Cisco ASA Series User Manual

1-14
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Configuring Connection Profiles
hostname(config-tunnel-general)# authenticated-session-username secondary
Configuring Remote-Access Connection Profile IPsec IKEv1 Attributes
To configure the IPsec IKEv1 attributes for a remote-access connection profile, perform the following
steps. The following description assumes that you have already created the remote-access connection
profile. Remote-access connection profiles have more attributes than LAN-to-LAN connection profiles.
Step 1 To specify the IPsec attributes of an remote-access tunnel-group, enter tunnel-group ipsec-attributes
mode by entering the following command in either single or multiple context mode. The prompt changes
to indicate the mode change.
hostname(config)# tunnel-group tunnel-group-name ipsec-attributes
hostname(config-tunnel-ipsec)#
This command enters tunnel-group ipsec-attributes configuration mode, in which you configure the
remote-access tunnel-group IPsec attributes in either single or multiple context mode.
For example, the following command designates that the tunnel-group ipsec-attributes mode commands
that follow pertain to the connection profile named TG1. Notice that the prompt changes to indicate that
you are now in tunnel-group ipsec-attributes mode:
hostname(config)# tunnel-group TG1 type remote-access
hostname(config)# tunnel-group TG1 ipsec-attributes
hostname(config-tunnel-ipsec)#
Step 2 Specify the preshared key to support IKEv1 connections based on preshared keys. For example, the
following command specifies the preshared key xyzx to support IKEv1 connections for an IPsec IKEv1
remote access connection profile:
hostname(config-tunnel-ipsec)# ikev1 pre-shared-key xyzx
hostname(config-tunnel-ipsec)#
Step 3 Specify whether to validate the identity of the peer using the peer’s certificate:
hostname(config-tunnel-ipsec)# peer-id-validate option
hostname(config-tunnel-ipsec)#
The possible option values are req (required), cert (if supported by certificate), and nocheck (do not
check). The default is req.
For example, the following command specifies that peer-id validation is required:
hostname(config-tunnel-ipsec)# peer-id-validate req
hostname(config-tunnel-ipsec)#
Step 4 Specify whether to enable sending of a certificate chain. The following command includes the root
certificate and any subordinate CA certificates in the transmission:
hostname(config-tunnel-ipsec)# chain
hostname(config-tunnel-ipsec)#
This attribute applies to all IPsec tunnel-group types.
Step 5 Specify the name of a trustpoint that identifies the certificate to be sent to the IKE peer:
hostname(config-tunnel-ipsec)# ikev1 trust-point trust-point-name
hostname(config-tunnel-ipsec)#

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English