Cisco 500 Series, Руководство по настройке

Страница: 737 / 1140

34-7
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 34 Configuring Easy VPN Services on the ASA 5505
Specifying the Tunnel Group or Trustpoint
For example, enter the following command to identify the VPN tunnel group named TestGroup1 and the
IKE preshared key my_key123.
hostname(config)# vpnclient vpngroup TestGroup1 password my_key123
hostname(config)#
To remove the attribute from the running configuration, enter the following command:
no vpnclient vpngroup
If the configuration of the ASA 5505 running as an Easy VPN client does not specify a tunnel group, the
client attempts to use an RSA certificate.
For example:
hostname(config)# no vpnclient vpngroup
hostname(config)#
Specifying the Trustpoint
A trustpoint represents a CA identity, and possibly a device identity, based on a certificate the CA issues.
These parameters specify how the security appliance obtains its certificate from the CA and define the
authentication policies for user certificates issued by the CA.
First define the trustpoint using the crypto ca trustpoint command, as described in “Configuring
Trustpoints” section on page 39-7 . Then enter the following command in global configuration mode to
name the trustpoint identifying the RSA certificate to use for authentication:
vpnclient trustpoint trustpoint_name [ chain ]
trustpoint_name names the trustpoint identifying the RSA certificate to use for authentication.
(Optional) chain sends the entire certificate chain.
For example, enter the following command to specify the identity certificate named central and send the
entire certificate chain:
hostname(config)# crypto ca trustpoint central
hostname(config)# vpnclient trustpoint central chain
hostname(config)#
To remove the attribute from the running configuration, enter the following command:
no vpnclient trustpoint
For example:
hostname(config)# no vpnclient trustpoint
hostname(config)#