Cisco FirePOWER ASA 5500 series User Manual

30-16
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
Configuring Tunnel Groups
You use isakmp ikev1-user-authentication command to implement hybrid XAUTH authentication
when you need to use digital certificates for security appliance authentication and a different, legacy
method for remote VPN user authentication, such as RADIUS, TACACS+ or SecurID. Hybrid XAUTH
breaks phase 1 of IKE down into the following two steps, together called hybrid authentication:
a. The security appliance authenticates to the remote VPN user with standard public key techniques.
This establishes an IKE security association that is unidirectionally authenticated.
b. An XAUTH exchange then authenticates the remote VPN user. This extended authentication can use
one of the supported legacy authentication methods.
Note Before the authentication type can be set to hybrid, you must configure the authentication server,
create a preshared key, and configure a trustpoint.
You can use the isakmp ikev1-user-authentication command with the optional interface parameter to
specify a particular interface. When you omit the interface parameter, the command applies to all the
interfaces and serves as a back-up when the per-interface command is not specified. When there are two
isakmp ikev1-user-authentication commands specified for a tunnel group, and one uses the interface
parameter and one does not, the one specifying the interface takes precedence for that particular
interface.
For example, the following commands enable hybrid XAUTH on the inside interface for a tunnel group
called example-group:
hostname(config)# tunnel-group example-group type ipsec-ra
hostname(config)# tunnel-group example-group ipsec-attributes
hostname(config-tunnel-ipsec)# isakmp ikev1-user-authentication (inside) hybrid
hostname(config-tunnel-ipsec)#
Configuring WebVPN Tunnel Groups
A WebVPN tunnel group applies only to WebVPN connections. The tunnel-group general attributes for
WebVPN tunnel groups are the same as those of IPSec remote-access tunnel groups, except that the
tunnel-group type is webvpn and the strip-group and strip-realm commands do not apply. You define
the WebVPN-specific attributes separately. The following sections describe how to configure WebVPN
tunnel groups.
Specifying a Name and Type for a WebVPN Tunnel Group
Create the tunnel group, specifying its name and type by entering the tunnel-group command in global
configuration mode. For an IPSec remote-access tunnel, the type is webvpn
hostname(config)# tunnel-group tunnel_group_name type webvpn
hostname(config)#
For example, to create a WebVPN tunnel-group named TunnelGroup3, enter the following command:
hostname(config)# tunnel-group TunnelGroup3 type webvpn
hostname(config)#

Cisco FirePOWER ASA 5500 series Specifications

General

Brand	Cisco
Model	FirePOWER ASA 5500 series
Category	Firewall
Language	English