nmcnair
asked on
Setting up remote VPN access with aggressive mode disabled...
I have been asked to solve a problem which I'm not very familiar with. I've setup remote VPN access before but not with these options. My company has to be PCI compliant and we have a firewall which we use for some partners to access our internal network. We were recently told by our auditor that we could not have aggressive mode enabled on the VPN profiles. But apparently we can't get the VPN connections to work once we turn off aggressive mode. I read somewhere that you can use certificates instead of pre-shared keys and that might solve the problem. But I'm trying to set that up and having problems. Anyone have any insight into how to make this work? (remote IPSec VPN with aggressive mode disabled?)
ASKER
I upgraded to 8.0.4 this morning. All of the enpoints are Cisco VPN software clients (v 5.0.01.06) running on Widows boxes. I attempted this morning to setup self signed certifcates with a local CA server running on the SA but was unable to get it to work. I am tempted to go to Verisign and sign up for their managed PKI so I can use them as the CA but I'm not sure that's going to solve the problem.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Main mode is the default, so you should be able to disable aggressive mode.
Suggest you update to 8.0.4 as there is a long list of bug fixes since 8.0.1