SNRS

Purpose of Crypto Maps

Crypto maps pull together the various parts configured for IPsec, including Which traffic should be protected by IPsec Where IPsec-protected traffic should be sent The local address to be used for the IPsec traffic Which IPsec type should be applied to this traffic Whether SAs are established manually or via IKE Other parameters needed to define an IPsec SA 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0 -27 Crypto map entries must be created for IPsec to set up SAs for traffic flows...

Remote Access Using Cisco Easy VPN

PC with Cisco Easy VPN Remote Client v4.x PC with Cisco Easy VPN Remote Client v4.x 2007 Cisco Systems, Inc. All rights 2007 Cisco Systems, Inc. All rights In the example in the figure, the VPN gateway is a Cisco IOS router running the Cisco Easy VPN Server feature. Remote Cisco IOS routers and Cisco VPN Software Clients connect to the Cisco Easy VPN Server for access to the corporate intranet. The Cisco Easy VPN Remote feature requires that the destination peer be a Cisco Easy VPN Server or...

Cisco Easy VPN Remote Features

Cisco Easy VPN Remote is a collection of features that improves the capabilities of the Cisco Easy VPN Remote feature introduced in Cisco IOS Release 12.2(4)YA. Cisco Easy VPN Default inside interface Cisco Easy VPN supports the automatic configuration of the default Cisco Easy VPN inside interface for Cisco 800 Series Routers. Multiple inside interfaces It configures up to eight inside interfaces on the Cisco Easy VPN Remote. Multiple outside interfaces It configures up to four outside tunnels...

Assign Cisco Easy VPN Remote to an Interface

10.0.6.0 172 30 0 0 10.0.1.0 R6(config) interface FastEthernet 0 1 R6(config-if) crypto ipsec client ezvpn R6-Client R6(config-if) exit R6(config) interface FastEthernet 0 0 R6(config-if) crypto ipsec client ezvpn R6-Client inside R6(config-if) end 2007 Cisco Systems, Inc. All rights reservecl.SNRS v2.0 4-19 All that remains is to assign the Cisco Easy VPN Remote client profile to an interface. Use these steps to assign a client profile to an interface. Step 1 Change to interface configuration...

DMVPN Configuration Tasks

This topic describes the tasks required to configure a DMVPN. This topic describes the tasks required to configure a DMVPN. 2007 Cisco Systems, Inc. All rights reserved. There are several tasks required when implementing a DMVPN. Listed here are the configuration tasks required to implement a DMVPN Configure ISAKMP and IPsec transform sets There must be at least one matching ISAKMP policy between two potential crypto peers. There is a default ISAKMP policy that contains the default values for...

Default GRE Characteristics

Tunneling of arbitrary OSI Layer 3 payload is primary goal of GRE Stateless (no flow control mechanisms) No security (no confidentiality, data authentication, or integrity assurance) 24-B overhead by default (20-B IP header and 4-B GRE header) 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0 4-3 GRE encapsulation uses a protocol type field in the GRE header to support the encapsulation of any Open Systems Interconnection (OSI) Layer 3 protocol. GRE itself is completely stateless it does...

Next Hop Resolution Protocol

NHRP, defined in RFC 2332, is a Layer 2 address resolution protocol and cache, like Address Resolution Protocol (ARP) and Frame Relay Inverse ARP. NHRP is used by a branch router connected to a nonbroadcast multiaccess (NBMA) subnetwork to determine the IP address of the NBMA next hop (in this case, the hub router or the destination IP address of another branch router). When a branch router is first established onto a DMVPN network, it registers its IP address with the hub router whose IP...

Spoke Configuration

Router(config-if) ip address 172.16.16.X 255.255.255.0 router(config-if) ip mtu 1416 router(config-if) no ip next-hop-self eigrp router(config-if) ip nhrp authentication cisco123 router(config-if) ip nhrp map 172.16.16.1 172.30.1.2 router(config-if) ip nhrp map multicast 172.30.1.2 router(config-if) ip nhrp nhs 172.16.16.1 router(config-if) ip nhrp network-id 99 router(config-if) no ip split-horizon eigrp 1 router(config-if) tunnel source FastEthernet 0 1 router(config-if) tunnel key 999...

