Note |
The Cisco VPN Client is end-of-life and end-of-support. You must
upgrade to the AnyConnect Secure Mobility Client.
|
Use the IKEv1 Remote Access Wizard to
configure secure remote access for VPN clients, such as mobile users, and to
identify the interface that connects to the remote IPsec peer.
-
VPN Tunnel Interface—Choose the interface to use for remote
access clients. If the ASA has multiple interfaces, stop now and configure the
interfaces on the ASA before running this wizard.
-
Enable inbound IPsec sessions to bypass interface access
lists—Enable IPsec authenticated inbound sessions to always be permitted
through the ASA (that is, without checking the interface access-list
statements). Be aware that the inbound sessions bypass only the interface ACLs.
Configured group-policy, user, and downloaded ACLs still apply.
Remote Access
Client
Remote access users of various types can open VPN tunnels to
this ASA. Choose the type of VPN client for this tunnel.
-
VPN Client Type
-
Easy VPN Remote product.
-
Microsoft Windows client using L2TP over IPsec—Specify the PPP
authentication protocol. The choices are PAP, CHAP, MS-CHAP-V1, MS-CHAP-V2, and
EAP-PROXY:
PAP—Passes the cleartext username and password during
authentication and is not secure.
CHAP—In response to the server challenge, the client returns the
encrypted challenge plus password with a cleartext username. This protocol is
more secure than PAP, but it does not encrypt data.
MS-CHAP, Version 1—Similar to CHAP, but more secure in that the
server stores and compares only encrypted passwords rather than cleartext
passwords as in CHAP.
MS-CHAP, Version 2—Contains security enhancements over MS-CHAP,
Version 1.
EAP-Proxy—Enables EAP which permits the ASA to proxy the PPP
authentication process to an external RADIUS authentication server.
If a protocol is not specified on the remote client, do no
specify it.
-
Specify if the client will send the tunnel group name as
username@tunnelgroup.
VPN Client
Authentication Method and Tunnel Group Name
Use the VPN Client Authentication Method and Name pane to
configure an authentication method and create a connection policy (tunnel
group).
-
Authentication Method—The remote site peer authenticates either
with a preshared key or a certificate.
-
Pre-shared Key—Click to use a preshared key for authentication
between the local ASA and the remote IPsec peer.
Using a pre-shared key is a quick and easy way to set up
communication with a limited number of remote peers and a stable network. It
may cause scalability problems in a large network because each IPsec peer
requires configuration information for each peer with which it establishes
secure connections.
Each pair of IPsec peers must exchange preshared keys to
establish secure tunnels. Use a secure method to exchange the preshared key
with the administrator of the remote site.
-
Pre-shared Key—Type an alphanumeric string between 1 and 128
characters.
-
Certificate—Click to use certificates for authentication between
the local ASA and the remote IPsec peer. To complete this section, you must
have previously enrolled with a CA and downloaded one or more certificates to
the ASA.
You can efficiently manage the security keys used to establish
an IPsec tunnel with digital certificates. A digital certificate contains
information that identifies a user or device, such as a name, serial number,
company, department or IP address. A digital certificate also contains a copy
of the public key.
To use digital certificates, each peer enrolls with a
certification authority (CA), which is responsible for issuing digital
certificates. A CA can be a trusted vendor or a private CA that you establish
within an organization.
When two peers want to communicate, they exchange certificates
and digitally sign data to authenticate each other. When you add a new peer to
the network, it enrolls with a CA, and none of the other peers require
additional configuration.
Certificate Signing Algorithm—Displays the algorithm for signing
digital certificates, rsa-sig for RSA.
-
Tunnel Group Name—Type a name to create the record that
contains tunnel connection policies for this IPsec connection. A connection
policy can specify authentication, authorization, and accounting servers, a
default group policy, and IKE attributes. A connection policy that you
configure with this VPN wizard specifies an authentication method and uses the
ASA Default Group Policy.
Client
Authentication
Use the
Client Authentication pane to choose the method by which the ASA authenticates
remote users. Select one of the following options:
-
Authenticate using the local user database—Click to use
authentication internal to the ASA. Use this method for environments with a
small, stable number of users. The next pane lets you create accounts on the
ASA for individual users.
-
Authenticate using an AAA server group—Click to use an external
server group for remote user authentication.
User
Accounts
Use the User Accounts pane to add new
users to the ASA internal user database for authentication purposes.
Address
Pool
Use the Address Pool
pane to configure a pool of local IP addresses that the ASA assigns to remote
VPN clients.
-
Tunnel Group Name—Displays the name of the connection profile
(tunnel group) to which this address pool applies. You set this name in the VPN
Client and Authentication Method pane (step 3).
-
Pool Name—Select a descriptive identifier for the address pool.
-
New...—Click to configure a new address pool.
-
Range Start Address—Type the starting IP address in the address
pool.
-
Range End Address—Type the ending IP address in the address
pool.
-
Subnet Mask—(Optional) Choose the subnet mask for these IP
addresses.
Attributes
Pushed to Client (Optional)
Use the
Attributes Pushed to Client (Optional) pane to have the ASA pass information
about DNS and WINS servers and the default domain name to remote access
clients.
