![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241781.webp)
1-3
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Easy VPN Services on the ASA 5505
Specifying the Mode
no
removes the command from the running configuration.
ip_primary_address
is the IP address or DNS name of the primary Easy VPN server.
ip_secondary_address_n
(Optional) is a list of the IP addresses or DNS names of up to ten backup Easy
VPN servers. Use a space to separate the items in the list.
For example, enter the following command to configure a VPN client to use Easy VPN Server
10.10.10.15 as the primary server, and 10.10.10.30 and 192.168.10.45 as alternate servers:
hostname(config)#
vpnclient server 10.10.10.15 10.10.10.30 192.168.10.10
hostname(config)#
Specifying the Mode
The Easy VPN Client supports one of two modes of operation: Client Mode or Network Extension Mode
(NEM). The mode of operation determines whether the inside hosts relative to the Easy VPN Client are
accessible from the Enterprise network over the tunnel. Specifying a mode of operation is mandatory
before making a connection because Easy VPN Client does not have a default mode.
Client mode, also called Port Address Translation (PAT) mode, isolates the IP addresses of all devices
on the Easy VPN Client private network from those on the enterprise network. The Easy VPN Client
performs PAT for all VPN traffic for its inside hosts. IP address management is neither required for the
Easy VPN Client inside interface or the inside hosts.
NEM makes the inside interface and all inside hosts routeable across the enterprise network over the
tunnel. Hosts on the inside network obtain their IP addresses from an accessible subnet (statically or via
DHCP) pre-configured with static IP addresses. PAT does not apply to VPN traffic in NEM. This mode
does not require a VPN configuration for each client. The Cisco ASA 5505 configured for NEM mode
supports automatic tunnel initiation. The configuration must store the group name, user name, and
password. Automatic tunnel initiation is disabled if secure unit authentication is enabled.
Note
If the Easy VPN hardware client is using NEM and has connections to secondary servers, use the
crypto
map set reverse-route
command on each headend device to configure dynamic announcements of the
remote network using Reverse Route Injection (RRI).
To specify the mode for Easy VPN Clients, enter the following command in configuration mode:
[
no
]
vpnclient mode
{
client-mode
|
network-extension-mode
}
no
removes the command from the running configuration.
NEM with Multiple Interfaces
If you have an
ASA
5505 security appliance (version 7.2 (3) and higher) configured as an Easy VPN
Client in Network Extension Mode with multiple interfaces configured, the security appliance builds a
tunnel for locally encrypted traffic only from the interface with the highest security level.
For example, consider the following configuration:
vlan1 security level 100 nameif inside
vlan2 security level 0 nameif outside
vlan12 security level 75 nameif work
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......