!— Configure the outside and inside interfaces.

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.20.20.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.22.1.1 255.255.255.0
!
!

!— This access list is used for a nat zero command that prevents
!— traffic which matches the access list from undergoing
!— network address translation (NAT).

access-list no-nat extended permit ip 172.22.1.0 255.255.255.0 172.16.1.0 255.255.255.0

!— This access list is used to define the traffic
!— that should pass through the tunnel.
!— It is bound to the group policy which defines
!— a dynamic crypto map.

access-list ezvpn1 extended permit ip 172.22.1.0 255.255.255.0 172.16.1.0 255.255.255.0
!
!

!— Specify the NAT configuration.
!— NAT 0 prevents NAT for the ACL defined in this configuration.
!— The nat 1 command specifies NAT for all other traffic.

global (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 10.20.20.2 1
!
!

!— This defines the group policy you use with EasyVPN.
!— Specify the networks
!— that should pass through the tunnel and that you want to
!— use network extension mode.

group-policy myGROUP internal
group-policy myGROUP attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ezvpn1
nem enable
webvpn

!— Here the username and password associated with
!— this VPN connection are defined.  You
!— can also use AAA for this function.

username cisco password 3USUcOPFUiMCO4Jk encrypted
!
!

!— PHASE 2 CONFIGURATION —!
!— The encryption types for Phase 2 are defined here.
!— A single DES encryption with
!— the md5 hash algorithm is used.

crypto ipsec transform-set mySET esp-des esp-md5-hmac

!— Defines a dynamic crypto map with
!— the specified encryption settings.

crypto dynamic-map myDYN-MAP 5 set transform-set mySET

!— Binds the dynamic map to the IPsec/ISAKMP process.

crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP

!— Specifies the interface to be used with
!— the settings defined in this configuration.

crypto map myMAP interface outside

!— PHASE 1 CONFIGURATION —
!— This configuration uses isakmp policy 1.
!— The configuration commands here define the Phase
!— 1 policies that are used.

isakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400

!— The tunnel-group commands bind the configurations
!— defined in this configuration to the tunnel that is
!— used for EasyVPN.  This tunnel name is the one specified on the remote side.
!— defined in this configuration to the tunnel that is
!— used for EasyVPN.  This tunnel name is the one specified on the remote side.

tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
!
— The pre-shared-key used here is “cisco”.

pre-shared-key *

Easy VPN Remote Hardware Client :

PIX Version 6.3(5)

!— Brings the interfaces out of a shutdown state.

interface ethernet0 auto
interface ethernet1 auto

!— Assign the interface names.

nameif ethernet0 outside security0
nameif ethernet1 inside security100!
!

!— Assign the interface IP addresses.

ip address outside 10.10.10.1 255.255.255.0
ip address inside 172.16.1.1 255.255.255.0
!
!— Set the standard NAT configuration.
!— EasyVPN  provides the NAT exceptions needed.

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
!
!— Specify the default route.

route outside 0.0.0.0 0.0.0.0 10.10.10.2 1
!

!— EasyVPN Client Configuration —
!— Specify the IP address of the VPN server.

vpnclient server 10.20.20.1

!— This example uses network extension mode.

vpnclient mode network-extension-mode

!— Specify the group name and the pre-shared key.

vpnclient vpngroup mytunnel password ********

!— Specify the authentication username and password.

vpnclient username cisco password ********

!—- After you issue this command, the tunnel is established.

Summary :

ASA :

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.20.20.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.22.1.1 255.255.255.0
!
access-list no-nat extended permit ip 172.22.1.0 255.255.255.0 172.16.1.0 255.255.255.0
!
access-list ezvpn1 extended permit ip 172.22.1.0 255.255.255.0 172.16.1.0 255.255.255.0
!
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 10.20.20.2 1
!
group-policy myGROUP internal
group-policy myGROUP attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ezvpn1
nem enable
webvpn
!
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto dynamic-map myDYN-MAP 5 set transform-set mySET
crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
crypto map myMAP interface outside
!
isakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
!
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
pre-shared-key *

PIX Client : Easy VPN Client :

interface ethernet0 auto
interface ethernet1 auto
!
nameif ethernet0 outside security0
nameif ethernet1 inside security100
!
ip address outside 10.10.10.1 255.255.255.0
ip address inside 172.16.1.1 255.255.255.0
!
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
!
route outside 0.0.0.0 0.0.0.0 10.10.10.2 1
!
vpnclient server 10.20.20.1
vpnclient mode network-extension-mode
vpnclient vpngroup mytunnel password ********
vpnclient username cisco password ********

!—- After you issue this command, the tunnel is established.