Configuring the FlexVPN Server

The FlexVPN server supports peer authentication using the Extensible Authentication protocol (EAP) and acts as a pass-through authenticator relaying EAP messages between the client and the backend EAP server. The backend EAP server is typically a RADIUS server that supports EAP authentication.

Note	While a FlexVPN client authenticates the FlexVPN client using EAP, the FlexVPN server must authenticate the FlexVPN server by using certificates.

The FlexVPN server is configured to authenticate FlexVPN clients that use EAP by configuring the authentication remote eap command in IKEv2 profile configuration mode. FlexVPN clients authenticate using EAP by skipping the AUTH payload in the IKE_AUTH request.

If the query-identity keyword is configured, the FlexVPN server queries the EAP identity from the client; otherwise, the FlexVPN client's IKEv2 identity is used as the EAP identity. However, if the query-identity keyword is not configured and the FlexVPN client's IKEv2 identity is an IPv4 or IPv6 address, the session is terminated because IP addresses cannot be used as the EAP identity.

The FlexVPN server starts the EAP authentication by passing the FlexVPN client's EAP identity to the EAP server; the FlexVPN server then relays EAP messages between the remote access (RA) client and the EAP server until the authentication is complete. If the authentication succeeds, the EAP server is expected to return the authenticated EAP identity to the FlexVPN server in the EAP success message.

After EAP authentication, the EAP identity used for the IKEv2 configuration is obtained from the following sources in the given order:

• The EAP identity provided by the EAP server with the EAP success message.
• The EAP identity queried from the client when the query-identity keyword is configured.
• The FlexVPN client IKEv2 identity used as the EAP identity.

The figure below shows IKEv2 exchange for EAP authentication without the query-identity keyword.

Figure 1

IKEv2 Exchange Without the query-identity Keyword

The figure below shows the IKEv2 exchange for EAP authentication with the query-identity keyword.

Figure 2

IKEv2 Exchange with the query-identity Keyword

The IKEv2 name mangler is used to derive the username for IKEv2 authorization and obtain the AAA preshared key from the peer IKE identity.

IKEv2 authorization provides a policy for an authenticated session by using the AAA. The policy can be defined locally or on the RADIUS server, and contains local and/or remote attributes. The username for authorization can either be derived from the peer identity using the name-mangler keyword or be directly specified in the command. IKEv2 authorization is mandatory only if the peer requests an IP address via configuration mode.

IKEv2 authorization types are as follows:

• User authorization--Use the aaa authorization user command in the IKEv2 profile to enable user authorization. User authorization is based on the user-specific portion of the peer IKE identity such as fqdn-hostname. The attributes from user authorization are called user attributes.
• Group authorization--Use the aaa authorization group command in the IKEv2 profile to enable group authorization. Group authorization is based on the generic portion of the peer IKE identity such as fqdn-domain. The attributes from group authorization are called group attributes.
• Implicit user authorization--Use the aaa authorization user cached command in the IKEv2 profile to enable implicit user authorization. Implicit authorization is performed as part of EAP authentication or when obtaining the AAA preshared key. The attributes from implicit user authorization are called cached attributes.

Note	Depending on your release, the aaa authorization user cached command may or may not be available. Explicit user authorization is performed only when implicit user authorization does not return any attributes or does not have the Framed-IP-Address attribute.

An IKEv2 authorization policy defines the local authorization policy and contains local and/or remote attributes. Local attributes, such as VPN routing and forwarding (VRF) and the QOS policy, are applied locally. Remote attributes, such as routes, are pushed to the peer via the configuration mode. Use the crypto ikev2 authorization policy command to define the local policy. The IKEv2 authorization policy is referred from the IKEv2 profile via the aaa authorization command.

IKEv2 configuration mode allows IKE peers to exchange configuration information such as IP addresses and routes. The configuration information is obtained from IKEv2 authorization. Both pull and push models are supported. The pull model involves the exchange of configuration requests and replies; the push model involves the exchange of configuration sets and acknowledgements.

The following table describes the conditions when the initiator and the responder send different configuration payload types:

Note	The commands to send configuration requests and configuration set payloads are enabled by default.

