Configuring Remote Management; Guidelines For Configuring The Easy Vpn Server - Cisco PIX 500 Series Configuration Manual

Chapter 34 Configuring Easy VPN Services on the ASA 5505

Configuring Remote Management

The Cisco ASA 5505, operating as an Easy VPN hardware client, supports management access using
SSH or HTTPS, with or without a second layer of additional encryption. You can configure the Cisco
ASA 5505 to require IPSec encryption within the SSH or HTTPS encryption.
Use the vpnclient management clear command in global configuration mode to use normal routing to
provide management access from the corporate network to the outside interface of the ASA 5505
(no tunneling management packets).
Caution
Use the vpnclient management tunnel command in global configuration mode if you want to automate
the creation of IPSec tunnels to provide management access from the corporate network to the outside
interface of the ASA 5505. The Easy VPN hardware client and server create the tunnels automatically
after the execution of the vpnclient server command. The syntax of the vpnclient management tunnel
command follows:
For example, enter the following command to automate the creation of an IPSec tunnel to provide
management access to the host with IP address 192.168.10.10:
hostname(config)# vpnclient management tunnel 192.198.10.10 255.255.255.0
hostname(config)#
The no form of this command sets up IPSec for management tunnels in accordance with the
split-tunnel-policy and split-tunnel-network-list commands.
For example:
hostname(config)# no vpnclient management
hostname(config)#

Guidelines for Configuring the Easy VPN Server

The following sections address the Easy VPN hardware client considerations that apply to the Easy VPN
server:
•
•
OL-12172-03
Do not configure a management tunnel on a Cisco ASA 5505 configured as an Easy VPN
hardware client if a NAT device is operating between the Easy VPN hardware client and the
Internet. In that configuration, use the vpnclient management clear command.
vpnclient management tunnel ip_addr_1 ip_mask_1 [ip_addr_2 ip_mask_2...ip_addr_n
ip_mask_n]
no vpnclient management
Group Policy and User Attributes Pushed to the Client
Authentication Options
Cisco Security Appliance Command Line Configuration Guide
Configuring Remote Management
34-9