Cisco FirePOWER ASA 5500 series Configuration Manual page 565

Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
hostname(config-tunnel-ipsec)# chain
hostname(config-tunnel-ipsec)#
This attribute applies to all IPSec tunnel-group types.
Step 6 Specify the name of a trustpoint that identifies the certificate to be sent to the IKE peer:
hostname(config-tunnel-ipsec)# trust-point trust-point-name
hostname(config-tunnel-ipsec)#
The following command specifies mytrustpoint as the name of the certificate to be sent to the IKE peer:
hostname(config-ipsec)# trust-point mytrustpoint
Step 7 Specify the ISAKMP (IKE) keepalive threshold and the number of retries allowed.
hostname(config-tunnel-ipsec)# isakmp keepalive threshold <number> retry <number>
hostname(config-tunnel-ipsec)#
The threshold parameter specifies the number of seconds (10 through 3600) that the peer is allowed to
idle before beginning keepalive monitoring. The retry parameter is the interval (2 through 10 seconds)
between retries after a keepalive response has not been received. IKE keepalives are enabled by default.
To disable IKE keepalives, enter the no form of the isakmp command:
For example, the following command sets the IKE keepalive threshold value to 15 seconds and sets the
retry interval to 10 seconds:
hostname(config-tunnel-ipsec)# isakmp keepalive threshold 15 retry 10
hostname(config-tunnel-ipsec)#
The default value for the threshold parameter is 300 for remote-access and 10 for LAN-to-LAN, and the
default value for the retry parameter is 2.
To specify that the central site ("head end") should never initiate ISAKMP monitoring, enter the
following command:
hostname(config-tunnel-ipsec)# isakmp keepalive threshold infinite
hostname(config-tunnel-ipsec)#
Specify the ISAKMP hybrid authentication method, XAUTH or hybrid XAUTH.
Step 8
You use isakmp ikev1-user-authentication command to implement hybrid XAUTH authentication
when you need to use digital certificates for security appliance authentication and a different, legacy
method for remote VPN user authentication, such as RADIUS, TACACS+ or SecurID. Hybrid XAUTH
breaks phase 1 of IKE down into the following two steps, together called hybrid authentication:
The security appliance authenticates to the remote VPN user with standard public key techniques.
a.
This establishes an IKE security association that is unidirectionally authenticated.
An XAUTH exchange then authenticates the remote VPN user. This extended authentication can use
b.
one of the supported legacy authentication methods.
Note
You can use the isakmp ikev1-user-authentication command with the optional interface parameter to
specify a particular interface. When you omit the interface parameter, the command applies to all the
interfaces and serves as a back-up when the per-interface command is not specified. When there are two
isakmp ikev1-user-authentication commands specified for a tunnel group, and one uses the interface
parameter and one does not, the one specifying the interface takes precedence for that particular
interface.
OL-10088-01
Before the authentication type can be set to hybrid, you must configure the authentication server,
create a preshared key, and configure a trustpoint.
Cisco Security Appliance Command Line Configuration Guide
Configuring Tunnel Groups
30-11