Specifying The Tunnel Group Or Trustpoint - Cisco FirePOWER ASA 5500 series Configuration Manual

Specifying the Tunnel Group or Trustpoint

Figure 34-1
the commands you enter.
Figure 34-1 Easy VPN Hardware Client Tunneling Options for the Cisco ASA 5505
Phase 2 Tunnels Source proxy
Public IP
1) Public to Public
2) Management
N/A
a) clear
b) default Public IP
c) tunnel Public IP
3) Inside to Inside
NEM Network
a) NEM Mode
Assign IP
b) Client mode
Configuration factors:
1. Certs or Preshare Keys (Phase 1- main mode or aggressive mode)
2. Mode: Client or NEM
3. All-or-nothing or Split-tunneling
4. Management Tunnels
5. IUA to VPN3000 or ASA headend
The term "All-Or-Nothing" refers to the presence or absence of an access list for split tunneling. The
access list ("ST-list") distinguishes networks that require tunneling from those that do not.
Specifying the Tunnel Group or Trustpoint
When configuring the Cisco ASA 5505 as an Easy VPN hardware client, you can specify a tunnel group
or trustpoint configured on the Easy VPN server, depending on the Easy VPN server configuration. See
the section that names the option you want to use:
•
•
Specifying the Tunnel Group
Enter the following command in global configuration mode to specify the name of the VPN tunnel group
and password for the Easy VPN client connection to the server:
group_name is the name of the VPN tunnel group configured on the Easy VPN server. You must
configure this tunnel group on the server before establishing a connection.
preshared_key is the IKE pre-shared key used for authentication on the Easy VPN server.
Cisco Security Appliance Command Line Configuration Guide
34-6
network-extension-mode to make those addresses accessible from the enterprise network.
–
shows the types of tunnels that the Easy VPN client initiates, based on the combination of
Public
Work zone
client
Specifying the Tunnel Group
Specifying the Trustpoint
vpnclient vpngroup group_name password preshared_key
Chapter 34 Configuring Easy VPN Services on the ASA 5505
Public
Corporate
server
* Only for ASA or VPN3000 Headends
Destination proxy
Public IP
N/A
Any or ST-List (*3)
Specified on Client
Any or ST-List (*3)
Any or ST-List (*3)
OL-10088-01