Solved

Cisco ASA VPN configuration

Posted on 2009-07-07
4
702 Views
Last Modified: 2012-05-07
I am converting all of my PIX devices over to ASA platforms.  Several of my PIX 515's also support VPDN access.  Can someone take a look at the attached following code and make sure I have the ASA configured to match the way I have my PIX devices currently set up?

The one CLI command on the PIX that really concerns me the most is the 'vpdn enable outside' command.  I cannot find the equivalent CLI under the ASA.
PIX config:
ip local pool etpool 192.168.250.1-192.168.250.254
...
...
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local etpool
vpdn group PPTP-VPDN-GROUP client configuration dns 172.20.3.11
vpdn group PPTP-VPDN-GROUP client authentication aaa RADIUS
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn enable outside
 
ASA configuration:
ip local pool etpool 192.168.250.1-192.168.250.254
...
...
service-policy global_policy global
group-policy PPTP-VPDN-GROUP internal
group-policy PPTP-VPDN-GROUP attributes
 dns-server value 172.20.3.11
 vpn-tunnel-protocol l2tp-ipsec
tunnel-group PPTP-VPDN-GROUP type ipsec-ra
tunnel-group PPTP-VPDN-GROUP general-attributes
 address-pool etpool
 authentication-server-group RADIUS
 default-group-policy PPTP-VPDN-GROUP
tunnel-group PPTP-VPDN-GROUP ppp-attributes
 authentication pap
 authentication ms-chap-v2

Open in new window

0
Comment
Question by:jgrammer42
  • 2
  • 2
4 Comments
 
LVL 13

Expert Comment

by:3nerds
ID: 24795118
Your VPDN is using PPTP, and the ASA does not support that as a remote access VPN protocol, just making sure you realize this. As it was common to create a VPN connection using PPTP in windows XP so that you did not have to load a client on the remote machines. They new idea is to use IPSEC and the Cisco VPN client or to go the SSL VPN route.

Regards,

3nerds
0
 

Author Comment

by:jgrammer42
ID: 24830935
3nerds,

So, what you are saying is that if I make this change, my MS Windows XP users will no longer be able to VPN in using the Windows VPN client?

Thanks,
0
 
LVL 13

Accepted Solution

by:
3nerds earned 500 total points
ID: 24842600
Correct.

3nerds
0
 

Author Comment

by:jgrammer42
ID: 24849664
That is not good....that creates some real problems.

I will have to think about this..

Thank you,
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Configuring Port Access on Cisco ASA 5 33
What Cisco IOS has CBAC support? 4 21
Syslog-ng works. Now what? How to filter and manage? 8 64
Cisco Edge Routers for BGP 6 53
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question