This document outlines the 5 steps to set up an IKEv2 VPN with EAP-TLS authentication between an ASA and Cisco ISE for remote access VPN: 1. Arrange certificates on the user PC, ASA, and ISE 2. Configure the ASA with group policies, tunnel settings, and to authenticate with ISE 3. Configure ISE with the root CA certificate and RADIUS settings 4. Install the user certificate and trusted root CA on the VPN client 5. Verify the VPN connection between the client and ASA via ISE authentication

1. RAVPN EAP-IKEv2 VPN
Windows VPN Client
By Dhruv Sharma

2. Introduction
In this session we will understand how to setup our ASA for IKEv2 VPN with EAP TLS authentication
for Remote Access VPN.

3. Introduction
Objective can be achieved in just 5 simple steps:
• Step 1: Arrange the certificates
• Step 2: Setup ASA
• Step 3: Setup ISE
• Step 4: Setup VPN Client
• Step 5: Verify Connection

4. Topology

5. Step 1 of 5: Arrange the Certificates
User Authentication ASA Authentication Cisco ISE
Windows VPN allows EAP-TLS Cert
based authentication for VPN. Thus,
we need to request a CA to issue a
certificate for a user.
• A certificate with private key
must be installed into the User PC
• Trusted Root CA certificate must
be added with its issuer.
Only Identity Certificate must be
installed into ASA, which binds
to the external interface facing
internet.
Root CA certificate must be
installed into ISE. This is the
CA certificate used to issue
the User cert for User
authentication.

6. Step 1.1 of 5: Arrange the Certificates -PC

7. Step 1.2 of 5: Arrange the Certificates -ISE

8. Step 2.1 of 5: Setup ASA
group-policy cisco_ops_vpn_group_policy internal
group-policy cisco_ops_vpn_group_policy attributes
dns-server value 12.12.12.50
vpn-simultaneous-logins 5
vpn-tunnel-protocol ikev2
pfs enable
default-domain value cisco.com
address-pools value sales
group-policy nbs_ops_vpn_group_policy internal
group-policy nbs_ops_vpn_group_policy attributes
dns-server value 12.12.12.50
vpn-simultaneous-logins 5
vpn-tunnel-protocol ikev2
pfs enable
default-domain value cisco.com
address-pools value sales

9. Step 2.2 of 5: Setup ASA
tunnel-group DefaultRAGroup general-attributes
authentication-server-group ISE
authorization-required
tunnel-group DefaultRAGroup webvpn-attributes
authentication certificate
group-alias DefaultRAGroup enable
tunnel-group DefaultRAGroup ipsec-attributes
peer-id-validate cert
chain
ikev2 remote-authentication eap query-identity
ikev2 local-authentication certificate vpn2.cisco.com
!
aaa-server ISE protocol radius
interim-accounting-update
aaa-server ISE (management) host 192.168.111.12
key cisco
!

10. Step 2.3 of 5: Setup ASA
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400
!
crypto ikev2 enable outside
crypto ikev2 remote-access trustpoint vpn2.cisco.com
!
crypto ipsec ikev2 ipsec-proposal RA
protocol esp encryption aes-256
protocol esp integrity sha-256 sha-1
!

11. Step 2.4 of 5: Setup ASA
!
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group24
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal RA
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set reverse-route
!
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group24
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES RA
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set reverse-route
!
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
!

12. Step 3.1 of 5: Setup ISE

13. Step 3.2 of 5: Setup ISE

14. Step 3.2 of 5: Setup ISE

15. Step 4.1 of 5: Setup VPN Client

16. Step 4.3 of 5: Setup VPN Client

17. Step 4.2 of 5: Setup VPN Client

18. Step 5 of 5: Verify Connection

19. Step 5 of 5: Verify Connection

20. Lab Time