71-11
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter71 Configuring Easy VPN Services on the ASA 5505
Guidelines for Configuring the Easy VPN Server
pfs Commands the VPN client to use perfect forward secrecy.
re-xauth Requires XAUTH authentication when IKE rekeys.
Note: Disable re-xauth if secure unit authentication is enabled.
secure-unit-authentication Enables interactive authentication for VPN hardware clients.
split-dns Pushes a list of domains for name resolution.
split-tunnel-network-list Specifies one of the following:
•No access list exists for split tunneling. All traffic travels across the
tunnel.
•Identifies the access list the security appliance uses to distinguish
networks that require tunneling and those that do not.
Split tunneling lets a remote-access IPsec client conditionally direct
packets over an IPsec tunnel in encrypted form, or to a network interface
in cleartext form. With split-tunneling enabled, packets not bound for
destinations on the other side of the IPsec tunnel do not have to be
encrypted, sent across the tunnel, decrypted, and then routed to a final
destination.
split-tunnel-policy Lets a remote-access IPsec client conditionally direct packets over an
IPsec tunnel in encrypted form, or to a network interface in cleartext form.
Options include the following:
•split-tunnel-policy—Indicates that you are setting rules for tunneling
traffic.
•excludespecified—Defines a list of networks to which traffic goes in
the clear.
•tunnelall—Specifies that no traffic goes in the clear or to any other
destination than the Easy VPN server. Remote users reach Internet
networks through the corporate network and do not have access to
local networks.
•tunnelspecified—Tunnels all traffic from or to the specified networks.
This option enables split tunneling. It lets you create a network list of
addresses to tunnel. Data to all other addresses travels in the clear, and
is routed by the remote user’s internet service provider.
user-authentication Enables individual user authentication for hardware-based VPN clients.
vpn-access-hours Restricts VPN access hours.
vpn-filter Applies a filter to VPN traffic.
vpn-idle-timeout Specifies the number of minutes a session can be idle before it times out.
vpn-session-timeout Specifies the maximum number of minutes for VPN connections.
vpn-simultaneous-logins Specifies the maximum number of simultaneous logins.
vpn-tunnel-protocol Specifies the permitted tunneling protocols.
wins-server Specifies the IP address of the primary and secondary WINS servers, or
prohibits the use of WINS servers.
Table71-2 Group Policy and User Attributes Pushed to the Cisco ASA 5505 Configured as an
EasyVPN Hardware Client (continued)
Command Description