Cisco 500 Series, Configuration Manual

Page: 708 / 1140

31-2
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 31 Configuring IP Addresses for VPNs
Configuring an IP Address Assignment Method
Configuring Local IP Address Pools
To configure IP address pools to use for VPN remote access tunnels, enter the ip local pool command
in global configuration mode. To delete address pools, enter the no form of this command.
The security appliance uses address pools based on the tunnel group for the connection. If you configure
more than one address pool for a tunnel group, the security appliance uses them in the order in which
they are configured.
If you assign addresses from a non-local subnet, we suggest that you add pools that fall on subnet
boundaries to make adding routes for these networks easier.
A summary of the configuration of local address pools follows:
hostname(config)# vpn-addr-assign local
hostname(config)# ip local pool firstpool 10.20.30.40-10.20.30.50 mask 255.255.255.0
hostname(config)
Step 1 To configure IP address pools as the address assignment method, enter the vpn-addr-assign command
with the local argument:
hostname(config)# vpn-addr-assign local
hostname(config)#
Step 2
To configure an address pool, enter the ip local pool command. The syntax is ip local pool poolname
first-address—last-address mask mask .
The following example configures an IP address pool named firstpool. The starting address is
10.20.30.40 and the ending address is 10.20.30.50. The network mask is 255.255.255.0.
hostname(config)# ip local pool firstpool 10.20.30.40-10.20.30.50 mask 255.255.255.0
hostname(config)
Configuring AAA Addressing
To use a AAA server to assign addresses for VPN remote access clients, you must first configure a AAA
server or server group. See the
aaa-server protocol command in the Cisco Security Appliance Command
Reference and “ Identifying AAA Server Groups and Servers ,” in Chapter 13, “Configuring AAA Servers
and the Local Database” of this guide.
In addition, the user must match a tunnel group configured for RADIUS authentication.
The following examples illustrate how to define a AAA server group called RAD2 for the tunnel group
named firstgroup. It includes one more step than is necessary, in that previously you might have named
the tunnel group and defined the tunnel group type. This step appears in the following example as a
reminder that you have no access to subsequent tunnel-group commands until you set these values.
An overview of the configuration that these examples create follows:
hostname(config)# vpn-addr-assign aaa
hostname(config)# tunnel-group firstgroup type ipsec-ra
hostname(config)# tunnel-group firstgroup general-attributes
hostname(config-general)# authentication-server-group RAD2
To configure AAA for IP addressing, perform the following steps: