Home > Articles > Certification > Cisco Certification

📄 Contents

  1. ASA Easy VPN (EZVPN) Concepts
  2. ASA Easy VPN (EZVPN) Configuration
  • Print
  • + Share This
From the author of ASA Easy VPN (EZVPN) Configuration

ASA Easy VPN (EZVPN) Configuration

The configuration of the Easy VPN server side is very similar to a "typical" remote access server configuration using group policy. Table 1 reviews the steps that are required to perform this configuration.

Table 1: ASA IKEv1 Easy VPN Server Configuration<


Create and enter IKEv1 policy configuration mode.

Note: The lower the policy-priority, the higher the priority with a valid range from 1-65535.

asa(config)#crypto ikev1 policy policy-priority


Configure an authentication method (default: pre-share).

asa(config-ikev1-policy)#authentication {pre-share | rsa-sig}


Configure an encryption method (default: 3des).

asa(config-ikev1-policy)#encryption {des | 3des | aes | aes-192 | aes-256}


Configure a hash method (default: sha).

asa(config-ikev1-policy)#hash {md5 | sha}


Configure a Diffie-Hellman (DH) group (default: 2).

asa(config-ikev1-policy)#group {1 | 2 | 5}


Configure the IKE SA lifetime (Default: 86400 seconds (24 hours)).

asa(config-ikev1-polocy)#lifetime lifetime


Enable IKEv1 on an interface

Note: This is the interface that goes out to the IPsec destination.

asa(config)#crypto ikev1 enable interface-name


Create a IKEv1 Transform set.


encryption-method can be esp-des, esp-3des, esp-aes, esp-aes-192, esp-aes-256, or esp-null

authentication-method can be esp-md5-hmac, esp-sha-hmac or esp-none.

asa(config)#crypto ipsec ikev1 transform-set set-name encryption-method authentication-method


Create a dynamic map that links together the previously created transform set and the crypto map (which will be configured next).

asa(config)#crypto dynamic-map dynamic-map-name sequence-number set ikev1 transform-set set-name


Create a Crypto map and match based on the previously created dynamic map.

asa(config)#crypto map map-name sequence-number ipsec-isakmp dynamic dynamic-map-name


Apply the crypto map to an interface.

asa(config)#crypto map map-name interface interface


Create an internal group policy.

asa(config)#group-policy policy-name internal


Enter group policy attribute configuration mode.

asa(config)#group-policy policy-name attributes


Enable the use of the Easy VPN Network Emulation mode.

asa(config-group-policy)#nem enable


(optional) Create an access-list to specify the traffic that will be to be encrypted within the IPsec tunnel to the central network.

Note: This is a very simplified version of an ACL; for further details on ACLs. see the "ASA Access Lists Concepts and Configuration" article.

asa(config)#access-list acl-name extended {permit | deny} protocol source-network source-netmask destination-network destination-netmask


(optional) Enable the use of split tunnel.

Note: the mode shown will tunnel only specified traffic.

asa(config-group-policy)#split-tunnel-policy tunnelspecified


(optional) Specify the name of an access list that specifies the traffic to be tunneled.

asa(config-group-policy)#split-tunnel-network-list access-list-name


Define a username and password that will be used by the remote client to log in.

asa(config)#username username password password


Specify the tunnel group type.

asa(config)#tunnel-group tunnel-group-name type remote-access


Enter IPsec tunnel general attribute configuration mode.

asa(config)#tunnel-group tunnel-group-name general-attributes


Specify the default group policy to be used.

asa(config-tunnel-general)#default-group-policy policy-name


Enter IPsec tunnel IPsec attribute configuration mode.

asa(config)#tunnel-group tunnel-group-name ipsec-attributes


Configure the IPsec tunnel pre-shared key or certificate trustpoint.

asa(config-tunnel-ipsec)#ikev1 pre-shared-key pre-shared-key

The client configuration, as opposed to the server configuration, is very simple and is shown in Table 2:

Table 2: ASA IKEv1 Easy VPN Client Configuration


Configure the IP addresses to the Easy VPN server (or servers).

asa(config)#vpnclient server server-ip-address [server-ip-address2...server-ip-address10]


Configure the Easy VPN mode.

asa(config)#vpnclient mode {client-mode | network-extension-mode}


Configure the IPsec VPN group credentials.

Note: The tunnel-group-name and pre-shared-key come from the configuration of the Easy VPN server.

asa(config)#vpnclient vpngroup tunnel-group-name password pre-shared-key


Configure the login credentials.

Note: These were configured with the username statement in the VPN server configuration.

asa(config)#vpnclient username username password password


(optional) When using split tunneling, configure to enable automatic IPsec tunnel initiation.

asa(config)#vpnclient nem-st-autoconnect


Enable the Easy VPN client.

asa(config)#vpnclient enable


The configuration of a VPN can be daunting, and getting it to work as expected can be very challenging. Cisco's Easy VPN feature allows at least the client configuration to be as easy as possible and enables the relatively small ASA 5505 to become a well-secured, easily configured hardware client.

There are a number of possible ways that a VPN can be configured on modern networks, and this is certainly a good option in certain situations and should be considered as one of the possibilities.

  • + Share This
  • 🔖 Save To Your Account