1

Create and enter IKEv1 policy configuration mode.

Note: The lower the policy-priority, the higher the priority with a valid range from 1-65535.

asa(config)#crypto ikev1 policy policy-priority

2

Configure an authentication method (default: pre-share).

asa(config-ikev1-policy)#authentication {pre-share | rsa-sig}

3

Configure an encryption method (default: 3des).

asa(config-ikev1-policy)#encryption {des | 3des | aes | aes-192 | aes-256}

4

Configure a hash method (default: sha).

asa(config-ikev1-policy)#hash {md5 | sha}

5

Configure a Diffie-Hellman (DH) group (default: 2).

asa(config-ikev1-policy)#group {1 | 2 | 5}

6

Configure the IKE SA lifetime (Default: 86400 seconds (24 hours)).

asa(config-ikev1-polocy)#lifetime lifetime

7

Enable IKEv1 on an interface

Note: This is the interface that goes out to the IPsec destination.

asa(config)#crypto ikev1 enable interface-name

8

Create a IKEv1 Transform set.

Notes:

encryption-method can be esp-des, esp-3des, esp-aes, esp-aes-192, esp-aes-256, or esp-null

authentication-method can be esp-md5-hmac, esp-sha-hmac or esp-none.

asa(config)#crypto ipsec ikev1 transform-set set-name encryption-method authentication-method

9

Create a dynamic map that links together the previously created transform set and the crypto map (which will be configured next).

asa(config)#crypto dynamic-map dynamic-map-name sequence-number set ikev1 transform-set set-name

10

Create a Crypto map and match based on the previously created dynamic map.

asa(config)#crypto map map-name sequence-number ipsec-isakmp dynamic dynamic-map-name

11

Apply the crypto map to an interface.

asa(config)#crypto map map-name interface interface

12

Create an internal group policy.

asa(config)#group-policy policy-name internal

13

Enter group policy attribute configuration mode.

asa(config)#group-policy policy-name attributes

14

Enable the use of the Easy VPN Network Emulation mode.

asa(config-group-policy)#nem enable

15

(optional) Create an access-list to specify the traffic that will be to be encrypted within the IPsec tunnel to the central network.

Note: This is a very simplified version of an ACL; for further details on ACLs. see the 'ASA Access Lists Concepts and Configuration' article.

asa(config)#access-list acl-name extended {permit | deny} protocol source-network source-netmask destination-network destination-netmask

16

(optional) Enable the use of split tunnel.

Note: the mode shown will tunnel only specified traffic.

asa(config-group-policy)#split-tunnel-policy tunnelspecified

17

(optional) Specify the name of an access list that specifies the traffic to be tunneled.

asa(config-group-policy)#split-tunnel-network-list access-list-name

18

Define a username and password that will be used by the remote client to log in.

asa(config)#username username password password

19

Specify the tunnel group type.

asa(config)#tunnel-group tunnel-group-nametype remote-access

20

Enter IPsec tunnel general attribute configuration mode.

asa(config)#tunnel-group tunnel-group-name general-attributes

21

Specify the default group policy to be used.

asa(config-tunnel-general)#default-group-policy policy-name

22

Enter IPsec tunnel IPsec attribute configuration mode.

asa(config)#tunnel-group tunnel-group-name ipsec-attributes

23

Configure the IPsec tunnel pre-shared key or certificate trustpoint.

asa(config-tunnel-ipsec)#ikev1 pre-shared-key pre-shared-key

1

Configure the IP addresses to the Easy VPN server (or servers).

asa(config)#vpnclient server server-ip-address [server-ip-address2...server-ip-address10]

2

Configure the Easy VPN mode.

asa(config)#vpnclient mode {client-mode | network-extension-mode}

3

Configure the IPsec VPN group credentials.

Note: The tunnel-group-name and pre-shared-key come from the configuration of the Easy VPN server.

asa(config)#vpnclient vpngroup tunnel-group-name password pre-shared-key

4

Configure the login credentials.

Note: These were configured with the username statement in the VPN server configuration.

asa(config)#vpnclient username username password password

5

(optional) When using split tunneling, configure to enable automatic IPsec tunnel initiation.

asa(config)#vpnclient nem-st-autoconnect

6

Enable the Easy VPN client.

asa(config)#vpnclient enable