topic Yes that is correct. in Network Security

Cisco IPsec IKEV2 AAA server

Kahlilevelyn — Tue, 12 Mar 2019 08:22:27 GMT

Good Day,

Is it possible to configure IKEv2 Ipsec VPN without a AAA server? Or at the very least use the ASA 5508x as a AAA server for VPN users?

Hi,

Aditya Ganjoo — Mon, 10 Oct 2016 15:34:20 GMT

Hi,

Yes you can do that.

Under the tunnel group config you need to define authentication server as local.

tunnel-group TEST type remote-access
tunnel-group TEST general-attributes
no address-pool
no ipv6-address-pool
authentication-server-group LOCAL

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Is it possible to do this via

Kahlilevelyn — Mon, 10 Oct 2016 17:27:17 GMT

Is it possible to do this via ASDM?

As i have never used CLI to configure a IKEv2 VPN before.

Hi,

Aditya Ganjoo — Mon, 10 Oct 2016 19:34:27 GMT

Hi,

Apologies as I was not able to find it from the ASDM.

But the CLI commands shared would enable local authentication.

Let me know if you face any issues.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Thanks,

Kahlilevelyn — Mon, 10 Oct 2016 19:41:33 GMT

Thanks,

I have no idea what the CLI commands are

I want to create the IKEv2 Ipsec VPN on my outside interface with a dhcp pool of 192.168.250.1-253 and i want it to block access to my inside address of 10.0.0.0 and 192.168.10.0

Hi,

Aditya Ganjoo — Mon, 10 Oct 2016 19:55:01 GMT

Hi,

I have attached the ASDM screenshot for doing both LOCAL authentication and DHCP address assignment for the VPN users.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Is the attached correct?

Kahlilevelyn — Mon, 10 Oct 2016 20:05:18 GMT

Is the attached correct?

i added the anyconnect client to the anyconnect client software tab also.

Yes that is correct.

Aditya Ganjoo — Tue, 11 Oct 2016 03:44:51 GMT

Yes that is correct.

Regards,

Aditya

Please rate helpful posts and mark correct answers.