Spoke Verification

To verify the operation at the spoke routers, perform the following commands and observe the output Crypto Map MYMAP 10 ipsec-isakmp Peer 172.30.1.2 Extended IP access list vpn access-list vpn permit ip host 172.30.1.5 host 172.30.1.2 Current peer 172.30.1.2 Security association lifetime 4608000 kilobytes 3600 seconds PFS (Y N) N Transform sets Crypto Map Tunnel0-head-0 65536 ipsec-isakmp Profile name DMVPN Security association lifetime 4608000 kilobytes 3600 seconds PFS (Y N) N Transform sets...

Configuring a GRE Tunnel

Create and identify the tunnel interface. Configure the tunnel interface source address. Configure the tunnel interface destination address. Bring up tunnel interface (administratively). 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0 4-5 To configure a GRE tunnel between the headquarters and remote office routers, you must configure a tunnel interface, source, and destination on the local and remote office routers. When configuring GRE, you must have only Cisco routers or access...

Huband Spoke IPsec VPNs

This topic describes hub-and-spoke IPsec VPNs. Static public address needed at the hub only. Spoke addresses can be dynamically applied using DHCP. Static public address needed at the hub only. Spoke addresses can be dynamically applied using DHCP. 2007 Cisco Systems, Inc. All rights In a hub-and-spoke network configuration, the spoke sites connect with IPsec tunnels to a hub site to establish connectivity to the network. The hub site consists of high-end tunnel aggregation routers servicing...

Editing Transform Sets

Complete the following steps if you need to edit a transform set Delete the transform set from the crypto map. Delete the transform set from the global configuration. Re-enter the transform set with corrections. Assign the transform set to a crypto map. Observe the SA negotiation and ensure that it works properly Securing Networks with Cisco Routers and Switches (SNRS) v2.0 Match Transform sets are negotiated during IKE Phase 2. Transform sets are negotiated during IKE Phase 2. 2007 Cisco...

Defining Mirror Image Crypto ACLs at Each IPsec Peer

It is recommended that for every crypto ACL specified for a static crypto map entry that you define at the local peer, you define a mirror image crypto ACL at the remote peer. This practice ensures that traffic that has IPsec protection applied locally can be processed correctly at the remote peer. Note The crypto map entries themselves must also support common transforms and must refer to 4-80 Securing Networks with Cisco Routers and Switches (SNRS) v2.0 2007 Cisco Systems, Inc. Configure...

Step 1 Create a Dynamic Crypto

Transform-set VPNTRANSFORM reverse-route transform-set VPNTRANSFORM reverse-route R1(config) crypto dynamic-map Dynamic-Map 10 R1(config-crypto-map) set transform-set VPNTRANSFORM R1(config-crypto-map) reverse-route R1(config-crypto-map) end Complete these steps to create a dynamic crypto map. Step 1 Create a dynamic crypto map entry and enter the crypto map configuration mode using the crypto dynamic-map command. R1(config) crypto dynamic map-name seq-num Specifies the name of the dynamic...

Apply Mode Configuration and XAUTH

Step 1 Configure the router to respond to mode configuration requests. Step 2 Enable IKE querying for a group policy. Step 3 Enforce XAUTH Step 3 Apply the dynamic crypto map to the crypto map. 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0 -36 Apply mode configuration to a dynamic crypto map using the following steps in global configuration mode Step 1 Configure the router to respond to mode configuration requests. Step 2 Enable IKE queries for group policy lookup. Step 3 Enforce...

Single Dmvpn Topology

This figure represents a single DMVPN topology. In a single DMVPN cloud topology, there are two hub routers on the same DMVPN subnet. Therefore, the branch router requires an mGRE interface. Because of this mGRE interface, branch routers attempt interbranch communications if so directed by the routing table. As a result, this model should be considered a spoke-to-spoke topology. The hub-and-spoke deployment model can be configured in a single DMVPN cloud topology with only one hub router. This...

