Cisco ASA Konfiguration für das iPhone

Ab der Softwareversion 2.0 kann das Apple iPhone nicht nur L2PT und PPTP sondern auch richtige IPSec Verbindungen zu Firewalls von CISCO (z.B. PIX oder ASA) aufbauen. Leiter konnte ich auf den Webseiten von Apple und Cisco nur die Information finden, dass es funktionieren soll. Eine Anleitung oder ein HowTo für die Konfiguration der PIX oder ASA konnte ich nicht finden. Deshalb habe ich selber herumprobiert und die folgende Konfiguration auf einer Cisco ASA 5505 mit einem iPhone 3G (Softwareversion 2.1) zu laufen gebracht:

ASA Version 7.2(4) 
!
hostname minastirith
domain-name domain.de
enable password testpasswort
passwd testpasswort
names
name 172.20.20.0 LAN
name 172.20.52.0 iPhones
!
interface Vlan1
 nameif LAN
 security-level 100
 ip address 172.20.20.1 255.255.255.0 
!
interface Vlan2
 nameif INTERNET
 security-level 0
 ip address 217.6.26.94 255.255.255.248 
!
interface Ethernet0/0
 switchport access vlan 2
!             
interface Ethernet0/1
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
ftp mode passive
clock timezone MET 1
dns server-group DefaultDNS
 domain-name domain.de
access-list INTERNET_access_in extended permit ip iPhones 255.255.255.0 LAN 255.255.255.0 
access-list iPhone_splitTunnelAcl standard permit LAN 255.255.255.0 
access-list inside_outbound_nat0_acl extended permit ip LAN 255.255.255.0 iPhones 255.255.255.0 
pager lines 24
logging enable
logging asdm informational
mtu LAN 1500
mtu INTERNET 1500
ip local pool iphone_pool 172.20.52.101-172.20.52.199
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (INTERNET) 1 interface
nat (LAN) 0 access-list inside_outbound_nat0_acl
nat (LAN) 1 0.0.0.0 0.0.0.0
access-group INTERNET_access_in in interface INTERNET
route INTERNET 0.0.0.0 0.0.0.0 217.6.26.89 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication serial console LOCAL 
aaa authentication ssh console LOCAL 
aaa authentication http console LOCAL 
http server enable
http LAN 255.255.255.255 LAN
http LAN 255.255.255.0 LAN
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto dynamic-map INTERNET_dyn_map 20 set pfs 
crypto dynamic-map INTERNET_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map INTERNET_dyn_map 40 set pfs 
crypto dynamic-map INTERNET_dyn_map 40 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic INTERNET_dyn_map
crypto map outside_map interface INTERNET
crypto isakmp enable INTERNET
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh LAN 255.255.255.255 LAN
ssh timeout 60
console timeout 0

group-policy iPhone internal
group-policy iPhone attributes
 wins-server value 172.20.20.21
 dns-server value 172.20.20.21
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value iPhone_splitTunnelAcl
 default-domain value domain.de
username admin password testpasswort privilege 15
username marco password testpasswort privilege 0
username marco attributes
 vpn-group-policy iPhone
tunnel-group VPN-Clients type ipsec-ra
tunnel-group iPhone type ipsec-ra
tunnel-group iPhone general-attributes
 address-pool iphone_pool
 default-group-policy iPhone
tunnel-group iPhone ipsec-attributes
 pre-shared-key testkey
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny 
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip 
  inspect xdmcp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
: end