Security: Remote Access VPN

Moments ago Raj and I tried the remote access vpn and accessing each other’s services under encrypted tunnel.

Define local pool

ip local pool vpnpool mask


Define username and password for remote user

username guest password guest privilege 0

(You would not want your remote user to have full privilege of an admin)


Permit vpn traffic over the internet

sysopt connection permit-vpn

(Exempt vpn traffic from the outside from access list checking)


Permit same security level intra interface

same-security-traffic permit intra-interface

(Your remote user’s traffic will traverse to and fro from the same interface as your local network, default this kind of traffic is dropped.)


Exempt encrypted traffic from nat

access-list vpn-traffic extended permit ip object-group internal object-group remote

object-group network internal


object-group network remote


nat (inside) 0 access-list vpn-traffic


Define group-policy

group-policy cyrus-policy internal

group-policy cyrus-policy attributes

dns-server value

vpn-idle-timeout 60


Define isakmp (ike phase 1)

crypto isakmp enable outside

(isakmp has to be enabled on the outside interface where your remote user traffic is terminating)

crypto isakmp policy 1

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400


Define ipsec (ike phase 2)

crypto ipsec transform-set vpn-set esp-aes esp-sha-hmac


Create dynamic map

crypto dynamic-map vpn-dyn 1 set transform-set vpn-set


Create crypto map

crypto map vpn-map 1 ipsec-isakmp dynamic vpn-dyn


Apply crypto map on the outside interface

crypto map vpn-map interface outside


Define tunnel-group

tunnel-group vpnclient type remote-access

tunnel-group vpnclient general-attributes

address-pool vpnpool

default-group-policy cyrus-policy

tunnel-group vpnclient ipsec-attributes

pre-shared-key *

Your Easy vpn client should set the name to vpnclient (tunnel-group name), and the passwords are preshare key defined in your tunnel-group.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s