Supported Certificate Enrollment Methods

Cisco IOS Software supports the following methods to obtain a certificate from a CA Simple Certificate Enrollment Protocol (SCEP) SCEP is a Cisco developed enrollment protocol that uses HTTP to communicate with the CA or RA. SCEP is the most commonly used method for sending and receiving requests and certificates. Note To take advantage of automated certificate and key rollover functionality, Cisco IOS Release 12.4(2)T must be running and SCEP must be used as your client enrollment method....

Internet Security Association and Key Management Protocol

- Creation and management of SAs 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0 4-8 ISAKMP is defined in RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP). ISAKMP defines the procedures for authenticating a communicating peer, creation and management of SAs, key generation techniques, and threat mitigation (for example, denial of service DoS and replay attacks). While IPsec is the actual protocol that protects the IP datagrams, ISAKMP is the protocol that...

Create a DHCP Server Pool

R6(config) ip dhcp pool Local-Pool R6(dhcp-config) network 10.0.6.0 2 55.255.255.0 R6(dhcp-config) default-router 10.0.6.2 R6(dhcp-config) exit R6(config) ip dhcp excluded-address 10.0.6.2 R6(config) ip dhcp pool Local-Pool R6(dhcp-config) network 10.0.6.0 2 55.255.255.0 R6(dhcp-config) default-router 10.0.6.2 R6(dhcp-config) exit R6(config) ip dhcp excluded-address 10.0.6.2 If you want to use the local router DHCP server to assign IP addresses to the hosts that are connected to the LAN...

Configuring Cisco Easy VPN Remote for the Cisco VPN Client v4x General Tasks

Create a new client connection entry. Choose an authentication method. Configure transparent tunneling. Enable and add backup servers. Configure a connection to the Internet through dialup networking. 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0 -4 The Cisco VPN Client is simple to deploy and operate. The Cisco VPN Client enables customers to establish secure, end-to-end encrypted tunnels to any Cisco Easy VPN server. This thin design, IPSec...

Optional Enable Xauth Save Password

R1(config) crypto isakmp client configuration group VPN-REMOTE-ACCESS R1(config-isakmp-group) save-password This step could have been completed in Step 1 of Task 4 following the crypto isakmp client configuration group command. 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0 4-44 Cisco Easy VPN Remote uses one of three available authentication methods No XAUTH When no XAUTH is used, there is no authentication for the user when establishing the VPN tunnels. This is the least secure...

Configuring the Virtual Gateway

The WebVPN gateway will act as a proxy for connections to protected corporate resources. Protected resources are accessed through an SSL-encrypted connection between the gateway and a web-enabled browser on a remote client. You will use the webvpn gateway command to place the router in Cisco IOS SSL VPN gateway configuration mode. Only one gateway is configured in a Cisco IOS WebVPN-enabled network. The configuration of the ssl trustpoint command is required only if you need to configure a...

Multipoint GRE

In DMVPN designs, an mGRE interface is introduced, which serves as a one-to-many interface for the creation of multiple hub-and-spoke tunnels that work similarly to a point-to-multipoint Frame Relay interface. Unlike point-to-point GRE tunnels, the tunnel destination for an mGRE tunnel does not have to be configured. In all DMVPN designs, the hub is configured with an mGRE interface to allow the dynamic creation of tunnels for each branch connected. An mGRE interface does not require a unique...

Ensure ACLs Are Compatible with IPsec

R1 show ip access-lists Extended IP access list 101 10 permit ahp host 172.30.1.2 host 172.30.6.2 20 permit esp host 172.30.1.2 host 172.30.6.2 R1 show ip access-lists Extended IP access list 101 10 permit ahp host 172.30.1.2 host 172.30.6.2 20 permit esp host 172.30.1.2 host 172.30.6.2 30 permit udp host 172.30.1.2 host 172.30.6.2 eq isakmp < 500 40 permit udp host 172.30.1.2 host 172.30.6.2 eq non500-isakmp You will need to ensure that existing ACLs on perimeter routers, the Cisco Adaptive...

