{"id":527,"date":"2016-03-24T19:14:54","date_gmt":"2016-03-24T19:14:54","guid":{"rendered":"http:\/\/www.balajibandi.com\/?p=527"},"modified":"2017-09-24T19:50:08","modified_gmt":"2017-09-24T18:50:08","slug":"ipsec-remote-access-vpn","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=527","title":{"rendered":"IPsec Remote-Access VPN"},"content":{"rendered":"

IPsec Remote-Access VPN<\/strong><\/span><\/span><\/h1>\n

Part of the CCIE Sec Journey created a Remote Access VPN setup.<\/p>\n

Physical Diagram for the LAB<\/p>\n

\"\"<\/p>\n

I have used below Version of ASAv and ASDM<\/p>\n

\"\"<\/p>\n

IP address and Physical connectivity as shown as above pictures.<\/p>\n

RAS pool of address 200.200.200.X \/24<\/p>\n

Before proceeding further, i expect all the devices have L3 connectivity.<\/p>\n

Make sure Branch router \/ Windows PC able to ping 192.168.1.249 ( ASAv). If all devices have reachable. move to next level to configure Remove Access VPN.<\/p>\n

Connect to ASAv with your ASDM.<\/p>\n

its easy to ASDM to create remove access VPN with Wizard.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Notice the option on the screen above that is selected by default. This allows IPsec sessions to bypass access lists applied on the interface.<\/p>\n

The default selected interface is\u00a0outside<\/em>, which is where we want to configure this VPN, so I will click on the\u00a0Next<\/em>button.<\/p>\n

\"\"<\/p>\n

We will be using the Cisco VPN client, so I will leave the default option selected and click\u00a0Next<\/em>.<\/p>\n

\"\"<\/p>\n

\u00a0I have configured a tunnel group name of bblab-RAS-VPN and a pre-shared key of bbcisco.<\/p>\n

(change as per your setup)<\/p>\n

\"\"<\/p>\n

we select the method with which to authenticate the remote users. In the step before this, we configured a pre-shared key for the tunnel group.<\/p>\n

\"\"<\/p>\n

Because we specified that we want to use the local database for client authentication, the wizard prompts us to add usernames.\u00a0I will add another user with username and password of bbcisco.<\/p>\n

\"\"<\/p>\n

When a users connects using the VPN client, User will be assigned an IP address from an IP address pool that we configure. This is one of the reasons to have a remote access VPN, because it makes remote users become \u201cpart\u201d of the internal network. I will click on the\u00a0New<\/em>\u00a0button to add a local IP pool, as shown below:<\/p>\n

 <\/p>\n

\"\"<\/p>\n

I have used 200.200.200.0\/24. please change the IP address range based on your setup.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

\"\"<\/p>\n

DNS entry, change as per your DNS Server.<\/p>\n

Wizard gives us the option of performing a NAT exemption so that all internal networks will be visible to remote users without any translation. Also, notice that I have selected the option to enable split tunneling. Split tunneling allows remote access VPN users to access specified networks (e.g., 100.100.100.0\/24 ) through the VPN but all other traffic (e.g., Internet traffic) goes through the client\u2019s normal gateway without going through the tunnel. If split tunneling is not enabled, even the remote access user\u2019s Internet traffic will go through the VPN tunnel. This may be desired; it all depends on the network and your setup.<\/p>\n

\"\"<\/p>\n

Final config. :<\/p>\n

\"\"<\/p>\n

I have windows already installed Windows VPN Client, Now we going to configured the same.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

The configure we used here, before we configured in ASA, password is – bbcisco (change as per your network)<\/p>\n

Some tests before we establish VPN. below screen shows no connection to 100.100.100.5<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

Lets connect to VPN<\/p>\n

using<\/p>\n

username : bbscisoc<\/p>\n

password : passw0rd<\/p>\n

\"\"<\/p>\n

 <\/p>\n

\"\"<\/p>\n

It is connected now.<\/p>\n

\"\"<\/p>\n

we can see some statistics.<\/p>\n

\"\"<\/p>\n

We able to access 100.100.100.0\/24 network.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

We have IP 200.200.200.100\/24 as soon as we connected to remote access VPN<\/p>\n

Some tests :<\/p>\n

we able to ping Remote site Server, and traceroute is next hop.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

We can view Remote VPN Client connections.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Once you terminate the connection you can see the below logs in ASDM<\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

Happy Labiingggggggg!<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

IPsec Remote-Access VPN Part of the CCIE Sec Journey created a Remote Access VPN setup. Physical Diagram for the LAB I have used below Version of ASAv and ASDM IP address and Physical connectivity as shown as above pictures. RAS pool of address 200.200.200.X \/24 Before proceeding further, i expect all the devices have L3 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,2,6],"tags":[],"class_list":["post-527","post","type-post","status-publish","format-standard","hentry","category-ccie-sec","category-cisco","category-security"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/527","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=527"}],"version-history":[{"count":5,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/527\/revisions"}],"predecessor-version":[{"id":561,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/527\/revisions\/561"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}