Depending on your release, the IKEv2 initiator can trigger a configuration mode when the initiator is a FlexVPN client, or any static tunnel interface initiating IKEv2 can trigger configuration mode by enabling the config-mode command in the IKEv2 profile.

The IKEv2 FlexVPN server supports the following standard IPv4 configuration attributes:

• INTERNAL_IP4_ADDRESS
• INTERNAL_IP4_NETMASK
• INTERNAL_IP4_DNS
• INTERNAL_IP4_NBNS
• INTERNAL_IP4_SUBNET

The IKEv2 FlexVPN server supports the following standard IPv6 configuration attributes:

• INTERNAL_IP6_ADDRESS
• INTERNAL_IP6_DNS
• INTERNAL_IP6_SUBNET

Note	IPv6 configuration attributes are only supported by the Microsoft Windows IKEv2 client.

The INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET configuration attributes, controlled by the route set and aaa attribute list commands in the IKEv2 authorization policy, are not supported when you configure a static virtual tunnel interface (SVTI)-to-SVTI tunnel. In such cases, static routing or dynamic routing must be used instead of the IKEv2-based route exchange.

The IKEv2 FlexVPN server supports the following standard common configuration attribute:

• APPLICATION_VERSION

  Note	This attribute is only sent for Cisco Anyconnect and FlexVPN clients.

The IKEv2 FlexVPN server supports the following Cisco Unity configuration attributes:

• MODECFG_BANNER
• MODECFG_DEFDOMAIN
• MODECFG_SPLITDNS_NAME
• MODECFG_BACKUPSERVERS
• MODECFG_PFS
• MODECFG_INCLUDE_LOCAL_LAN
• MODECFG_SMARTCARD_REMOVAL_DISCONNECT

Note	The Cisco Unity attributes are sent only for Cisco Anyconnect and FlexVPN clients.

The IKEv2 FlexVPN server supports the following Cisco FlexVPN configuration attributes:

• MODECFG_CONFIG_URL
• MODECFG_CONFIG_VERSION

Note	The Cisco FlexVPN attributes are sent only for Cisco FlexVPN clients.

The INTERNAL_IP4_ADDRESS attribute value is derived from the following sources in the given order:

• The Framed-IP-Address attribute received in AAA user authorization.
• The local IP address pool.
• The DHCP server.

The DHCP server, if configured, allocates addresses only if the local IP address pool is not configured. However, if an error occurs when allocating IP addresses from the local pool, the next address source DHCP server is not used for allocating the addresses.

The value for INTERNAL_IP4_NETMASK attribute is derived as follows:

• If the IP address is obtained from the DHCP server, the netmask is also obtained from the DHCP server.
• If the IP address is obtained from either the Framed-IP-Address attribute in AAA user authorization or the local IP address pool, the netmask is derived from the IPv4 netmask attribute received in the user or group authorization. If the netmask is not available, the INTERNAL_IP4_NETMASK attribute is not included in the configuration reply. If the netmask is available, the INTERNAL_IP4_NETMASK attribute is included only if the INTERNAL_IP4_ADDRESS attribute is included in the configuration reply.

An IPv4 address is allocated and included in the reply only if the client requests an address. If the client requests multiple IPv4 addresses, only one IPv4 address is sent in the reply. If available, the remaining attributes are included in the reply even though the client does not request them. If the client requests an IPv4 address and the FlexVPN server is unable to assign an address, an INTERNAL_ADDRESS_FAILURE message is returned to the client.

The IKEv2 Multi-SA feature allows an IKEv2 Dynamic Virtual Tunnel Interface (DVTI) session on the IKEv2 responder to support multiple IPsec Security Associations (SA). The maximum number of IPsec SAs per DVTI session is either obtained from AAA authorization or configured on the IPsec profile. The value from AAA has a higher priority. Any change to the max-flow-limit argument in the IPsec profile is not applied to the current session but is applied to subsequent sessions. The IKEv2 Multi-SA feature makes the configuration of the IKEv2 profile in the IPsec profile optional. This optional configuration allows IPsec DVTI sessions using the same virtual template to have different IKEv2 profiles, thus saving the number of virtual template configurations.