Creating Crypto ACLs

Create an extended ACL to define what traffic will be protected. Must be a mirror image of peer's crypto ACL. 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0 4-36 As with the previous configuration, configuring crypto ACLs for digital signatures is the same as with pre-shared keys. Complete these steps to configure your crypto ACL router(config) ip access-list extended < name> Step 2 Define which traffic is to be protected. router(config-ext-nacl) permit protocol source...

X509v3 Digital Certificate

5B74 F440 66CC 70CD B972 4C5B 7E20 68D1 Encryption Algorithm Certificate Authority CN VeriSign Class 1 CA Individual Subscriber-Persona Not Validated OU www.verisign.com repository RPA Incorp. By Ref.,LIAB.LTD(c)98 OU VeriSign Trust Network O VeriSign, Inc. E dalazartia Lisco com 'IN David Lazaito 'I'll Digital ID Class 1 - Microsoft Full Sorvioo OU Persona Not Validated r OU www.verisign.com repository RPA Incorp. by Ref.,LIAB.LTD(c)98 W OU VeriSign Trust Network O VeriSign, Inc. 2007 Cisco...

Troubleshooting

This topic describes some strategies for troubleshooting IPsec. Remove crypto maps from the interfaces and check basic IP connectivity Compare configurations on both sides for symmetry Reapply crypto maps and turn on the following debug commands Observe debug output for error messages exceptions - show crypto engine connections active Use the following commands to clear established sessions and to regenerate 2007 Cisco Systems, Inc. All rights reseiveO. SNRS V2.0 4-38 A good troubleshooting...

DNS Configuration

Router(config) hostname SSL router(config) ip domain name cisco.com router(config) ip name server 10.0.1.13 router(config) ip host home.cisco.com 10.0.1.12 Before configuring WebVPN, an administrator must configure DNS-related commands. The hostname and the domain name must be set as well as any name servers that may be in use. The following commands are used to configure DNS parameters for use with WebVPN Step 1 Specify a hostname for the router. router(config) hostname name Where name New...

Create IP Address Pool

Remote-Pool 10.0.1.100 to 10.0.1.150 Remote-Pool 10.0.1.100 to 10.0.1.150 R1(config) ip local pool Remote-Pool 10.0.1.100 10.0.1.150 Creating a local address pool is optional if you are using an external DHCP server. 2007 Cisco Systems, Inc. All rights reserved. If you are using a local IP address pool, you will need to configure that pool using the ip local pool command. To configure a local pool of IP addresses to be used when a remote peer connects to a point-to-point interface, complete...

Psec Policy Example

Traffic (packet) type to be encrypted 2007 Cisco Systems, Inc. All rights reserved SNRS V2.0 4-1C 2007 Cisco Systems, Inc. All rights reserved SNRS V2.0 4-1C Determining network design details includes defining a more detailed IPsec policy for protecting traffic. You can then use the detailed policy to help select IPsec transform sets and modes of operation. Your IPsec policy should answer the following questions What protections are required or are acceptable for the protected traffic Which...

Authenticate the CA

CA Download --CA Fingerprint _ xxxx aaaa zzzz bbbb CA Download --CA Fingerprint _ xxxx aaaa zzzz bbbb CA 172.26.26.51 VPNCA CA Fingerprint xxxx aaaa zzzz bbbb CA 172.26.26.51 VPNCA CA Fingerprint xxxx aaaa zzzz bbbb R1(config) crypto pki authenticate VPNCA Certificate has the following attributes Fingerprint MD5 02DA1AB0 4FC8EFDE 3FB2ED92 5C96B72E Fingerprint SHA1 FFDE44F8 FA712C7B FA66F08C 08D548B7 5F05933D Do you accept this certificate yes no yes Trustpoint CA certificate accepted. 2007...

