Cisco ASA iPhone VPN Config

James — Tue, 07 Oct 2008 19:43:58 +0000

I recently purchased a shiny new iPhone 3G and wanted to be able to connect back to my house where I have a Cisco ASA 5505. I have noticed a lot of questions about how to get this to work, so here it is…

First, make sure you are running ASA Software version 8.0(3) or better. The previous versions have a bug when the iPhone connects that will boot all other users connected to the VPN.

On the ASA, we need to get the VPN configured. First, the ACLs for split-tunneling, no NAT and VPN access:

access-list RA_VPN_ACL extended permit ip any 172.30.30.0 255.255.255.0
access-list RA_VPN_SplitTunnel_ACL standard permit 172.25.25.0 255.255.255.0
access-list NoNAT_ACL extended permit ip 172.25.25.0 255.255.255.0 172.30.30.0 255.255.255.0
nat (inside) 0 access-list NoNAT_ACL

Since this config will authenticate to the local ASA, we need to have a username and password setup:

username iPhone password your_password

Now setup a DHCP pool for VPN clients:

ip local pool RA_VPN_POOL 172.30.30.100-172.30.30.200

Now create the crypto maps and apply them to the outside interface:

crypto ipsec transform-set RA_VPN_SET esp-aes esp-sha-hmac
crypto dynamic-map RA_VPN_MAP 1 match address RA_VPN_ACL
crypto dynamic-map RA_VPN_MAP 1 set transform-set RA_VPN_SET
crypto dynamic-map RA_VPN_MAP 1 set reverse-route
crypto map RA_VPN 65535 ipsec-isakmp dynamic RA_VPN_MAP
crypto map RA_VPN interface outside

Setup ISAKMP:

crypto isakmp enable outside
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20

Now create a remote access VPN policy. Make sure to add the split-dns value for your local domian. If you leave this out, the iPhone will not resolve DNS on the internal network!

group-policy RA_VPN_Policy internal
group-policy RA_VPN_Policy attributes
dns-server value DNS_Server_IP
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value RA_VPN_SplitTunnel_ACL
split-dns value domain.local

Add the tunnel-group to allow the VPN connection:

tunnel-group RA_VPN type ipsec-ra
tunnel-group RA_VPN general-attributes
address-pool RA_VPN_POOL
default-group-policy RA_VPN_Policy
tunnel-group RA_VPN ipsec-attributes
pre-shared-key your_password

Now to configure the iPhone. First, go to Settings -> General -> Network -> VPN. Then Add VPN Configuration. Select IPSec at the top and enter your information. The Server is the IP address or hostname of the ASA. The Account is the Username you created in the config above. The Group Name is the tunnel-group name created on the ASA.

To connect the VPN, go to Settings -> VPN (this appears after you create a VPN connection). Just change the option to ON.

Once you see the VPN icon on the top bar, you are connected!

Vista VPN to Cisco Pix devices

James — Fri, 05 Oct 2007 14:46:50 +0000

While trying to setup Vista to connect to new client’s network using a VPN, I kept running into problems and could not get it to connect. I was attempting to connect to a PPTP VPN on a Pix 500 series firewall. The error I kept getting was “Failed to connect to VPN Connection”. I tested the connection with XP and was able to connect without any issues.

Come to find out, Microsoft deprecated MSCHAP v1 from Vista! Vista only supports MSCHAP v2, CHAP, and PAP. Cisco does not support MSCHAP v2 in the 6.x line of software for the PIX. Unfortunately, I was connecting to a Pix 501 and did not have the option to upgrade to version 7.x software which does support MSCHAP v2.

Since the only option left is to use CHAP, I had reconfigured the VPN connection in Vista. To do this:

Go to Properties of the VPN connection

-> Security Tab

-> Select Advanced (custom settings)

-> Click Settings

-> Set Data encryption to optional

-> Then check CHAP under Allow these protocols

Now I am able to connect without any problems.

Please note that CHAP should not be considered secure. While it is better than PAP in that is uses encryption, it is only one-way and therefore should be used with caution.

jklogic.net » VPN

Cisco ASA iPhone VPN Config

Vista VPN to Cisco Pix devices