PIX Firewall 501 and 506 Cisco ASA 5500 Series Cisco ASA 5505 Security Appliance © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-4
  • 5. Features of Cisco Easy VPN Server  Server support for Cisco Easy VPN Remote clients was introduced with the release of the Cisco PIX Firewall Software version 6.2 and Cisco IOS 12.2(8)T.  It allows remote end users to communicate using IPsec with supported adaptive security appliance VPN gateways.  Centrally managed IPsec policies are pushed to the clients by the server, minimizing configuration by the end users. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-5
  • 6. Supported Cisco Easy VPN Servers Cisco Easy VPN Servers Cisco VPN Client > 3.x Cisco 800 and 900 Series Router Cisco IOS Release > 12.2(8)T Router Cisco 1700 and 1800 Series Router Cisco 2800 and 3800 Series Router Cisco PIX Firewall Software Version > 6.2 Cisco PIX 501 and 506 Security Appliance Cisco ASA 5500 Series Cisco ASA 5505 Adaptive Security Appliance © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-6
  • 7. Supported Cisco Easy VPN Remote Clients Cisco Easy VPN Remote Cisco VPN Client > 3.x Cisco 800 and 900 Series Router Cisco IOS Release > 12.2(8)T Router Cisco 1700 and 1800 Series Router Cisco 2800 and 3800 Series Router Cisco PIX Firewall Software Version> 6.2 Cisco PIX 501 and 506 Security Appliance Cisco ASA 5500 Series Cisco ASA 5505 Adaptive Security Appliance © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-7
  • 8. Cisco Easy VPN Remote Modes of Operation Cisco Easy VPN Remote supports two modes of operation:  Client mode – Specifies that NAT or PAT be used. – Enables the client to automatically configure NAT or PAT translations and the ACLs that are needed to implement the VPN tunnel. – Supports split tunneling.  Network Extension mode – Specifies that the hosts at the client end of the VPN connection use fully routable IP addresses. – NAT or PAT is not used. – Supports split tunneling. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-8
  • 9. Cisco Easy VPN Remote Client Mode PAT 10.0.0.0/24 192.168.1.2 192.168.1.1 10.0.1.2 VPN Tunnel 192.168.1.3 ASA 5505 ASA 5520 Adaptive Adaptive Security Security Appliance Appliance (Cisco Easy (Cisco Easy VPN VPN Remote) Server) © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-9
  • 10. Cisco Easy VPN Remote Network Extension Mode 172.16.30.0/24 172.16.10.5 172.16.10.1 10.0.1.2 VPN Tunnel 172.16.10.6 Cisco 1811 Router (Cisco Easy VPN Remote) ASA 5520 10.0.2.2 (Cisco Easy VPN Server) ASA 5505 172.16.20.5 (Cisco Easy VPN 172.16.20.1 Remote) 172.16.20.6 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-10
  • 11. How Cisco Easy VPN Connection Process © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-11
  • 12. Cisco Easy VPN Remote Connection Process Step 1: The Cisco VPN Client initiates the IKE Phase 1 process. Step 2: The Cisco VPN Client negotiates an IKE SA. Step 3: The Cisco Easy VPN Server accepts the SA proposal. Step 4: The Cisco Easy VPN Server initiates a username/password challenge. Step 5: The mode configuration process is initiated. Step 6: IKE quick mode completes the connection. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-12
  • 13. Step 1: Cisco VPN Client Initiates IKE Phase 1 Process Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server  Using PSKs? Initiate aggressive mode.  Using digital certificates? Initiate main mode. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-13
  • 14. Step 2: Cisco VPN Client Negotiates an IKE SA Remote PC with Cisco Easy VPN Remote Client Security Appliance Cisco Easy VPN Server Proposal 1, Proposal 2, Proposal 3  The Cisco VPN Client attempts to establish an SA between peer IP addresses by sending multiple IKE proposals to the Cisco Easy VPN Server.  To reduce manual configuration on the Cisco VPN Client, these IKE proposals include several combinations of the following: – Encryption and hash algorithms – Authentication methods – DH group sizes © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-14
  • 15. Step 3: Cisco Easy VPN Server Accepts SA Proposal Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server Proposal 1 Proposal checking finds proposal 1 match.  The Cisco Easy VPN Server searches for a match: – The first proposal to match the server list is accepted (highest priority match). – The most secure proposals are always listed at the top of the Cisco Easy VPN Server proposal list (highest priority).  IKE SA is successfully established.  Device authentication ends and user authentication begins. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-15
  • 16. Step 4: Cisco Easy VPN Server Initiates a Username/Password Challenge Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server Username/Password Challenge AAA Username/Password checking  If the Cisco Easy VPN Server is configured for XAUTH, the VPN Client waits for a username/password challenge: – The user enters a username/password combination. – The username/password information is checked against authentication entities.  All Cisco Easy VPN Servers should be configured to enforce user authentication. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-16
