Cisco ASA 5505 - Manual (Page 1560)

71-2
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 71 Configuring Easy VPN Services on the ASA 5505
Specifying the Primary and Secondary Servers
• no vpnclient enable to specify the role of the ASA 5505 as server
The following example shows how to specify the ASA 5505 as an Easy VPN hardware client:
hostname(config)# vpnclient enable
hostname(config)#
The CLI responds with an error message indicating that you must remove certain data elements if you
switch from server to hardware client, depending on whether the elements are present in the
configuration.
Table 71-1 lists the data elements that are permitted in both client and server
configurations, and not permitted in client configurations.
An ASA 5505 configured as an Easy VPN hardware client retains the commands listed in the first
column within its configuration, however, some have no function in the client role.
The following example shows how to specify the ASA 5505 as an Easy VPN server:
hostname(config)# no vpnclient enable
hostname(config)#
After entering the no version of this command, configure the ASA 5505 as you would any other ASA,
beginning with
“Getting Started” section on page 2-1 of this guide.
Specifying the Primary and Secondary Servers
Before establishing a connection with an Easy VPN hardware client, you must specify the IP address of
an Easy VPN server to which it will connect. Any ASA can act as an Easy VPN server, including another
ASA 5505 configured as a headend, a VPN 3000 Series Concentrator, an IOS-based router, or a firewall.
The ASA 5505 Client always tries to set up the tunnel to the headend primary VPN server. If unable to
set up the tunnel to the primary server, it tries the connection to the secondary_1 VPN server, and then
sequentially down the list of VPN servers at 8 second intervals. If the setup tunnel to the secondary_1
server fails, the primary comes online during this time, and the ASA proceeds to set up the tunnel to the
secondary_2 VPN server.
Use the vpnclient server command in global configuration mode, as follows:
[no] vpnclient server ip_primary [ip_secondary_1…ip_secondary_10]
no removes the command from the running configuration.
Table 71-1 Configuration Privileges and Restrictions on the ASA 5505
Permitted in Both Client and Server
Configurations
Not Permitted in Client Configurations
crypto ca trustpoints tunnel-groups
digital certificates isakmp policies
group-policies crypto maps
crypto dynamic-maps
crypto ipsec transform-sets
crypto ipsec security-association lifetime
crypto ipsec fragmentation before-encryption
crypto ipsec df-bit copy-df