Configuring Isakmp and IPsec

This topic describes how to create ISAKMP policies and IPsec transforms for use with a DMVPN. router(config) crypto isakmp policy 10 router(config-isakmp) hash md5 router(config-isakmp) encryption 3des router(config-isakmp) authentication pre-share router(config) crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 router(config) crypto ipsec transform-set esp-3des There must be at least one matching ISAKMP policy between two potential crypto peers. The sample configuration in this lesson shows a...

Configure the Cisco Easy VPN Client Profile

Group R6 Peer 172.30.1.2 Key MYVPNKEY Mode Client Group R6 Peer 172.30.1.2 Key MYVPNKEY Mode Client R6(config) crypto ipsec client ezvpn R6-Client R6(config-crypto-ezvpn) group R6 key VPNKEY R6(config-crypto-ezvpn) peer 172.30.1.2 R6(config-crypto-ezvpn) mode client R6(config-crypto-ezvpn) connect auto R6(config-crypto-ezvpn) end To configure the Cisco Easy VPN client profile and to assign the profile to a router interface follow these steps Step 1 Create a remote configuration and enter Cisco...

Psec Profile

R1(config) crypto ipsec transform-set MINE esp-3des esp-md5-hmac Rl(config) crypto ipsec set profile DMVPN Rl(ipsec-profile) set transform-set MINE R1(ipsec-profile) security association lifetime seconds 36000 Rl(ipsec-profile) set pfs group2 2007 Cisco Systems, Inc. All rights reserved.SNRS v2.0 4-16 The IPsec profile shares most of the same commands with the crypto map configuration, but only a subset of the commands are valid in an IPsec profile. Only commands that pertain to an IPsec policy...

Implementing PKI

To add a new IPsec router to the network, you need only configure that new router to request a certificate from the CA, instead of making multiple key configurations with all the other existing IPsec routers. 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0 4-2 Cisco IOS PKI provides certificate management to support security protocols such as IPsec, Secure Shell (SSH), and Secure Sockets Layer (SSL). A PKI is composed of the following entities Peers communicating on a secure network...

Generating RSA Keys

Use the crypto key generate rsa global configuration command to generate RSA key pairs. router(config) crypto key generate rsa general-keys usage-keys label key-label exportable modulus modulus-size storage device 4-140 Securing Networks with Cisco Routers and Switches (SNRS) v2.0 2007 Cisco Systems, Inc. Specifies that the general purpose key pair should be generated Specifies that two RSA special usage key pairs should be generated (that is, one encryption pair and one signature pair) instead...

Removing RSA Key Pairs

You might want to remove an RSA key pair for one of the following reasons During manual PKI operations and maintenance, old RSA keys can be removed and replaced with new keys. An existing CA is replaced and the new CA requires newly generated keys for example, the required key size might have changed in an organization so you would have to delete the old 1024-bit keys and generate new 2048-bit keys. To remove all RSA keys or the specified RSA key pair that has been generated by your router,...

Certificate and Trustpoint Configuration

Set the router time and date Request your own certificate 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0 4-14 WebVPN is based on HTTPS, which requires a public key infrastructure (PKI) trustpoint to be configured. A self-signed certificate is automatically generated when a WebVPN gateway is put in service. However, if network security policy dictates that you use an external certificate authority (CA) server, use the discussion here as a guide. The figure lists the tasks involved with...

Dual Dmvpn Topology

All rights re This figure represents a dual DMVPN topology. A dual DMVPN cloud topology hub-and-spoke deployment model consists of two hub routers (hub 1 and hub 2), each with one or more mGRE tunnel interfaces that connect to all branch routers. Each DMVPN cloud represents a unique IP subnet. One DMVPN cloud is considered the primary, which all branch traffic transits. Each branch is configured with two point-to-point GRE tunnel interfaces, with one going to each...

DMVPN Topologies

In a DMVPN design, the following two topologies are recommended Dual hub-single DMVPN cloud In both topologies, two hubs are recommended for redundancy. High availability is provided through the use of a second hub router, which may be on the same DMVPN subnet as the primary router. This is commonly referred to as a single DMVPN cloud topology. The second hub router can also service its own DMVPN subnet, which is known as a dual DMVPN cloud 2007 Cisco Systems, Inc. Secured Connectivity 4-181...

