Expiring Today—Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Cisco ASA VPN configuration

Posted on 2009-07-07
4
Medium Priority
?
708 Views
Last Modified: 2012-05-07
I am converting all of my PIX devices over to ASA platforms.  Several of my PIX 515's also support VPDN access.  Can someone take a look at the attached following code and make sure I have the ASA configured to match the way I have my PIX devices currently set up?

The one CLI command on the PIX that really concerns me the most is the 'vpdn enable outside' command.  I cannot find the equivalent CLI under the ASA.
PIX config:
ip local pool etpool 192.168.250.1-192.168.250.254
...
...
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local etpool
vpdn group PPTP-VPDN-GROUP client configuration dns 172.20.3.11
vpdn group PPTP-VPDN-GROUP client authentication aaa RADIUS
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn enable outside
 
ASA configuration:
ip local pool etpool 192.168.250.1-192.168.250.254
...
...
service-policy global_policy global
group-policy PPTP-VPDN-GROUP internal
group-policy PPTP-VPDN-GROUP attributes
 dns-server value 172.20.3.11
 vpn-tunnel-protocol l2tp-ipsec
tunnel-group PPTP-VPDN-GROUP type ipsec-ra
tunnel-group PPTP-VPDN-GROUP general-attributes
 address-pool etpool
 authentication-server-group RADIUS
 default-group-policy PPTP-VPDN-GROUP
tunnel-group PPTP-VPDN-GROUP ppp-attributes
 authentication pap
 authentication ms-chap-v2

Open in new window

0
Comment
Question by:jgrammer42
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 13

Expert Comment

by:3nerds
ID: 24795118
Your VPDN is using PPTP, and the ASA does not support that as a remote access VPN protocol, just making sure you realize this. As it was common to create a VPN connection using PPTP in windows XP so that you did not have to load a client on the remote machines. They new idea is to use IPSEC and the Cisco VPN client or to go the SSL VPN route.

Regards,

3nerds
0
 

Author Comment

by:jgrammer42
ID: 24830935
3nerds,

So, what you are saying is that if I make this change, my MS Windows XP users will no longer be able to VPN in using the Windows VPN client?

Thanks,
0
 
LVL 13

Accepted Solution

by:
3nerds earned 2000 total points
ID: 24842600
Correct.

3nerds
0
 

Author Comment

by:jgrammer42
ID: 24849664
That is not good....that creates some real problems.

I will have to think about this..

Thank you,
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question