Cisco Remote-Access IPSec VPN Setup

Step 1.

Launch the VPN Wizard.

To launch the VPN Wizard, click Wizards > VPN Wizard, as shown earlier in Figure 21-3.

ASDM launches the VPN Wizard, which provides an option to select the VPN tunnel type. Click the Remote Access radio button, as shown in Figure 21-22.

Figure 21-22. Selecting Remote-Access Tunnel

In this example, because VPN clients connect to Cisco ASA on the outside interface, the Outside interface is chosen from the drop-down menu in the VPN Tunnel Interface field. Click Next to move forward to the Remote Access Client window.

Step 2.

Select the type of remote-access VPN tunnel.

The current version of Cisco ASA supports only Cisco IPSec remote-access VPNs, which is the default remote-access VPN tunnel type, as shown in Figure 21-23. Click Next to move to the VPN Client Tunnel Group Name and Authentication Method window.

Figure 21-23. Selecting the Type of Remote-Access VPN

Step 3.

Set up the tunnel group name.

Specify the tunnel group name and the password if preshared keys are used. If PKI is being used, select the server certificate from the drop-down menu. In Figure 21-24, the administrator is setting up Cisco ASA with a tunnel group name of SecureMeTnlGrp with the associated preshared key of cisco123. Click Next to move to the Client Authentication window.

Figure 21-24. Specifying a Tunnel Group Name

Step 4.

Set the user authentication method.

As mentioned in Chapter 7, "Authentication, Authorization, and Accounting (AAA)," Cisco ASA supports local and external databases for user authentication. If an external database server is used for authentication, you must predefine it. If it is not defined earlier, you can leave the wizard and set it up under Configuration > Features > Properties > AAA Setup > AAA Servers. In Figure 21-25, the administrator is setting up Cisco ASA to use the local database for user authentication. Click Next to move to the User Accounts window.

Figure 21-25. Selecting the Local User Database

Step 5.

Create the user database.

In Step 4, the administrator is using the local user database for user authentication. ASDM allows you to create additional user accounts, if necessary. In Figure 21-26, the administrator is setting up an account for ciscouser2 with a password of 123cisco (shown in asterisks). Click Add to instruct ASDM to create a user account. Click Next to move to the Address Pool window.

Figure 21-26. Creating User Accounts

Step 6.

Assign IP addresses.

An important step in setting up the remote-access VPN connection is to assign an IP address to the client during the tunnel negotiation. ASDM prompts you to create an address pool and specify a range of IP addresses. In Figure 21-27, the administrator has set up an IP pool called ippool, which starts at 192.168.50.1 and ends at 192.168.50.127. The subnet mask for the range of addresses is 255.255.255.128. Click Next to move to the Attributes Pushed to Client (Optional) window.

Figure 21-27. Assigning IP Addresses

Step 7.

Set up mode configuration attributes.

The VPN Wizard allows you to configure three basic mode configuration attributes, which include the DNS and WINS servers, IP addresses, and the domain name of an organization, as shown in Figure 21-28. In this example, 192.168.10.10 and 192.168.10.20 are being used as the DNS addresses, and 192.168.10.20 and 192.168.10.10 are being used as the WINS addresses. The domain name is securemeinc.com. Click Next to move to IKE Policy window.

Figure 21-28. Assigning Mode Configuration Attributes

Step 8.

Select the IKE policy.

Cisco ASA allows you to choose the IKE parameters such as the encryption and authentication types and the Diffie-Hellman (DH) group. In Figure 21-29, the administrator has selected 3DES for encryption, SHA for authentication, and DH group 2 for key generation. Click Next to move to the IPSec Encryption and Authentication window.

Figure 21-29. IKE Policy

Note

Cisco VPN Client supports DH groups 2 and 5, by default. You have to select one of these groups to match the client settings.

Step 9.

Set up the IPSec transform set.

Set up the IPSec transform set by selecting the IPSec encryption and authentication methods. In Figure 21-30, the administrator has chosen 3DES for encryption and MD5 for hash authentication. Click Next to move to the Address Translation Exemption and Split Tunneling (Optional) window.

Figure 21-30. IPSec Transform Set

Step 10.

Bypass address translation.

If NAT control is enabled on the security Cisco ASA, you can choose to bypass address translation for the traffic sourced from the inside network of Cisco ASA and destined for the VPN client's assigned addresses. ASDM creates an access list to identify traffic traveling over the tunnel, and applies NAT exemption to bypass address translation. To identify local networks, add the local hosts/subnets/networks in the Selected Hosts/Networks pane, as shown in Figure 21-31. In this example, the administrator does not want 192.168.10.0/24 and 192.168.20.0/24 addresses to be translated if they are sending traffic to the VPN pool of addresses, 192.168.50.0/25.

Figure 21-31. Enabling Split Tunneling and NAT Exemption

By using split tunneling, you can enforce the remote VPN users to encrypt only the traffic destined for the inside networks of Cisco ASA. All other traffic can go to the Internet in clear text. Enable split tunneling by checking off the box shown at the bottom of Figure 21-31. Click Next to move to the last step of the VPN Wizard.

Step 11.

Verify remote-access configuration.

The last step in setting up a remote-access tunnel is to verify that all the parameters are accurate. If they look correct, click Finish to complete the wizard.