How do I setup Cisco ASA 5505 for Client VPN through CLI ?

Zones:
Virtual Private Networking (VPN), Networking Hardware Firewalls
Tags:
Setup of Cisco ASA 5505 VPN Remote Access
I am fairly familiar with these devices, but I use the ASA's ASDM pretty exclusively for setting up them up.
My problem is that the VPN wizard is hit or miss at best. Lately I'm running into issues with creating VPN's
that either won't attach, or won't talk to the inside interface from the VPN Pool (created on a different
subnet).

Can someone post a step by step CLI setup of a client access VPN? Ideally it would include some info on
what each line does if its not intuitive? ( I'm looking to understand the setup not just regurgitate the
commands.)

Thanks

Rank: Master
bignewf:
Here is a sample CLI config right from cisco:

Enable ISAKMP on ouside interface of ASA:

Asa#(config t)
Asa(config)# isakmp enable outside

Create ISAKMP Policy:

Asa#config t
Asa(config)#isakmp policy 10 authentication pre-share
Asa(config)# isakmp policy 10 encryption aes-25
Asa(config)# isakmp policy 10 hash sha
Asa(config)# isakmp policy 10 group 2
Asa(config)#isakmp policy 10 lifetime 86400

Configure Remote Access-Attributes for Default and User group-policy

asa(config)# group policy DfltGrpPolicy attributes

asa (config -group-policy)# vpn-simultaneous-logins 3

asa (config -group-policy)# ip-comp enable

Configuration of Group-Specific Group Policy

asa(config)# group-policy MYCompany internal
asa(config)# group-policy MyCompany attributes
asa(config-group-policy) default-domain value MyCompany.com

Config of User Policy here a user accound is mapped to the user group policy in the previous config above:

asa(config)# username vpnuser password cisco

asa(config)# username vpnuser attributes

asa(config-username)# vpn-group-policy-MyCompany

Define your Tunnel Type:

asa(config)# tunnel-group cisco type ipsec-ra

This the tunnel group name that needs to be configured on the cisco vpn client

Configure the ISAKMP Preshared Keys

asa(config)# tunnel-group cisco ipsec-attributes

as(config-ipsec)# pre-shared-key cisco123

This pre-shared key is also known as the group password in the Cisco remote access VPN
All cisco vpn clients that are configured for the tunnel group cisco must use the preshared key cisco123indicated
above

Configuring local user accounts:

asa(config)# username test password cisco123

asa(config)# username Joe password cisco999
These accounts would be in the local database on the ASA. However, you can use RADIUS, Windows NT
domain, Kerveros, SDI
for authentication also
If you use local authentication, then the tunnel-group must be configured with an authentication server, under
general attributes. The authentication-server-group subcommand specifies the authentication server.

asa(config)# tunnel-group cisco general-attributes

asa(config-group-plicy)# authentication-server-group LOCAL

Now, you must assign ip addresses to the vpn clients:

Using the appliance itself with a local address pool:

asa(config)# vpn-addr-assig local

asa(config)# ip local pool vpnremotepool 192.168.3.100-192.168.3.150

(not: this pool should be on a different subnet than your internal lans hosts)

For ip addresses from a dhcp server:

asa(config)#vpn-addr-assign dhcp
asa(config)#tunnel-group cisco general-attributes
asa(config-general)#dhcp-server 192.168.1.1

Define your IPSec Policy:

asa(config)# crypto ipsec transfore-set myset esp-aes-256 esp-sha-hmac (the transform set specifies the
encryption and hashing method used on the data packets once the tunnel is up)

Set up Dynamic Crypto Map:

asa(config)#crypto map IPSec_map 65535 ipsec-isakmp dynamic dynmap

Apply the crypto map to an interface - Outside interface:

asa(config)#crypto map IPSec_map interface outside

You must allow decrypted traffic to pass thru the asa. The correct way to do this would be to restrict traffic to
pass, but initially to get this working, I would allow all decrypted IPSec packets to pass without inspecting them
agianst the configured ACL's:

asa(config)#sysopt connection permit-ipsec

Finally, You need to create a connection entry on the cisco vpn client with the group authentication name, group
preshared key, and type of tunnel encapsulation