vpn

The video demonstrates User Custom Attribute and Active Directory Attribute features on Cisco ACS 5.4. We will leverage these two features to enforce per-user VPN access as well as static IP assignment. Please note that this lab is built on top of configuration on the previous lab video (SEC0096).

The video walks you through configuration of VPN RADIUS authentication on Cisco ACS 5.4 with AnyConnect Client SSL VPN. We will try to solve the problem of users having to select a VPN group at login by dynamically assigning them to a group-policy via Class RADIUS attribute. We will also attempt to enforce per-user ACL via the Downloadable ACL on the ACS.

• ASA 1000V VPN - IKEv1 Phase1/2
• ASA 1000V VPN - IPSec
• ASA 1000V NAT Bypass (ie. Self-NAT)

• VPN Interface Policy only take affect when applied to an outside interface

• ASA 1000V VPN Device Policy (Phase 1)
  • IKE Policy

The video demonstrates configuration of remote access IPSec VPN with Windows software client on Cisco ASA firewall. We will look at both simple pre-shared key authentication as well as using client certificate. The client is placed behind a NAT router to demonstrate the significance of NAT Transparency, and compare it to raw IPSec, IPSec over UDP and IPSec over TCP. The order of precedence on encapsulation types will be investigated when they are all enabled simultaneously.