You may recall that when we were
configuring the site‑to‑site VPNs, we
created crypto maps, and as a security
mechanism, ASAs will only allow
connections from any addresses specified
in the crypto maps. Now the issue we have
is that remote access clients can come
from any address on the internet.
Therefore, we need to use dynamic crypto
maps to allow any IP address to connect.
In addition to this, dynamic crypto maps
also tell the ASA which IPSec proposal
should be used. We can also add
reverse‑route to the dynamic crypto map.
This basically places a route in the
routing table, which can then be
advertised to IGPs so that routers inside
the network know how to reach the VPN
clients. So our VPN clients will be using
dynamic addresses. It's very rare you'd
have a VPN client with a static IP
address. To allow this, we need to create
a dynamic crypto map. So in
ACME‑HQ‑ASA‑06, we need to create an
access list with IP any any. We then need
to create a dynamic crypto map. We should
assign the access list we've just created.
Then we should set which IPSec proposal to
use. That's the proposal we just created
in the last clip. Then we need to make
sure that the VPN pool is added to the
routing table by using the reverse‑route
option. Then we need to create a crypto
map and add the dynamic crypto map to the
crypto map. Then we need to add the crypto
map to the outside interface. So let's
jump on our ASA. So Let's start with our
access list. And if we say access list,
and we'll call this one ALL_ACL, and we'll
say extended permit, and we'd say ip then
any4 to any4. So what this basically is
saying is any IP version 4 address to any
IP version 4 address. So now we need to
create the dynamic crypto map. And let's
just clear our screen for this, and we
start by saying crypto. Then we would say
dynamic‑map. And we'll call this
ACME‑DYM‑MAP. Then we need to specify a
sequence number. We'll just say number 1.
Then we'd say match address and the access
list we've just created, which is ALL_ACL.
Then we need to add the IPSec proposal. So
if we just press up, and we'll get rid of
the match address, and we'd say set ikev2
ipsec‑proposal, and the name of the
proposal we created was ACME‑IPSEC‑PROP.
Then, finally, we had to set reverse‑route
so the pool is advertised into the routing
table. So we just get rid of ipsec‑
proposal. And we just need to say
reverse‑route. So now we've created the
dynamic crypto map, we need to create the
crypto map itself, and then we need to add
the dynamic crypto map to it. Okay, so we
start off with crypto and then say map.
Then we need to give it a name, and we'll
call it ACME‑CRYPTO‑MAP. Then we need to
give it a sequence number, and we'll say
number 1. Then we say ipsec‑isakmp, then
dynamic for the dynamic crypto map, and
the name of the map was ACME‑DYM‑MAP.
Then, finally, we need to assign it to the
outside interface. So if I go up, and
let's just get rid of the ipsec and 1, and
then we just say interface, and the
interface was INTERNET. Okay, that's it.
So let's clear the screen and say sh run
crypto map and dynamic‑map. Perfect! So
now we've created our dynamic map and our
crypto map, our next task is to create a
group policy, and this is what we're going to do in our next clip.