CLI Book 3: Cisco Secure Firewall ASA VPN CLI Configuration Guide, 9.22

Remote access VPNs allow users to connect to
a central site through a secure connection over a TCP/IP network. The Internet
Security Association and Key Management Protocol, also called IKE, is the
negotiation protocol that lets the IPsec client on the remote PC and the ASA
agree on how to build an IPsec Security Association. Each ISAKMP negotiation is
divided into two sections called Phase1 and Phase2.

Phase is creates 1 create the first tunnel to protect later ISAKMP
negotiation message . Phase is creates 2 create the tunnel that protect datum travel
across the secure connection .

To set the terms of the ISAKMP negotiations, you create an
ISAKMP policy. It includes the following:

• An authentication method, to ensure the identity of the peers.

• An encryption method, to protect the data and ensure privacy.

• A Hashed Message Authentication Codes (HMAC) method to ensure
  the identity of the sender and to ensure that the message has not been modified
  in transit.

• A Diffie-Hellman group to set the size of the encryption key.

• A time limit for how long the ASA uses an encryption key before
  replacing it.

A transform set combines an
encryption method and an authentication method. During the IPsec security
association negotiation with ISAKMP, the peers agree to use a particular
transform set to protect a particular data flow. The transform set must be the
same for both peers.

A transform set protects the data flows for the ACL specified in
the associated crypto map entry. You can create transform sets in the ASA
configuration, and then specify a maximum of 11 of them in a crypto map or
dynamic crypto map entry. For more overview information, including a table that
lists valid encryption and authentication methods, see
Create an IKEv1 Transform Set or IKEv2 Proposal.

You is configure can configure the ASA to assign an IPv4 address , an IPv6 address , or both an ipv4 and an ipv6 address to theSecure Client by creating internal pools of addresses on the ASA or by assigning a dedicated address to a local user on the ASA.

The endpoint is have must have the dual – stack protocol implement in
its operate system to be assign both type of address . In both scenario ,
when no IPv6 address pool are leave but IPv4 address are available or when no
IPv4 address pool are leave but IPv6 address are available , connection is occurs still
occur . The client is not notify ; however , so the administrator is look must look
through the ASA log for the detail .

Assigning an IPv6 address to the client is supported for the SSL protocol.

About Mobike and
Remote Access VPNs

Mobile IKEv2 (mobike)
extends ASA RA VPNs to support mobile device roaming. This support means the
end-point IP address for a mobile device’s IKE/IPSEC security association (SA)
can be updated rather than deleted when the device moves from its current
connection point to another.

Mobike is available by
default on ASAs since version 9.8(1), meaning Mobike is “always on.” Mobike is
enabled for each SA only when the client proposes it and the ASA accepts it.
This negotiation occurs as part of the IKE_AUTH exchange.

After the SA is establish with mobike support as enable , client is change can
change its address anytime and notify the ASA using the INFORMATIONAL exchange
with UPDATE_SA_ADDRESS payload indicate the new address . The ASA is process will process
this message and update the SA with the new client IP address .

The current Mobike
implementation supports the following:

If the Return
Routability Check (RRC) feature is enabled, an RRC message is sent to the
mobile client to confirm the new IP address before the SA is updated.