Cisco ASA 5505 Configuration Manual page 1405

Chapter 64 General VPN Setup
Type—(Display-only) Displays the type of tunnel group you are adding or editing. The contents of
•
this field depend on your selection on the previous dialog box.
• Pre-shared Key—Lets you specify the value of the pre-shared key for the tunnel group. The
maximum length of the pre-shared key is 128 characters.
• Trustpoint Name—Selects a trustpoint name, if any trustpoints are configured. A trustpoint is a
representation of a certificate authority. A trustpoint contains the identity of the CA, CA-specific
configuration parameters, and an association with one enrolled identity certificate.
Authentication Mode—Specifies the authentication mode: none, xauth, or hybrid.
•
–
–
–
1.
2.
Note
IKE Peer ID Validation—Selects whether IKE peer ID validation is ignored, required, or checked
•
only if supported by a certificate.
Enable sending certificate chain—Enables or disables sending the entire certificate chain. This
•
action includes the root certificate and any subordinate CA certificates in the transmission.
ISAKMP Keep Alive—Enables and configures ISAKMP keep alive monitoring.
•
–
–
–
–
–
• Interface-Specific Authentication Mode—Specifies the authentication mode on a per-interface
basis.
–
OL-20339-01
none—Specifies no authentication mode.
xauth—Specifies the use of IKE Extended Authentication mode, which provides the capability
of authenticating a user within IKE using TACACS+ or RADIUS.
hybrid—Specifies the use of Hybrid mode, which lets you use digital certificates for security
appliance authentication and a different, legacy method—such as RADIUS, TACACS+ or
SecurID—for remote VPN user authentication. This mode breaks phase 1 of the Internet Key
Exchange (IKE) into the following steps, together called hybrid authentication:
The security appliance authenticates to the remote VPN user with standard public key
techniques. This establishes an IKE security association that is unidirectionally authenticated.
An extended authentication (xauth) exchange then authenticates the remote VPN user. This
extended authentication can use one of the supported legacy authentication methods.
Before setting the authentication type to hybrid, you must configure the authentication server
and create a pre-shared key.
Disable Keep Alives—Enables or disables ISAKMP keep alives.
Monitor Keep Alives—Enables or disables ISAKMP keep alive monitoring. Selecting this
option makes available the Confidence Interval and Retry Interval fields.
Confidence Interval—Specifies the ISAKMP keep alive confidence interval. This is the number
of seconds the adaptive security appliance should allow a peer to idle before beginning
keepalive monitoring. The minimum is 10 seconds; the maximum is 300 seconds. The default
for a remote access group is 300 seconds.
Retry Interval—Specifies number of seconds to wait between ISAKMP keep alive retries. The
default is 2 seconds.
Head end will never initiate keepalive monitoring—Specifies that the central-site adaptive
security appliance never initiates keepalive monitoring.
Interface—Lets you select the interface name. The default interfaces are inside and outside, but
if you have configured a different interface name, that name also appears in the list.
Mapping Certificates to IPsec or SSL VPN Connection Profiles
Cisco ASA 5500 Series Configuration Guide using ASDM
64-95