1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Easy VPN Services on the ASA 5505
Guidelines for Configuring the Easy VPN Server
Note
IPsec NAT-T connections are the only IPsec connection types supported on the home VLAN of a Cisco
ASA 5505. IPsec over TCP and native IPsec connections are not supported.
Authentication Options
The ASA 5505 supports the following authentication mechanisms, which it obtains from the group
policy stored on the Easy VPN Server. The following list identifies the authentication options supported
by the Easy VPN hardware client, however, you must configure them on the Easy VPN server:
•
Secure unit authentication (SUA, also called Interactive unit authentication)
Ignores the
vpnclient username
Xauth command (described in
Authentication” section on page 1-4
) and requires the user to authenticate the ASA 5505 by entering
a password. By default, SUA is disabled. You can use the
secure-unit-authentication enable
command in group-policy configuration mode to enable SUA. See
.
•
Individual user authentication
Requires users behind the ASA 5505 to authenticate before granting them access to the enterprise
VPN network. By default, IUA is disabled. To enable the IUA, use the
user-authentication enable
command in group-policy configuration mode. See
Configuring User Authentication, page 1-67
.
The security appliance works correctly from behind a NAT device, and if the ASA5505 is configured
in NAT mode, the provisioned IP (to which the clients all PAT) is injected into the routing table on
the central-site device.
Caution
Do not configure IUA on a Cisco ASA 5505 configured as an Easy VPN server if a NAT device
is operating between the server and the Easy VPN hardware client.
Use the
user-authentication-idle-timeout
command to set or remove the idle timeout period after
which the Easy VPN Server terminates the client’s access. See
•
Authentication by HTTP redirection
The Cisco Easy VPN server intercepts HTTP traffic and redirects the user to a login page if one of
the following is true:
–
SUA or the username and password are not configured on the Easy VPN hardware client.
–
IAU is enabled.
HTTP redirection is automatic and does not require configuration on the Easy VPN Server.
•
Preshared keys, digital certificates, tokens and no authentication
The ASA 5505 supports preshared keys, token-based (e.g., SDI one-time passwords), and “no user
authentication” for user authentication.
NOTE
: The Cisco Easy VPN server can use the digital
certificate as part of user authorization. See
Chapter 1, “Configuring IPsec and ISAKMP”
instructions.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......