Windows IKEv2 Remote Access VPN with an ASA

[Greg Focaccio]

Hi All,

I'd like to know if anyone has experience using the Windows built-it / native IKEv2 option to establish a remote access VPN connection with an ASA.

I know I am using general terms here and not being specific.  Perhaps it only works with Window 10 and ASA code versions above 

A Note in the introduction section of the following link seems to indicate that one can use Windows 7, but must be using ASA code 9.3(2)

http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115907-config-flexvpn-wcca-00.html

Can anyone verify this is correct in their experience?

Has anyone been able to get a remote access VPN established with Windows native IKEv2 and ASA?  (and not using ISE integrated services engine)

If so could you please share some config and/or links?

We are currently using a 5520 with 9.1(7)16  (beginning plans to upgrade to the -X series)

Thanks,

Greg

[Philip D'Ath]

Only a sadistic person who loves having problems would go down this route.  it does work but is painful.

Trust me on this one - buy some AnyConnect licences (if you don't have them already) and use that approach.

[Greg Focaccio]

Funny!  Yes, I did just upgrade the box from 2 to 10 Premium AnyConnect licenses and that is my preferred approach - which is already working.

I'm asking about Microsoft because I'd like to get that approach working as well -  even if it is painful.  We are working to automate and this approach would help.  I'm currently using local authentication, but will eventually be moving to LDAP authentication also.

Do you have any links or information about IKEv2 remote access VPNs with ASA?  What versions work or configs to share?

Thanks

[Philip D'Ath]

I found this example:

http://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119208-config-asa-00.html

[Greg Focaccio]

Thanks Philip,

That is the second article that mentions: 

"for a Cisco Adaptive Security Appliance (ASA) Version 9.3.2 and later"

Seems like we are going to need to upgrade our ASA before IKEv2 is possible since the non -X ASA can not be upgraded beyond 9.1