Configuring IPSec Remote Access Tunnel Group IPSec Attributes

To configure the IPSec attributes for a remote-access tunnel group, do the following steps. The following description assumes that you have already created the IPSec remote-access tunnel group. IPSec remote-access tunnel groups have more attributes than IPSec LAN-to-LAN tunnel groups:

Step 1 To specify the attributes of an IPSec remote-access tunnel-group, enter tunnel-group ipsec-attributes mode by entering the following command. The prompt changes to indicate the mode change:

hostname(config)# tunnel-group tunnel-group-name ipsec-attributes hostname(config-tunnel-ipsec)#

This command enters tunnel-group ipsec-attributes configuration mode, in which you configure the remote-access tunnel-group IPSec attributes.

For example, the following command designates that the tunnel-group ipsec-attributes mode commands that follow pertain to the tunnel group named TG1. Notice that the prompt changes to indicate that you are now in tunnel-group ipsec-attributes mode:

hostname(config)# tunnel-group TG1 type ipsec-ra hostname(config)# tunnel-group TG1 ipsec-attributes hostname(config-tunnel-ipsec)#

Step 2 Specify the preshared key to support IKE connections based on preshared keys. For example, the following command specifies the preshared key xyzx to support IKE connections for an IPSec remote access tunnel group:

hostname(config-tunnel-ipsec)# pre-shared-key xyzx hostname(config-tunnel-ipsec)#

Step 3 Specify whether to validate the identity of the peer using the peer's certificate:

hostname(config-tunnel-ipsec)# peer-id-validate option hostname(config-tunnel-ipsec)#

The available options are req (required), cert (if supported by certificate), and nocheck (do not check). The default is req.

For example, the following command specifies that peer-id validation is required:

hostname(config-tunnel-ipsec)# peer-id-validate req hostname(config-tunnel-ipsec)#

Step 4 Specify whether to

Step 5 Specify whether to enable sending of a certificate chain. The following command includes the root certificate and any subordinate CA certificates in the transmission:

hostname(config-tunnel-ipsec)# chain hostname(config-tunnel-ipsec)#

This attribute applies to all IPSec tunnel-group types. Step 6 Specify the name of a trustpoint that identifies the certificate to be sent to the IKE peer:

hostname(config-tunnel-ipsec)# trust-point trust-point-name hostname(config-tunnel-ipsec)#

The following command specifies mytrustpoint as the name of the certificate to be sent to the IKE peer:

hostname(config-ipsec)# trust-point mytrustpoint

Step 7 Specify the ISAKMP (IKE) keepalive threshold and the number of retries allowed.

hostname(config-tunnel-ipsec)# isakmp keepalive threshold <number> retry <number> hostname(config-tunnel-ipsec)#

The threshold parameter specifies the number of seconds (10 through 3600) that the peer is allowed to idle before beginning keepalive monitoring. The retry parameter is the interval (2 through 10 seconds) between retries after a keepalive response has not been received. IKE keepalives are enabled by default. To disable IKE keepalives, enter the no form of the isakmp command:

For example, the following command sets the IKE keepalive threshold value to 15 seconds and sets the retry interval to 10 seconds:

hostname(config-tunnel-ipsec)# isakmp keepalive threshold 15 retry 10

hostname(config-tunnel-ipsec)#

The default value for the threshold parameter is 300 for remote-access and 10 for LAN-to-LAN, and the default value for the retry parameter is 2.

To specify that the central site ("head end") should never initiate ISAKMP monitoring, enter the following command:

hostname(config-tunnel-ipsec)# isakmp keepalive threshold infinite hostname(config-tunnel-ipsec)#

Step 8 Specify the ISAKMP hybrid authentication method, XAUTH or hybrid XAUTH.

You use isakmp ikev1-user-authentication command to implement hybrid XAUTH authentication when you need to use digital certificates for security appliance authentication and a different, legacy method for remote VPN user authentication, such as RADIUS, TACACS+ or SecurID. Hybrid XAUTH breaks phase 1 of IKE down into the following two steps, together called hybrid authentication:

a. The security appliance authenticates to the remote VPN user with standard public key techniques. This establishes an IKE security association that is unidirectionally authenticated.

b. An XAUTH exchange then authenticates the remote VPN user. This extended authentication can use one of the supported legacy authentication methods. % _

Note Before the authentication type can be set to hybrid, you must configure the authentication server, create a preshared key, and configure a trustpoint.

You can use the isakmp ikev1-user-authentication command with the optional interface parameter to specify a particular interface. When you omit the interface parameter, the command applies to all the interfaces and serves as a back-up when the per-interface command is not specified. When there are two isakmp ikev1-user-authentication commands specified for a tunnel group, and one uses the interface parameter and one does not, the one specifying the interface takes precedence for that particular interface.

For example, the following commands enable hybrid XAUTH on the inside interface for a tunnel group called example-group:

hostname(config)# tunnel-group example-group type ipsec-ra hostname(config)# tunnel-group example-group ipsec-attributes hostname(config-tunnel-ipsec)# isakmp ikev1-user-authentication (inside) hybrid hostname(config-tunnel-ipsec)#

Continue reading here: Configuring WebVPN Tunnel Group General Attributes

Was this article helpful?

0 0