  • 17. Step 5: Mode Configuration Process Is Initiated Remote PC with Cisco Easy VPN Security Appliance Remote Client Cisco Easy VPN Server Client Requests Parameters System Parameters via Mode Configuration  If the Cisco Easy VPN Server indicates successful authentication, the Cisco VPN Client requests the remaining configuration parameters from the Cisco Easy VPN Server: – Mode configuration starts. – The remaining system parameters (IP address, DNS, split tunneling information, and so on) are downloaded to the Cisco VPN Client.  Remember that the IP address is the only required parameter in a group profile; all other parameters are optional. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-17
  • 18. Step 6: IKE Quick Mode Completes Connection Remote PC with Cisco Easy VPN Remote Client Quick Mode Security Appliance IPsec SA Cisco Easy VPN Establishment Server VPN Tunnel  After the configuration parameters have been successfully received by the Cisco VPN Client, IKE quick mode is initiated to negotiate IPsec SA establishment.  After IPsec SA establishment, the VPN connection is complete. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-18
  • 19. Configuring the Easy VPN Server for Extended Authentication © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-19
  • 20. Cisco Easy VPN Server General Configuration Tasks The following general tasks are used to configure an Cisco Easy VPN Server on a security appliance: Task 1: Create ISAKMP policy for remote Cisco VPN Client access. Task 2: Create IP address pool. Task 3: Define group policy for mode configuration push. Task 4: Create transform set. Task 5: Create dynamic crypto map. Task 6: Assign dynamic crypto map to static crypto map. Task 7: Apply crypto map to security appliance interface. Task 8: Configure Xauth. Task 9: Configure NAT and NAT 0. Task 10: Enable IKE DPD. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-20
  • 21. Task 1: Create ISAKMP Policy for Remote VPN Client Access Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ISAKMP Pre-Share DES SHA Group 2 asa1(config)# isakmp enable outside asa1(config)# isakmp policy 20 asa1(config-isakmp-policy)# authentication pre-share asa1(config-isakmp-policy)# encryption des asa1(config-isakmp-policy)# hash sha asa1(config-isakmp-policy)# group 2 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-21
  • 22. Task 2: Create IP Address Pool Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 MYPOOL 10.0.11.1-10.0.11.254 ciscoasa(config)# ip local pool poolname first-address—last-address [mask mask]  Creates an optional local address pool if the remote client is using the remote server as an external DHCP server asa1(config)# ip local pool MYPOOL 10.0.11.1-10.0.11.254 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-22
  • 23. Task 3: Define Group Policy for Mode Configuration Push Task 3 contains the following steps: Step 1: Set the tunnel group type. Step 2: Configure the IKE PSK. Step 3: Specify the local IP address pool. Step 4: Configure the group policy type. Step 5: Enter the group-policy attributes submode. Step 6: Specify the DNS servers. Step 7: Specify the WINS servers. Step 8: Specify the DNS domain. Step 9: Specify idle timeout. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-23
  • 24. Step 1: Set the Tunnel Group Type Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config)# tunnel-group name type type  Names the tunnel group  Defines the type of VPN connection that is to be established asa1(config)# tunnel-group TRAINING type ipsec-ra © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-24
  • 25. Step 2: Configure IKE Pre-Shared Key Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 Push to Client ciscoasa(config)# tunnel-group name [general-attributes | ipsec-attributes]  Enters tunnel-group ipsec-attributes submode to configure the key ciscoasa(config-tunnel-ipsec)# pre-shared-key key  Associates a PSK with the connection policy asa1(config)# tunnel-group TRAINING ipsec-attributes asa1(config-tunnel-ipsec)# pre-shared-key cisco123 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-25
  • 26. Step 3: Specify Local IP Address Pool Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 Push to Client ciscoasa(config)# tunnel-group name [general-attributes | ipsec-attributes]  Enters tunnel-group general-attributes submode to configure the address pool ciscoasa(config-tunnel-general)# address-pool [interface name] address_pool1 [...address_pool6]  Associates an address pool with the connection policy asa1(config)# tunnel-group TRAINING general-attributes asa1(config-tunnel-general)# address-pool MYPOOL © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-26
  • 27. Step 4: Configure the Group Policy Type Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config)# group-policy {name internal [from group-policy name]} asa1(config)# group-policy TRAINING internal © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-27
  • 28. Step 5: Enter the Group-Policy Attributes Subcommand Mode Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 Push VPN Group to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config)# group-policy {name} attributes asa1(config)# group-policy TRAINING attributes asa1(config-group-policy)# © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-28
  • 29. Step 6: Specify DNS Servers Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# dns-server {value ip_address [ip_address] | none} asa1(config-group-policy)# dns-server value 10.0.0.15 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-29
