Solved

Cisco ASA VPN configuration

Posted on 2009-07-07
4
701 Views
Last Modified: 2012-05-07
I am converting all of my PIX devices over to ASA platforms.  Several of my PIX 515's also support VPDN access.  Can someone take a look at the attached following code and make sure I have the ASA configured to match the way I have my PIX devices currently set up?

The one CLI command on the PIX that really concerns me the most is the 'vpdn enable outside' command.  I cannot find the equivalent CLI under the ASA.
PIX config:
ip local pool etpool 192.168.250.1-192.168.250.254
...
...
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local etpool
vpdn group PPTP-VPDN-GROUP client configuration dns 172.20.3.11
vpdn group PPTP-VPDN-GROUP client authentication aaa RADIUS
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn enable outside
 
ASA configuration:
ip local pool etpool 192.168.250.1-192.168.250.254
...
...
service-policy global_policy global
group-policy PPTP-VPDN-GROUP internal
group-policy PPTP-VPDN-GROUP attributes
 dns-server value 172.20.3.11
 vpn-tunnel-protocol l2tp-ipsec
tunnel-group PPTP-VPDN-GROUP type ipsec-ra
tunnel-group PPTP-VPDN-GROUP general-attributes
 address-pool etpool
 authentication-server-group RADIUS
 default-group-policy PPTP-VPDN-GROUP
tunnel-group PPTP-VPDN-GROUP ppp-attributes
 authentication pap
 authentication ms-chap-v2

Open in new window

0
Comment
Question by:jgrammer42
  • 2
  • 2
4 Comments
 
LVL 13

Expert Comment

by:3nerds
ID: 24795118
Your VPDN is using PPTP, and the ASA does not support that as a remote access VPN protocol, just making sure you realize this. As it was common to create a VPN connection using PPTP in windows XP so that you did not have to load a client on the remote machines. They new idea is to use IPSEC and the Cisco VPN client or to go the SSL VPN route.

Regards,

3nerds
0
 

Author Comment

by:jgrammer42
ID: 24830935
3nerds,

So, what you are saying is that if I make this change, my MS Windows XP users will no longer be able to VPN in using the Windows VPN client?

Thanks,
0
 
LVL 13

Accepted Solution

by:
3nerds earned 500 total points
ID: 24842600
Correct.

3nerds
0
 

Author Comment

by:jgrammer42
ID: 24849664
That is not good....that creates some real problems.

I will have to think about this..

Thank you,
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question