1. Phase 1:

1.1 IKE Setup

An example of a IKE setup is as follows.  You can have many versions of the policies, each is numbered (this one is numbered "2"), and the lower the number the higher the priority (first) to be used or matched against.


Review of the IKE commands are

• Encryption method: aes, ase-192, aes-256, des, or 3des.  "des" is not used anymore as it has already been hacked.
• Hash algorithm: md5, or sha.  
• Authentication method is pre-share, crack, or rsa-sig  
• diffie-helman group identifier can be 1, 2 or 5.  group 1 has been cracked and should not be used anymore.  
• The SA lifetime (in seconds), with the default of 1 day (86400 seconds)

• Enabling the firewall to listen to ISAKMP traffic on the outside interface
• The peer identity method could be address, hostname, key-id, id-string, or auto.
• "NAT-T lets IPsec peers establish a connection through a NAT device. It does this by encapsulating IPsec traffic in UDP datagrams, using port 4500, thereby providing NAT devices with port information. NAT-T auto-detects any NAT devices, and only encapsulates IPsec traffic when necessary. This feature is disabled by default." The keep alive range is from 10 to 3600 seconds with the default being 20 seconds.  
• You can ensure that clients are alerted to being disconnected with the disconnect-notify command. 

1.3 Create the Crypto Transform Sets:

3.4 IPSEC Client Setup

• You can optionally include an acl, to define what traffic should be encrypted or not
• Define what transform sets are allowed on this dynamic crypto map
• you can optionally define the max life of the SA.  this is either in seconds or in kilobytes.
• You can also optionally ask for PFS when requesting new SA's.  PFS types are group1, group2, group5 and group7. (In IPsec negotiations, Perfect Forward Secrecy (PFS) ensures that each new cryptographic key is unrelated to any previous key. Either enable or disable PFS on both the tunnel peers, otherwise the L2L IPsec tunnel is not established in PIX/ASA.)
• create a static crypto map (mymap200) and refernce the the dynamic map (dyn1)
  

3.5 Object Group

3.6 VPN Pool

3.7 Access List for Accounts:

3.8 Access List for VPN Policy:

3.9 Group Policy

3.10 Tunnel Group

3.11 User Accounts

3.12 Double Nat Statements for VPN Pool

3.3.x Viewing the Pre shared key in the config file

Normaly if you do a sh run, you will only view the stared out version of the keys. 

To see the keys, you need to view the config with the "more system" command:

3.4 Cisco Client Setup:

(what do you enter where in the client software)

3.5 Debugging

3.5.1 Monitoring VPN Sessions

3.5.2 Monitoring SSH Sessions

References:

• Cisco ASA 5500 Series Command Reference, 8.3   
  
• Cisco ASA 5500 Series Configuration Guide using the CLI, 8.3   
  
•