  • 30. Step 7: Specify WINS Servers Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# wins-server value {ip_address} [ip_address] | none asa1(config-group-policy)# wins-server value 10.0.0.15 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-30
  • 31. Step 8: Specify DNS Domain Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# default-domain {value domain-name | none} asa1(config-group-policy)# default-domain value cisco.com © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-31
  • 32. Step 9: Specify Idle Timeout Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 VPN Group Push to Client Pre-Share DNS Server WINS Server DNS Domain Address Pool Idle Time ciscoasa(config-group-policy)# vpn-idle-timeout {minutes | none} asa1(config-group-policy)# vpn-idle-timeout 600 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-32
  • 33. Task 4: Create Transform Set Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 Transform Set DES SHA-HMAC ciscoasa(config)# crypto ipsec transform-set transform-set-name transform1 [transform2]] asa1(config)# crypto ipsec transform-set REMOTEUSER1 esp-des esp-sha-hmac © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-33
  • 34. Task 5: Create Dynamic Crypto Map Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# crypto dynamic-map dynamic-map-name dynamic-seq-num set transform-set transform-set-name1 [… transform-set- name9] asa1(config)# crypto dynamic-map RMT-DYNA-MAP 10 set transform-set REMOTEUSER1 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-34
  • 35. Task 6: Assign Dynamic Crypto Map to Static Crypto Map Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# crypto map map-name seq-num ipsec-isakmp dynamic dynamic- map-name asa1(config)# crypto map RMT-USER-MAP 10 ipsec-isakmp dynamic RMT-DYNA-MAP © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-35
  • 36. Task 7: Apply Dynamic Crypto Map to Security Appliance Outside Interface Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# crypto map map-name interface interface-name asa1(config)# crypto map RMT-USER-MAP interface outside © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-36
  • 37. Task 8: Configure XAUTH Task 8 contains the following steps: Step 1: Enable AAA login authentication. Step 2: Define AAA server IP address and encryption key. Step 3: Enable IKE XAUTH for the tunnel group. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-37
  • 38. Step 1: Enable AAA Login Authentication Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# aaa-server server-tag protocol server-protocol asa1(config)# aaa-server MYTACACS protocol tacacs+ asa1(config-aaa-server-group)# © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-38
  • 39. Step 2: Define AAA Server IP Address and Encryption Key Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 ciscoasa(config)# aaa-server server-tag [(interface-name)] host server-ip [key] [timeout seconds] asa1(config)# aaa-server MYTACACS (inside) host 10.0.0.15 cisco123 timeout 5 asa1(config-aaa-server-host)# © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-39
  • 40. Step 3: Enable IKE Xauth for Tunnel Group Remote Client Outside Inside 172.26.26.1 Server Internet 10.0.0.15 192.168.1.5 XAUTH ciscoasa(config-tunnel-general)# authentication-server-group [(interface name)] server group [LOCAL | NONE] asa1(config)# tunnel-group TRAINING general-attributes asa1(config-tunnel-general)# authentication-server-group MYTACACS © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-40
  • 41. Task 9: Configure NAT and NAT 0 Remote Client Outside Inside 172.26.26.1 10.0.0.0 Server Internet 10.0.0.15 192.168.1.5 Encrypted — No Translation Clear Text — Translation asa1(config)# access-list 101 permit ip 10.0.0.0 255.255.255.0 10.0.11.0 255.255.255.0 asa1(config)# nat (inside) 0 access-list 101 asa1(config)# nat (inside) 1 0.0.0.0 0.0.0.0 0 0 asa1(config)# global (outside) 1 interface  Matches ACL: Encrypted data and no translation (NAT 0)  Does not match ACL: Clear text and translation (PAT) © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-41
  • 42. Task 10: Enable IKE DPD Remote Client Outside Inside 172.26.26.1 10.0.0.0 Server Internet 10.0.0.15 192.168.1.5 1) DPD Send: Are you there? 2) DPD Reply: Yes, I am here. ciscoasa(config-tunnel-ipsec)# isakmp keepalive [threshold seconds] [retry seconds] [disable]  Configures the IKE DPD parameters asa1(config)# tunnel-group TRAINING ipsec-attributes asa1(config-tunnel-ipsec)# isakmp keepalive threshold 30 retry 10 © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-42
  • 43. Summary  Cisco Easy VPN features greatly enhance deployment of remote access solutions for Cisco IOS software customers.  The Cisco Easy VPN Server adds several new commands to Cisco PIX Security Appliance Software Version 6.3 and later versions.  The Cisco VPN Client enables software-based VPN remote access. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-43
  • 44. Lab Visual Objective Student PC VPN Client Web FTP RBB Security Appliance 172.26.26.0 192.168.P.0 10.0.P.0 .150 .1 .2 .1 .10 172.26.26.P © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-44
  • 45. © 2007 Cisco Systems, Inc. All rights reserved. SNPA v5.0—12-45