Hello,
I'm trying to configure a VPN server (Cisco FirePower 1100) for Remote Access,
using IKEv2 with PSK and LDAP for user authentication.
So far I'm was able to correctly set the IKEv2 part,
but the problem is that every connection is accepted,
without asking for user credentials.
My current configuration looks like this:
aaa-server MY-LDAP protocol ldap
aaa-server MY-LDAP (outside) host ldap.mysite.com
***** hidden, but it works (tested with ikev1) *****
crypto ipsec ikev2 ipsec-proposal ipsec-proposal
protocol esp encryption aes-256 aes-192 aes
protocol esp integrity sha-256 sha-1
crypto dynamic-map DYNMAP 1 set ikev2 ipsec-proposal ipsec-proposal
crypto dynamic-map DYNMAP 1 set reverse-route
crypto map CMAP 1 ipsec-isakmp dynamic DYNMAP
crypto map CMAP interface outside
crypto ikev2 policy 1
encryption aes-256
integrity sha512 sha256
group 21 20 19 16 15 14
prf sha512 sha256
lifetime seconds 86400
crypto ikev2 enable outside
group-policy DefaultRA internal
group-policy DefaultRA attributes
vpn-tunnel-protocol ikev1 ikev2 ssl-client ssl-clientless
group-lock value DefaultRAGroup
split-tunnel-policy tunnelspecified
split-tunnel-network-list value def_acl
tunnel-group DefaultRAGroup general-attributes
address-pool vpn-client-pool
authentication-server-group MY-LDAP
authorization-server-group MY-LDAP
default-group-policy DefaultRA
tunnel-group DefaultRAGroup ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
For the client testing, I'm using a mac, with the following configuration setted:
Under Settings -> Network -> new VPN(IKEv2)
server address = remote ID = vpn.mysite.com
Authentication Settings -> Shared Secred = myPSK
Thank You in advance,
Gabriele
