ASA Easy VPN (EZVPN) Configuration
The configuration of the Easy VPN server side is very similar to a "typical" remote access server configuration using group policy. Table 1 reviews the steps that are required to perform this configuration.
Table 1: ASA IKEv1 Easy VPN Server Configuration<
|
1 |
Create and enter IKEv1 policy configuration mode. Note: The lower the policy-priority, the higher the priority with a valid range from 1-65535. |
asa(config)#crypto ikev1 policy policy-priority |
|
2 |
Configure an authentication method (default: pre-share). |
asa(config-ikev1-policy)#authentication {pre-share | rsa-sig} |
|
3 |
Configure an encryption method (default: 3des). |
asa(config-ikev1-policy)#encryption {des | 3des | aes | aes-192 | aes-256} |
|
4 |
Configure a hash method (default: sha). |
asa(config-ikev1-policy)#hash {md5 | sha} |
|
5 |
Configure a Diffie-Hellman (DH) group (default: 2). |
asa(config-ikev1-policy)#group {1 | 2 | 5} |
|
6 |
Configure the IKE SA lifetime (Default: 86400 seconds (24 hours)). |
asa(config-ikev1-polocy)#lifetime lifetime |
|
7 |
Enable IKEv1 on an interface Note: This is the interface that goes out to the IPsec destination. |
asa(config)#crypto ikev1 enable interface-name |
|
8 |
Create a IKEv1 Transform set. Notes: encryption-method can be esp-des, esp-3des, esp-aes, esp-aes-192, esp-aes-256, or esp-null authentication-method can be esp-md5-hmac, esp-sha-hmac or esp-none. |
asa(config)#crypto ipsec ikev1 transform-set set-name encryption-method authentication-method |
|
9 |
Create a dynamic map that links together the previously created transform set and the crypto map (which will be configured next). |
asa(config)#crypto dynamic-map dynamic-map-name sequence-number set ikev1 transform-set set-name |
|
10 |
Create a Crypto map and match based on the previously created dynamic map. |
asa(config)#crypto map map-name sequence-number ipsec-isakmp dynamic dynamic-map-name |
|
11 |
Apply the crypto map to an interface. |
asa(config)#crypto map map-name interface interface |
|
12 |
Create an internal group policy. |
asa(config)#group-policy policy-name internal |
|
13 |
Enter group policy attribute configuration mode. |
asa(config)#group-policy policy-name attributes |
|
14 |
Enable the use of the Easy VPN Network Emulation mode. |
asa(config-group-policy)#nem enable |
|
15 |
(optional) Create an access-list to specify the traffic that will be to be encrypted within the IPsec tunnel to the central network. Note: This is a very simplified version of an ACL; for further details on ACLs. see the "ASA Access Lists Concepts and Configuration" article. |
asa(config)#access-list acl-name extended {permit | deny} protocol source-network source-netmask destination-network destination-netmask |
|
16 |
(optional) Enable the use of split tunnel. Note: the mode shown will tunnel only specified traffic. |
asa(config-group-policy)#split-tunnel-policy tunnelspecified |
|
17 |
(optional) Specify the name of an access list that specifies the traffic to be tunneled. |
asa(config-group-policy)#split-tunnel-network-list access-list-name |
|
18 |
Define a username and password that will be used by the remote client to log in. |
asa(config)#username username password password |
|
19 |
Specify the tunnel group type. |
asa(config)#tunnel-group tunnel-group-name type remote-access |
|
20 |
Enter IPsec tunnel general attribute configuration mode. |
asa(config)#tunnel-group tunnel-group-name general-attributes |
|
21 |
Specify the default group policy to be used. |
asa(config-tunnel-general)#default-group-policy policy-name |
|
22 |
Enter IPsec tunnel IPsec attribute configuration mode. |
asa(config)#tunnel-group tunnel-group-name ipsec-attributes |
|
23 |
Configure the IPsec tunnel pre-shared key or certificate trustpoint. |
asa(config-tunnel-ipsec)#ikev1 pre-shared-key pre-shared-key |
The client configuration, as opposed to the server configuration, is very simple and is shown in Table 2:
Table 2: ASA IKEv1 Easy VPN Client Configuration
|
1 |
Configure the IP addresses to the Easy VPN server (or servers). |
asa(config)#vpnclient server server-ip-address [server-ip-address2...server-ip-address10] |
|
2 |
Configure the Easy VPN mode. |
asa(config)#vpnclient mode {client-mode | network-extension-mode} |
|
3 |
Configure the IPsec VPN group credentials. Note: The tunnel-group-name and pre-shared-key come from the configuration of the Easy VPN server. |
asa(config)#vpnclient vpngroup tunnel-group-name password pre-shared-key |
|
4 |
Configure the login credentials. Note: These were configured with the username statement in the VPN server configuration. |
asa(config)#vpnclient username username password password |
|
5 |
(optional) When using split tunneling, configure to enable automatic IPsec tunnel initiation. |
asa(config)#vpnclient nem-st-autoconnect |
|
6 |
Enable the Easy VPN client. |
asa(config)#vpnclient enable |
Summary
The configuration of a VPN can be daunting, and getting it to work as expected can be very challenging. Cisco's Easy VPN feature allows at least the client configuration to be as easy as possible and enables the relatively small ASA 5505 to become a well-secured, easily configured hardware client.
There are a number of possible ways that a VPN can be configured on modern networks, and this is certainly a good option in certain situations and should be considered as one of the possibilities.