So lately I have been working on an Easy VPN configuration that requires a Cisco 1811 connected with just one interface to a Pix’s DMZ. I am about 75 percent done with the configuration and I am just waiting on the rest of the local traffic information to finish the tunnel. The ASA will have an external IP address of 12.34.56.78. I currently have the following configured on the ASA:
access-list ezvpn standard permit 172.16.1.0 255.255.255.0
group−policy DfltGrpPolicy attributes
banner none
wins−server none
dns−server none
dhcp−network−scope none
vpn−access−hours none
vpn−simultaneous−logins 3
vpn−idle−timeout 30
vpn−session−timeout none
vpn−filter none
vpn−tunnel−protocol IPSec
password−storage enable
ip−comp disable
re−xauth disable
group−lock none
pfs disablei
psec−udp enable
ipsec−udp−port 10000
split−tunnel−policy tunnelspecified
split−tunnel−network−list value ezvpn
default−domain none
split−dns none
secure−unit−authentication disable
user−authentication disable
user−authentication−idle−timeout 3
ip−phone−bypass disable
leap−bypass disable
nem enable
backup−servers keep−client−config
client−firewall none
client−access−rule none
username alltimedefense password 23DSFLKJlsdkfs9080wr encrypted
crypto ipsec transform-set EZVPN esp-3des esp-sha-hmac
crypto dynamic-map dynEZVPN 10 set transform-set EZVPN
crypto map ezvpn 10 ipsec-isakmp dynamic dynEZVPN
crypto map ezvpn interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 86400
tunnel-group ezvpn-tunnel general-attributes
default-group-policy DfltGrpPolicy
tunnel-group ezvpn-tunnel ipsec-attributes
pre-shared-key cisco
That should be all that is needed on the ASA. The lines in bold are different configuration modes and the italics are any configuration that is custom (where I changed a name or password). Now let me move on to the Cisco 1811 at the remote site. The Fast Ethernet 0 interface will have an ip address of 192.168.1.1 and the loopback interface will have an ip address of 172.16.1.1.
username alltimedefense password 23DSFLKJlsdkfs9080wr
ip route 0.0.0.0 0.0.0.0 192.168.1.2
crypto ipsec client ezvpn EZVPN
connect auto
group ezvpn key cisco
mode network-extension
peer 12.34.56.78
xauth userid mode local
access-list 100 permit ip any any
access-list 110 permit ip any any
access-list 120 permit ip 172.16.1.0 0.0.0.255 any
route-map EZVPN permit 1
match ip address 120
ip nat inside source route-map EZVPN interface FastEthernet0 overload
Now we need to add the access-lists and the crypto ipsec client ezvpn EZVPN to the FastEthernet0 and Loopback interfaces.
interface FastEthernet0
ip access-group 100 in
crypto ipsec client ezvpn EZVPN
interface Loopback0
ip access-group 110 out
crypto ipsec client ezvpn EZVPN inside
After this configuration I was able to bring the tunnel up and ping the loopback interface from my ASA at the 172.16.1.1 ip address. When I am given the remote ip addressing information I will make the necessary changes to the configuration to allow traffic to flow from the remote LAN to my network behind the ASA.
Hopefully I didn’t mistype anything while going back through this and I plan to update the configuration once the project is completed. If anyone catches any mistakes or can give me some criticism or advice please feel free to leave a comment or email me.