Connection Is Completed with IPsec Quick Mode

IKE Phase 2 has one mode, called quick mode. Quick mode occurs after IKE has established the secure tunnel in IKE Phase 1. IKE Phase 2 negotiates a shared IPsec policy, derives shared-secret keying material used for the IPsec security algorithms, and establishes IPsec SAs. Quick mode exchanges nonces that provide replay protection. The nonces are used to generate new shared-secret key material and prevent replay attacks from generating bogus SAs. Quick mode is also used to renegotiate a new...

DMVPN Deployment Models

A DMVPN cloud topology can support either a hub-and-spoke or spoke-to-spoke deployment model. In a hub-and-spoke deployment model, each hub contains an mGRE interface and each branch contains a point-to-point GRE interface. In a spoke-to-spoke deployment model, both the hub and the branch contain mGRE interfaces. A DMVPN cloud is a collection of routers that is configured either with an mGRE interface or a point-to-point GRE interface (or a combination of the two) and that share the same...

Apply the Crypto Map to Router Outside Interface

R1(config) interface ethernet0 1 R1(config-if) crypto map ClinetMap R1(config-if) end This task applies the crypto map to the Cisco Easy VPN Server router outside interface. The figure above shows an example of how to apply the crypto map to the outside interface. 4-330 Securing Networks with Cisco Routers and Switches (SNRS) v2.0 This section describes how to enable DPD. crypto isakmp keepalive secs retries R1(config) crypto isakmp keepalive 20 10 2007 Cisco Systems, Inc. All rights re Use the...

Usage RSA Keys Vs General Purpose RSA Keys

There are two mutually exclusive types of RSA key pairs. When you generate RSA key pairs (via the crypto key generate rsa command), you will be prompted to choose either usage keys or general purpose keys. 2007 Cisco Systems, Inc. Secured Connectivity 4-139 If you generate special usage keys, two pairs of RSA keys will be generated. One pair will be used with any IKE policy that specifies RSA signatures as the authentication method, and the other pair will be used with any IKE policy that...

Encrypting GRE Tunnel Traffic

To encrypt only traffic through the GRE tunnel, follow these additional instructions When you set up your encryption ACL, the list should contain only one criteria statement. In this one statement, specify gre as the protocol, specify the tunnel source address as the source, and specify the tunnel destination address as the destination. Apply the crypto map to both the physical interface and to the tunnel interface. Note Without GRE tunnels, you only had to apply the crypto map to the physical...

Tunnel Activation Options

There are three tunnel activation options Traffic-triggered activation (not available in Cisco IOS Release 12.3(11)T) Tunnel connect and disconnect options are available with Cisco SDM. The Cisco Easy VPN tunnel is automatically connected when the Cisco Easy VPN Remote feature is configured on an interface. If the tunnel times out or fails, the tunnel automatically reconnects and retries indefinitely. To specify automatic tunnel control on a Cisco Easy VPN Remote device, you need to configure...

Optional Initiate the VPN Tunnel XAUTH

01 34 42 EZVPN Pending XAuth Request, Please enter the following command 01 34 42 EZVPN crypto ipsec client ezvpn xauth Cisco IOS message Waiting for valid Xauth username and password. R6 crypto ipsec client ezvpn xauth Enter Username and Password vpnusers Password ******** With XAUTH When SA expires, username and password must be manually entered. With XAUTH Save Password enabled When SA expires, the last valid username and password will be reused automatically. 2007 Cisco Systems, Inc. All...

Cisco Easy VPN Server General Configuration Tasks

The following general tasks are used to configure Cisco Easy VPN Server on a Cisco router (Optional) Create IP address pool for connecting clients Enable group policy lookup via AAA Create an ISAKMP policy for remote VPN Client access Define a group policy for mode configuration push Apply mode configuration and XAUTH (Optional) Enable the XAUTH Save Password feature 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0 4-27 The Cisco Easy VPN Server feature allows a remote end user to...

