Easy VPN with Hardware client, NEM enabled, auto connect:-

Easy VPN SERVER (Cisco ASA 5520):-

• NAT is required between the encryption domains if NAT/PAT is present on the outside interface.
• ACL for split-tunnel (if required)
• ISAKMP policy and IPsec transform-set
• Dynamic-map and crypto-map
• Group-policy attributes (nem enabled)
• Tunnel-group (xauth is the default authentication in ASA, disable it if the client connects automatically)

nat (inside,outside) source static 4.4.4.4 4.4.4.4 destination static 11.11.11.11 11.11.11.11 no-proxy-arp route-lookup
!
access-list splitacl1 standard permit host 4.4.4.4 
!
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
!
crypto ipsec ikev1 transform-set esp-3des esp-3des esp-sha-hmac 
!
crypto dynamic-map dyn-map 10 set ikev1 transform-set esp-3des
crypto dynamic-map dyn-map 10 set reverse-route
crypto map outmap 100 ipsec-isakmp dynamic dyn-map
crypto map outmap interface outside
!
group-policy r1policy internal
group-policy r1policy attributes
 group-lock value R1
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value splitacl1
 nem enable
!
tunnel-group R1 type remote-access
tunnel-group R1 general-attributes
 default-group-policy r1policy
tunnel-group R1 ipsec-attributes
 ikev1 pre-shared-key *****
 ikev1 user-authentication none

Easy VPN Hardware CLIENT (Cisco 1760 router):-

• crypto ipsec client ezvpn HQVPN – configure the client setting under this command
• connect auto – always on connection. No authentication required by the HW client
• group R1 key ciscor1 – Tunnel-group and pre-shared key configured on the EZ VPN server
• local-address – the IP address that is advertised to the server. The intermediary routers should have a route to this IP address. Example; if the local-address is a loopback IP address on the hardware client the intermediary routers should have a route for the loopback IP.
• mode – network-extension (Extended LAN, similar to a Site-to-Site VPN)
• peer – IP of the EZ VPN server

crypto ipsec client ezvpn HQ
 connect auto
 group R1 key *******
 local-address Loopback1
 mode network-extension
 peer 10.1.111.1
 xauth userid mode interactive
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
 crypto ipsec client ezvpn HQ inside
!
interface Loopback1
 ip address 111.111.111.111 255.255.255.255
 crypto ipsec client ezvpn HQ inside
!
interface FastEthernet0/0
 ip address 10.1.101.1 255.255.255.0
 speed auto
 crypto ipsec client ezvpn HQ outside

Verification:-

ASA1# show crypto isakmp sa
IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 111.111.111.111
Type : user Role : responder 
Rekey : no State : AM_ACTIVE


R1# show crypto ipsec client ezvpn 
Easy VPN Remote Phase: 4
Tunnel name : HQ
Inside interface list: Loopback0
Outside interface: FastEthernet0/0 
Current State: IPSEC_ACTIVE
Last Event: SOCKET_UP
Save Password: Disallowed
Split Tunnel List: 1
 Address : 4.4.4.4
 Mask : 255.255.255.255
 Protocol : 0x0
 Source Port: 0
 Dest Port : 0
Current EzVPN Peer: 10.1.111.1
R1#show crypto isakmp sa
dst src state conn-id slot status
10.1.111.1 111.111.111.111 QM_IDLE 5 0 ACTIVE

Bookmark to follow my CCIE Security v4 journey -> https://networkology.net/ccie-security/