Specifying The Client/Server Role Of The Cisco Asa 5505 - Cisco FirePOWER ASA 5500 series Configuration Manual

Specifying the Client/Server Role of the Cisco ASA 5505

Specifying the Client/Server Role of the Cisco ASA 5505
The Cisco ASA 5505 can function as a Cisco Easy VPN hardware client (also called "Easy VPN
Remote") or as a server (also called a "headend"), but not both at the same time. It does not have a default
role. Use one of the following commands in global configuration mode to specify its role:
•
•
The following example shows how to specify the ASA 5505 as an Easy VPN hardware client:
hostname(config)# vpnclient enable
hostname(config)#
The CLI responds with an error message indicating that you must remove certain data elements if you
switch from server to hardware client, depending on whether the elements are present in the
configuration.
configurations, and not permitted in client configurations.
Table 34-1
Permitted in Both Client and Server
Configurations
crypto ca trustpoints
digital certificates
group-policies
crypto dynamic-maps
crypto ipsec transform-sets
crypto ipsec security-association lifetime
crypto ipsec fragmentation before-encryption
crypto ipsec df-bit copy-df
An ASA 5505 configured as an Easy VPN hardware client retains the commands listed in the first
column within its configuration, however, some have no function in the client role.
The following example shows how to specify the ASA 5505 as an Easy VPN server:
hostname(config)# no vpnclient enable
hostname(config)#
After entering the no version of this command, configure the ASA 5505 as you would any other ASA,
beginning with
Cisco Security Appliance Command Line Configuration Guide
34-2
vpnclient enable to specify the role of the ASA 5505 as an Easy VPN Remote
no vpnclient enable to specify the role of the ASA 5505 as server
Table 0-1 lists the data elements that are permitted in both client and server
Configuration Privileges and Restrictions on the ASA 5505
"Getting Started" section on page 2-1
Chapter 34 Configuring Easy VPN Services on the ASA 5505
Not Permitted in Client Configurations
tunnel-groups
isakmp policies
crypto maps
of this guide.
OL-10088-01