Cisco IOS router to ASA Anyconnect configuration

[Albert Wong]

Hello,

               Could someone give me some pointers whether I can use a Cisco 1812 to login to a Cisco ASA5512X using Anyconnect. The issue we have is that some of the remote offices can't be given fixed IP addresses...

Thanks.

[czaja0000]

Hi,

Maybe this idea will be helpfully.

Check this documentation:

Dynamic IPsec Tunnel Between a Statically Addressed ASA and a Dynamically Addressed Cisco IOS Router

This is a sample how to configure the ASA to accept dynamic IPsec connections from the Cisco router.

Remember, in this scenario L2L tunnel establishes only when the tunnel is initiated from the router !!

________________
Best regards,
MB

[Karsten Iwen · Accepted solution]

AnyConnect can't be used as it's only a software-client-solution and not integrated into IOS like the EzVPN-client.

You can use the already proposed dynamic crypto maps on the ASA with a standard crypto map on the router, or you configure EzVPN remote on the router and EzVPN server on the ASA:

http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_esyvpn/configuration/15-mt/sec-easy-vpn-rem.html

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_remote_access.html

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Albert Wong]

karsen,

               I got it working but I only got an IP address for within the VPN Pool of IPs. The configuration was a breeze and EZVPN is one of the best documented part of all the Cisco VPN technology.

Having said that I don't have it clear how I do create a site to site VPN with EZVPN

[Karsten Iwen]

Well, EzVPN is also a Remote-Access technology, so you don't configure site-to-site VPNs. But you can achieve something similar:

Your router is still the EzVPN client and initiates the connection. In the ezvpn-client config you have to change the mode from client (which is the default) to network-extension. With that, the router won't request an IP through mode-config. Instead your local LAN IPs can communicate transparently through the tunnel.

In addition to that change on the client, you have to add the option to allow network-extention-mode in the corresponding group-policy of your EzVPN server (the ASA).

Sent from Cisco Technical Support iPad App