Secured Connectivity

Cisco Easy VPN Server

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-1

Cisco Easy VPN Server General Configuration Tasks

The following general tasks are used to configure Cisco Easy VPN Server on a Cisco router:
(Optional) Create IP address pool for connecting clients Enable group policy lookup via AAA Create an ISAKMP policy for remote VPN Client access Define a group policy for mode configuration push Apply mode configuration and XAUTH Enable RRI for the client Enable IKE DPD Configure XAUTH (Optional) Enable the XAUTH Save Password feature

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-2

Create IP Address Pool

Remote Clients Pool Remote-Pool 10.0.1.100 to 10.0.1.150 R1

R1(config)# ip local pool Remote-Pool 10.0.1.100 10.0.1.150

Creating a local address pool is optional if you are using an external DHCP server.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-3

Configure Group Policy Lookup

Remote Clients
Group
VPN-REMOTE-ACCESS

R1

R1(config)# R1(config)# R1(config)# R1(config)#

aaa new-model aaa authentication login vpn-users local aaa authorization network vpn-group local username cisco password 0 cisco

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-4

Define Group Policy for Mode Configuration Push

Contains the following steps:
Step 1: Add the group profile to be defined. Step 2: Configure the ISAKMP pre-shared key. Step 3: Specify the DNS servers. Step 4: Specify the Microsoft WINS servers. Step 5: Specify the DNS domain. Step 6: Specify the local IP address pool.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-5

Add the Group Profile to Be Defined

Remote Clients
Primary DNS/ Microsoft WINS 10.0.1.13

R1

Secondary DNS/ Microsoft WINS 10.0.1.14

R1(config)# crypto isakmp client configuration group R6 R1(config-isakmp-group)# key VPNKEY R1(config-isakmp-group)# dns 10.0.1.13 10.0.1.14 R1(config-isakmp-group)# wins 10.0.1.13 10.0.1.14 R1(config-isakmp-group)# domain cisco.com R1(config-isakmp-group)# pool Remote-Pool R1(config-isakmp-group)# save-password

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-6

Create ISAKMP Policy for Remote VPN Client Access

Remote Clients
Policy 10 Authentication: Pre-shared keys Encryption: 3-DES Diffie-Hellman: Group 2

R1

Other settings: Default

R1(config)# crypto R1(config)# crypto R1(config-isakmp)# R1(config-isakmp)# R1(config-isakmp)# R1(config-isakmp)#

isakmp enable isakmp policy 10 authentication pre-share encryption 3des group 2 end

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-7

Create Transform Sets

Remote Clients

VPNTRANSFORM esp-3des esp-sha-hmac

R1

R1(config)# crypto ipsec transform-set VPNTRANSFORM esp-3des esp-sha-hmac R1(cfg-crypto-trans)# end

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-8

Create Dynamic Crypto Map with RRI

Contains the following steps:
Step 1: Create a dynamic crypto map. Step 2: Assign a transform set. Step 3: Enable RRI.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-9

Step 1: Create a Dynamic Crypto Map

Remote Clients

Dynamic-Map 10
transform-set VPNTRANSFORM reverse-route

R1

R1(config)# crypto dynamic-map Dynamic-Map 10 R1(config-crypto-map)# set transform-set VPNTRANSFORM R1(config-crypto-map)# reverse-route R1(config-crypto-map)# end

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-10

Apply Mode Configuration and XAUTH

Contains the following steps:
Step 1: Configure the router to respond to mode configuration requests. Step 2: Enable IKE querying for a group policy. Step 3: Enforce XAUTH Step 3: Apply the dynamic crypto map to the crypto map.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-11

Applying Mode Configuration

Remote Client

R1

R1(config)# R1(config)# R1(config)# R1(config)#

crypto crypto crypto crypto

map map map map

ClientMap ClientMap CLientMap ClientMap

client configuration address respond isakmp authorization list vpn-group client authentication list vpn-users 65535 ipsec-isakmp dynamic Dynamic-Map

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-12

Apply the Crypto Map to Router Outside Interface

Crypto map name ClientMP

Remote Client

Fa0/1

R1

R1(config)# interface ethernet0/1 R1(config-if)# crypto map ClinetMap R1(config-if)# end

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-13

Enable ISAKMP DPD

1) DPD Send: Are you there? Remote Client

R1

2)2) DPDReply:Yes, IIam here. DPD reply: Yes am here.

router(config)#

crypto isakmp keepalive secs retries R1(config)# crypto isakmp keepalive 20 10

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-14

Configure XAUTH
Step 1: Enable AAA login authentication. Step 2: Set the XAUTH timeout value. Step 3: Enable ISAKMP XAUTH for the dynamic crypto map.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-15

Step 1: Enable AAA Login Authentication

VPN user group VPNUSERS R1

Remote Client

R1(config)# aaa authentication login VPNUSERS local

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-16

Step 2: Set XAUTH Timeout Value

20 Seconds
Remote Client VPN user group VPNUSERS R1

R1(config)# crypto isakmp xauth timeout 20

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-17

Step 3: Enable ISAKMP XAUTH for Crypto Map

Remote Client

Crypto map name CLIENTMAP VPN user group R1 VPNUSERS

R1(config)# crypto map CLIENTMAP client authentication list VPNUSERS

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-18

(Optional) Enable XAUTH Save Password

Remote Client

R1

Group VPN-REMOTE-ACCESS

R1(config)# crypto isakmp client configuration group VPNREMOTE-ACCESS R1(config-isakmp-group)# save-password

This step could have been completed in Step 1 of Task 4 following the crypto isakmp client configuration group command.
2007 Cisco Systems, Inc. All rights reserved. SNRS v2.04-19

Verify

Router# show crypto map interface ethernet 0 Router# show run

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-20

Configuring Cisco Easy VPN Remote for the Cisco VPN Client v4.x: General Tasks
Install Cisco VPN Client v4.x. Create a new client connection entry. Choose an authentication method. Configure transparent tunneling. Enable and add backup servers. Configure a connection to the Internet through dialup networking.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-21

Install Cisco VPN Client

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-22

Install Cisco VPN Client (Cont.)

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-23

Create a New Client Connection Entry

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-24

Create a New Client Connection Entry (Cont.)

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-25

Configure Client Authentication Properties

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-26

Mutual Group Authentication

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-27

Configure Transparent Tunneling

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-28

Routes Table

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-29

Enable and Add Backup Servers

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-30

Configure Connection to the Internet Through Dial-Up Networking

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-31

Summary
Cisco Easy VPN simplifies the configuration of VPNs using routers as Easy VPN servers and clients. An access router can be configured as a Cisco Easy VPM remote client. The Cisco Easy VPN Server feature allows a remote end user to communicate using IPsec with any Cisco IOS VPN gateway. The Cisco VPN Client is simple to deploy and operate.

2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-32

 2007 Cisco Systems, Inc. All rights reserved.

SNRS v2.04-33