WebVPN clear Commands

There are clear commands that will clear the NBNS cache, clear the WebVPN sessions, and clear the statistics. To clear WebVPN remote user sessions, use the following command router clear webvpn session user name context name (Optional) Clears session information for a specific user Clears session information for a specific context or all contexts This command is used to clear the session for either the specified remote user or all remote users in the specified context. To clear the NBNS cache...

Installing the Cisco VPN Client through Microsoft Windows Installer

Microsoft Windows Installer is available for Microsoft Windows NT, Microsoft Windows 2000, and Microsoft Windows XP. Note If you are using Microsoft Windows Installer, you must have Microsoft Windows NT-based products such as Microsoft Windows NT 4.0 (with SP6), Microsoft Windows 2000, or Microsoft Windows XP. Installing with Microsoft Windows Installer also requires administrator privileges. Microsoft Windows Installer 2.0 must be installed on a Microsoft Windows NT or Microsoft Windows 2000...

Installing the Cisco VPN Client Through Install Shield

To install the Cisco VPN Client on your system using InstallShield, follow these steps. It is suggested that you accept the defaults unless your system administrator has instructed you otherwise. Step 1 Exit all Microsoft Windows programs, and disable any antivirus software. Step 2 Insert the Cisco Systems CD-ROM in the CD-ROM drive of your system. Step 3 Choose Start > Run. The Run dialog box appears. Step 4 Enter E VPN Client CD-ROM InstallShield setup.exe, where E is the CD-ROM Note Cisco...

Create a New Client Connection Entry Cont

All rights reserveO A VPN Client Properties for 10.86.194.173 Connection Entry ConnectiorABC P HPE2 Description Documentation Concentrator i MjjjjX i l Authentication j Transport j Backup Servers Dial-Up r 6 roup Authentication ( Mutual Group Authentication Confirm Password I Step 10 Enter a unique name for this new connection. You can use any name to identify this connection for example, Engineering. This name can contain spaces, and it is not case-sensitive. Step 11...

Troubleshooting Ssl Vpn

Enables WebVPN basic session monitoring Displays port-forwarding debug messages 2007 Cisco Systems, Inc. All rights reserved SNRS v2.0 -3S 2007 Cisco Systems, Inc. All rights reserved SNRS v2.0 -3S There are many debug webvpn commands available to use in troubleshooting Cisco IOS SSL VPN. The table shows some debug commands available to help troubleshooting possible problems. Debug Commands Enables WebVPN basic session monitoring Displays port-forwarding debug messages 2007 Cisco Systems, Inc....

Planning the IKE Policy

This topic describes how to determine the IKE policies between IPsec peers. This topic describes how to determine the IKE policies between IPsec peers. Determine the following policy details IPsec peer IP addresses and hostnames 2007 Cisco Systems, Inc. All rights reserved. You should determine the ISAKMP (IKE Phase 1) policy details that you want to use and then configure those policy details. Having a detailed IKE policy plan lessens the chances of improper configuration. Determine the key...

Configuring the Virtual Context

The WebVPN context defines the virtual configuration of the Cisco IOS SSL VPN. Entering the webvpn context command places the router in Cisco IOS SSL VPN configuration mode. Follow these steps to configure a WebVPN context Step 1 Enter Cisco IOS SSL VPN configuration mode to configure the WebVPN context. If you have not already set up your WebVPN context, this will create a new context and enter Cisco IOS SSL VPN configuration mode. Step 2 Configure AAA authentication for Cisco IOS SSL VPN...

Configuring Microsoft File Shares for Clientless Remote Access

In clientless remote-access mode, files and directories created on Microsoft Windows servers can be accessed by the remote client through the HTTPS-enabled browser. When enabled, a list of file server and directory links are displayed on the portal page after login. The administrator can customize permissions on the WebVPN gateway to provide limited read-only access for a single file or full write access and network browsing capabilities. CIFS is the protocol that provides access to Microsoft...