Specifying The Primary And Secondary Servers - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 34 Configuring Easy VPN Services on the ASA 5505

Specifying the Primary and Secondary Servers

Before establishing a connection with an Easy VPN hardware client, you must specify the IP address of
an Easy VPN server to which it will connect. Any ASA, including another ASA 5505 configured as a
headend, a VPN 3000 Series Concentrator, an IOS-based router, or a firewall can act as an Easy VPN
server. Use the vpnclient server command in global configuration mode, as follows:
[no] vpnclient server ip_primary [ip_secondary_1...ip_secondary_10]
no removes the command from the running configuration.
ip_primary_address is the IP address or DNS name of the primary Easy VPN server.
ip_secondary_address_n (Optional) is a list of the IP addresses or DNS names of up to ten backup Easy
VPN servers. Use a space to separate the items in the list.
For example, enter the following command to configure a VPN client to use Easy VPN Server
10.10.10.15 as the primary server, and 10.10.10.30 and 192.168.10.45 as alternate servers:
hostname(config)# vpnclient server 10.10.10.15 10.10.10.30 192.168.10.10
hostname(config)#
Specifying the Mode
The Easy VPN Client supports one of two modes of operation: Client Mode or Network Extension Mode
(NEM). The mode of operation determines whether the inside hosts relative to the Easy VPN Client are
accessible from the Enterprise network over the tunnel. Specifying a mode of operation is mandatory
before making a connection because Easy VPN Client does not have a default mode.
Client mode, also called Port Address Translation (PAT) mode, isolates the IP addresses of all devices
on the Easy VPN Client private network from those on the enterprise network. The Easy VPN Client
performs PAT for all VPN traffic for its inside hosts. IP address management is neither required for the
Easy VPN Client inside interface or the inside hosts.
NEM makes the inside interface and all inside hosts routeable across the enterprise network over the
tunnel. Hosts on the inside network obtain their IP addresses from an accessible subnet (statically or via
DHCP) pre-configured with static IP addresses. PAT does not apply to VPN traffic in NEM. This mode
does not require a VPN configuration for each client. The Cisco ASA 5505 configured for NEM mode
supports automatic tunnel initiation. The configuration must store the group name, user name, and
password. Automatic tunnel initiation is disabled if secure unit authentication is enabled.
Note If the Easy VPN hardware client is using NEM and has connections to secondary servers, use the crypto
map set reverse-route command on each headend device to configure dynamic announcements of the
remote network using Reverse Route Injection (RRI).
To specify the mode for Easy VPN Clients, enter the following command in configuration mode:
no removes the command from the running configuration.
OL-10088-01
[no] vpnclient mode {client-mode | network-extension-mode}
Specifying the Primary and Secondary Servers
Cisco Security Appliance Command Line Configuration Guide
34-3