1. Home
    2. /
  2. Manuals
    3. /
  3. Cisco
    4. /
  4. 870-Series
    5. /
  5. 14
Page 66 / 196 Scroll up to view Page 61 - 65
5-8
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 5
Configuring a LAN with DHCP and VLANs
Configure VLANs
VLAN Type
SAID
MTU
Parent RingNo BridgeNo Stp
BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1
enet
100001
1500
-
-
-
-
-
1002
1003
2
enet
100002
1500
-
-
-
-
-
0
0
1002 fddi
101002
1500
-
-
-
-
-
1
1003
1003 tr
101003
1500
1005
0
-
-
srb
1
1002
1004 fdnet 101004
1500
-
-
1
ibm
-
0
0
1005 trnet 101005
1500
-
-
1
ibm
-
0
0
Page 67 / 196
C H A P T E R
6-1
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
6
Configuring a VPN Using Easy VPN and an IPSec
Tunnel
The Cisco 870 series routers support the creation of Virtual Private Networks (VPNs).
Cisco routers and other broadband devices provide high-performance connections to the Internet, but
many applications also require the security of VPN connections which perform a high level of
authentication and which encrypt the data between two particular endpoints.
Two types of VPNs are supported—site-to-site and remote access. Site-to-site VPNs are used to connect
branch offices to corporate offices, for example. Remote access VPNs are used by remote clients to log
in to a corporate network.
The example in this chapter illustrates the configuration of a remote access VPN that uses the Cisco Easy
VPN and an IPSec tunnel to configure and secure the connection between the remote client and the
corporate network.
Figure 6-1
shows a typical deployment scenario.
Note
The material in this chapter does not apply to Cisco 850 series routers. Cisco 850 series routers do not
support Cisco Easy VPN.
Page 68 / 196
6-2
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 6
Configuring a VPN Using Easy VPN and an IPSec Tunnel
Figure 6-1
Remote Access VPN Using IPSec Tunnel
2
1
121782
Internet
3
4
5
6
1
Remote, networked users
2
VPN client—Cisco 870 series access router
3
Router—Providing the corporate office network access
4
VPN server—Easy VPN server; for example, a Cisco VPN 3000 concentrator with outside
interface address 210.110.101.1
5
Corporate office with a network address of 10.1.1.1
6
IPSec tunnel
Cisco Easy VPN
The Cisco Easy VPN client feature eliminates much of the tedious configuration work by implementing
the Cisco Unity Client protocol. This protocol allows most VPN parameters, such as internal IP
addresses, internal subnet masks, DHCP server addresses, WINS server addresses, and split-tunneling
flags, to be defined at a VPN server, such as a Cisco VPN 3000 series concentrator that is acting as an
IPSec server.
An Easy VPN server–enabled device can terminate VPN tunnels initiated by mobile and remote workers
who are running Cisco Easy VPN Remote software on PCs. Easy VPN server–enabled devices allow
remote routers to act as Easy VPN Remote nodes.
The Cisco Easy VPN client feature can be configured in one of two modes—client mode or network
extension mode. Client mode is the default configuration and allows only devices at the client site to
access resources at the central site. Resources at the client site are unavailable to the central site.
Network extension mode allows users at the central site (where the VPN 3000 series concentrator is
located) to access network resources on the client site.
After the IPSec server has been configured, a VPN connection can be created with minimal configuration
on an IPSec client, such as a supported Cisco 870 series access router. When the IPSec client initiates
the VPN tunnel connection, the IPSec server pushes the IPSec policies to the IPSec client and creates
the corresponding VPN tunnel connection.
Page 69 / 196
6-3
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 6
Configuring a VPN Using Easy VPN and an IPSec Tunnel
Note
The Cisco Easy VPN client feature supports configuration of only one destination peer. If your
application requires creation of multiple VPN tunnels, you must manually configure the IPSec VPN and
Network Address Translation/Peer Address Translation (NAT/PAT) parameters on both the client and the
server.
Configuration Tasks
Perform the following tasks to configure your router for this network scenario:
•
Configure the IKE Policy
•
Configure Group Policy Information
•
Apply Mode Configuration to the Crypto Map
•
Enable Policy Lookup
•
Configure IPSec Transforms and Protocols
•
Configure the IPSec Crypto Method and Parameters
•
Apply the Crypto Map to the Physical Interface
•
Create an Easy VPN Remote Configuration
An example showing the results of these configuration tasks is provided in the
“Configuration Example”
section on page 6-11
.
Note
The procedures in this chapter assume that you have already configured basic router features as well as
PPPoE or PPPoA with NAT, DCHP and VLANs. If you have not performed these configurations tasks,
see
Chapter 1, “Basic Router Configuration,” Chapter 3, “Configuring PPP over Ethernet with NAT,”
Chapter 4, “Configuring PPP over ATM with NAT,”
and
Chapter 5, “Configuring a LAN with DHCP
and VLANs”
as appropriate for your router.
Note
The examples shown in this chapter refer only to the endpoint configuration on the Cisco 870 series
router. Any VPN connection requires both endpoints be configured properly to function. See the
software configuration documentation as needed to configure VPN for other router models.
Page 70 / 196
6-4
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 6
Configuring a VPN Using Easy VPN and an IPSec Tunnel
Configure the IKE Policy
Configure the IKE Policy
Perform these steps to configure the Internet Key Exchange (IKE) policy, beginning in global
configuration mode:
Command or Action
Purpose
Step 1
crypto isakmp policy
priority
Example:
Router(config)#
crypto isakmp policy 1
Router(config-isakmp)#
Creates an IKE policy that is used during IKE
negotiation. The priority is a number from 1 to
10000, with 1 being the highest.
Also enters the Internet Security Association Key
and Management Protocol (ISAKMP) policy
configuration mode.
Step 2
encryption
{
des
|
3des
|
aes
|
aes 192
|
aes 256
}
Example:
Router(config-isakmp)#
encryption 3des
Router(config-isakmp)#
Specifies the encryption algorithm used in the IKE
policy.
The example specifies 168-bit data encryption
standard (DES).
Step 3
hash
{
md5
|
sha
}
Example:
Router(config-isakmp)#
hash md5
Router(config-isakmp)#
Specifies the hash algorithm used in the IKE
policy.
The example specifies the Message Digest 5
(MD5) algorithm. The default is Secure Hash
standard (SHA-1).
Step 4
authentication
{
rsa-sig
|
rsa-encr
|
pre-share
}
Example:
Router(config-isakmp)#
authentication
pre-share
Router(config-isakmp)#
Specifies the authentication method used in the
IKE policy.
The example specifies a pre-shared key.
Step 5
group
{
1
|
2
|
5
}
Example:
Router(config-isakmp)#
group 2
Router(config-isakmp)#
Specifies the Diffie-Hellman group to be used in
an IKE policy.
Step 6
lifetime
seconds
Example:
Router(config-isakmp)#
lifetime 480
Router(config-isakmp)#
Specifies the lifetime, 60–86400 seconds, for an
IKE security association (SA).
Step 7
exit
Example:
Router(config-isakmp)#
exit
Router(config)#
Exits IKE policy configuration mode, and enters
global configuration mode.

Rate

4.5 / 5 based on 2 votes.

Popular Cisco Models

Famous Router IPs
Famous Router Companies
Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top