Hello brian,
there are no pre-shared information configured for dynamic IPSEC. Instead you need to configure VPN groups and get the client authenticated using a TACACS server or a local database.
The sample configs are as below:
Nonat configuration:
nat (inside) 0 access-list 100
access-list 100 permit ip host 192.168.1.1 10.1.1.0 255.255.255.0
This will not do a nat for the traffic originating from your server (192.168.1.1) to the IP pool when the user gets connected.
IPSEC configuration:
aaa-server LOCAL protocol local
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
Policy:
isakmp identity address
isakmp nat-traversal 20 (required only if PAT traffic coming onto the PIX)
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
VPN group config:
vpngroup vpn idle-time 1800
vpngroup abcvpn address-pool vpnpool
vpngroup abcvpn split-tunnel 100
vpngroup abcvpn idle-time 1800
vpngroup abcvpn password ********
username xyz password abcdef
Do let me know if you need any more information.