-
Tunnel Group—Displays the name of the connection policy to which
the address pool applies. You set this name in the VPN Client Name and
Authentication Method pane.
-
Primary DNS Server—Type the IP address of the primary DNS
server.
-
Secondary DNS Server—Type the IP address of the secondary DNS
server.
-
Primary WINS Server—Type the IP address of the primary WINS
server.
-
Secondary WINS Server— Type the IP address of the secondary WINS
server.
-
Default Domain Name—Type the default domain name.
IKE
Policy
IKE, also called Internet Security
Association and Key Management Protocol (ISAKMP), is the negotiation protocol
that lets two hosts agree on how to build an IPsec Security Association. Each
IKE negotiation is divided into two sections called Phase1 and Phase 2. Phase 1
creates the first tunnel, which protects later IKE negotiation messages. Phase
2 creates the tunnel that protects data.
Use the IKE Policy pane to set the terms of the Phase 1 IKE
negotiations which includes an encryption method to protect the data and ensure
privacy, an authentication method to ensure the identity of the peers, and a
Diffie-Hellman group to establish the strength of the of the
encryption-key-determination algorithm. The ASA uses this algorithm to derive
the encryption and hash keys.
-
Encryption—Select the symmetric encryption algorithm the ASA
uses to establish the Phase 1 SA that protects Phase 2 negotiations. The ASA
supports the following encryption algorithms:
|
Algorithm
|
Explanation
|
|
DES
|
Data Encryption Standard.
Uses a 56-bit key.
|
|
3DES
|
Triple DES. Performs
encryption three times using a 56-bit key.
|
|
AES-128
|
Advanced Encryption
Standard. Uses a 128-bit key.
|
|
AES-192
|
AES using a 192-bit key.
|
|
AES-256
|
AES using a 256-bit key.
|
The default, 3DES, is more secure than DES but requires more
processing for encryption and decryption. Similarly, the AES options provide
increased security but also require increased processing.
-
Authentication—Choose the hash algorithm used for authentication
and ensuring data integrity. The default is SHA. MD5 has a smaller digest and
is considered to be slightly faster than SHA. There has been a demonstrated
successful (but extremely difficult) attack against MD5. However, the
Keyed-Hash Message Authentication Code (HMAC) version used by the ASA prevents
this attack.
-
Diffie-Hellman Group—Choose the Diffie-Hellman group identifier, which the two IPsec peers use to derive a shared secret without
transmitting it to each other. The default, Group 2 (1024-bit Diffie-Hellman), requires less CPU time to execute but is less secure than Group 5 (1536-bit).
IPsec Settings
(Optional)
Use
the IPsec Settings (Optional) pane to identify local hosts/networks which do
not require address translation. By default, the ASA hides the real IP
addresses of internal hosts and networks from outside hosts by using dynamic or
static Network Address Translation (NAT). NAT minimizes risks of attack by
untrusted outside hosts but may be improper for those who have been
authenticated and protected by VPN.
For example, an inside host using dynamic NAT has its IP address
translated by matching it to a randomly selected address from a pool. Only the
translated address is visible to the outside. Remote VPN clients that attempt
to reach these hosts by sending data to their real IP addresses cannot connect
to these hosts, unless you configure a NAT exemption rule.
Note |
If you want all hosts and networks to be exempt from NAT,
configure nothing on this pane. If you have even one entry, all other hosts and
networks are subject to NAT.
|
-
Interface—Choose the name of the interface that connects to the
hosts or networks you have selected.
-
Exempt Networks—Select the IP address of the host or network
that you want to exempt from the chosen interface network.
-
Enable split tunneling—Select to have traffic from remote access
clients destined for the public Internet sent unencrypted. Split tunneling
causes traffic for protected networks to be encrypted, while traffic to
unprotected networks is unencrypted. When you enable split tunneling, the ASA
pushes a list of IP addresses to the remote VPN client after authentication.
The remote VPN client encrypts traffic to the IP addresses that are behind the
ASA. All other traffic travels unencrypted directly to the Internet without
involving the ASA.
-
Enable Perfect Forwarding Secrecy (PFS)—Specify whether to use
Perfect Forward Secrecy, and the size of the numbers to use, in generating
Phase 2 IPsec keys. PFS is a cryptographic concept where each new key is
unrelated to any previous key. In IPsec negotiations, Phase 2 keys are based on
Phase 1 keys unless PFS is enabled. PFS uses Diffie-Hellman techniques to
generate the keys.
PFS ensures that a session key derived from a set of long-term
public and private keys is not compromised if one of the private keys is
compromised in the future.
PFS must be enabled on both sides of the connection.
-
Diffie-Hellman Group—Select the Diffie-Hellman group identifier, which the two IPsec peers use to derive a shared secret without
transmitting it to each other. The default, Group 2 (1024-bit Diffie-Hellman), requires less CPU time to execute but is less secure than Group 5 (1536-bit).
Summary
When you are satisfied with the configuration, click
Finish. ASDM saves the LAN-to-LAN configuration. After you
click
Finish, you can no longer use the VPN wizard to make changes
to this configuration. Use ASDM to edit and configure advanced features.
Feedback