conf t

First define the new CA.

ip http server
 
crypto pki server ca-server
 database level names
 no database archive
 hash sha512
 lifetime certificate 3650
 lifetime ca-certificate 7305 23 59
 eku server-auth client-auth
 auto-rollover 365
 database url flash:ca
 exit

Now we have a CA operating, we need to generate a certificate for our router to identify itself to clients.

crypto key generate rsa general modulus 2048 exportable label ca-server
do crypto pki server ca-server start
 
crypto key generate rsa general modulus 2048 exportable label router
 
crypto pki trustpoint router
 enrollment url http://<ip address>:80
 ip-address <ip address>
 fqdn <DNS entry pointing to router>
 subject-name CN=<site name>,OU=user-vpn,O=<company name>
 revocation-check crl
 rsakeypair router
 auto-enroll regenerate
 hash sha512
 exit
 
crypto pki authenticate router
crypto pki enroll router

The certificate server should now have a pending request.

do show crypto pki server ca-server requests
do crypto pki server ca-server grant <request number>

The request number is often 1

crypto key generate rsa general modulus 2048 exportable label anyconnect
 
crypto pki trustpoint anyconnect
 enrollment url http://<ip address>:80
 serial-number none
 fqdn none
 ip-address none
 subject-name CN=<site name>,OU=user-vpn,O=<company name>
 revocation-check none
 rsakeypair anyconnect
 
crypto pki authenticate anyconnect
crypto pki enroll anyconnect

The certificate server should now have a pending request.

do show crypto pki server ca-server requests
do crypto pki server ca-server grant <request number>

The request number is often 1

crypto pki export anyconnect pem terminal

aaa new-model
aaa group server radius freeradius
 
server-private <freeradius ip> auth-port 1812 acct-port 1813 key cisco12
aaa authentication login win7 group freeradius
 
aaa accounting network default start-stop group freeradius

crypto ikev2 profile default
 match identity remote key-id anyconnect_remote_access
 match identity remote key-id cisco.com
 identity local dn
 authentication remote eap query-identity
 authentication local rsa-sig
 pki trustpoint anyconnect
 dpd 60 2 on-demand
 aaa authentication eap win7
 aaa authorization user eap cached
 aaa accounting eap default
 virtual-template 1

crypto ipsec transform-set default esp-aes 256 esp-sha-hmac
 mode tunnel
 
crypto ipsec profile default
 set ikev2-profile default

interface Virtual-Template1 type tunnel
 ip unnumbered Loopback0
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile default

ip local pool mypool 192.168.1.3

access-list 99 permit any

a

ggggg

a

ggggg

a

gggggg

a