Note	The IKEv2 Multi-SA feature allows multiple IPsec SAs that have non-any-any proxies. However, when the IPsec SA proxies are any-any, a single IPsec SA is allowed.

For more information, see the "Multi-SA Support for Dynamic Virtual Tunnel Interfaces for IKEv2" module.

The following tables list the RADIUS attributes supported by the IKEv2 FlexVPN server:

• The Scope field defines the direction of the attribute and the usage on the FlexVPN server or client.
  • Inbound--FlexVPN server to RADIUS
  • Outbound--RADIUS to the FlexVPN server
  • Local--Used locally by the FlexVPN server
  • Remote--Pushed to the client by the FlexVPN server
• The "Local configuration" field specifies the IKEv2 authorization policy command that is used to configure the attribute locally on the FlexVPN server.
• Cisco AV Pair is a Cisco Vendor Specific Attribute (VSA) with vendor-id 9 and vendor-type 1. The VSAs are encapsulated in the Radius IETF attribute 26 Vendor-Specific. The Cisco AV pair is specified as a string of format "protocol:attribute=value".

cisco-avpair = "ipsec:ipv6-addr-pool=v6-pool"	 

Effective with Cisco IOS Release 15.2(2)T, the following changes were made:

• The Cisco AV Pair ipsec:route-set=access-list replaced ipsec:inacl.
• The Cisco AV pair ipsec:route-set=access-list ipv6 replaced ipsec:ipv6-subnet-acl.
• The Cisco AV pair ipsec:route-set=interface replaced ipsec:route-set-interface.
• The Cisco AV pair ipsec:route-accept=any replaced ipsec:route-accept=accept acl:any.
• The Cisco AV pair ipsec:route-accept=none replaced ipsec:route-accept=deny.
• The Cisco AV pair ipsec:route-set=prefix prefix/length was introduced.

The FlexVPN server interoperates with the Microsoft Windows7 IKEv2 client, Cisco IKEv2 AnyConnect client, and Cisco FlexVPN client.

• Microsoft Windows7 IKEv2 Client
• Cisco IKEv2 AnyConnect Client

1.    enable

2.    configure terminal

3.    crypto ikev2 profile profile-name

4.    aaa authentication eap list-name

5.    authentication {local {rsa-sig | pre-share | ecdsa-sig | eap} | remote {eap [query-identity | timeout seconds] | rsa-sig | pre-share | ecdsa-sig}}

6.    Execute both or one of the following:

7.    Execute both or one of the following:

8.   config-exchange {request | set {accept | send}}

9.    end

1.    enable

2.    configure terminal

3.    crypto ikev2 name-mangler mangler-name

4.    dn {common-name | country | domain | locality | organization | organization-unit | state}

5.    eap {all | dn {common-name | country | domain | locality | organization | organization-unit | state} | prefix | suffix {delimiter {. | @ | \}}}

6.    email {all | domain | username}

7.    fqdn {all | domain | hostname}

8.    end

1.    enable

2.    configure terminal

3.    crypto ikev2 authorization policy policy-name

4.   aaa attribute list list-name

5.   backup-gateway string

6.   banner banner-text

7.   configuration url url

8.   configuration version version

9.   def-domain domain-name

10.    dhcp {giaddr ip-address | server {ip-address | hostname} | timeout seconds}

11.    [ipv6] dns primary-server [secondary-server]

12.   include-local-lan

13.   ipsec flow-limit number

14.    netmask mask

15.   pfs

16.    [ipv6] pool name

17.   route set {interface | access-list {access-list-name | access-list-number | expanded-access-list-number | ipv6 access-list-name}}

18.   route accept any [tag value] [distance value]

19.   smartcard-removal-disconnect

20.   split-dns string

21.    route set access-list {acl-number | [ipv6] acl-name}

22.    wins primary-server [secondary-server]

23.    end

• Example: Configuring the FlexVPN Server to Authenticate Peers Using EAP
• Example: Configuring the FlexVPN Server for Group Authorization (External AAA)
• Example: Configuring the FlexVPN Server for Group Authorization (Local AAA)
• Example: Configuring the FlexVPN Server for User Authorization
• Example: Configuring the FlexVPN Server for IPv6 Session with IPv6 Configuration Attributes