Configuration_Example_Easy_VPN.pdf

(254 KB) Pobierz
Configuration Example: Easy VPN
This document provides a Easy VPN (EzVPN) sample configuration, using Cisco 1800 series,
Cisco 2800 series, and Cisco 3800 series routers.
Contents
•
•
•
•
•
•
Introduction, page 1
Before You Begin, page 2
Configure, page 3
Verify, page 12
Troubleshoot, page 14
Related Information, page 16
Introduction
This document provides a sample Easy VPN (or EzVPN) configuration with the following
characteristics:
•
•
All traffic between two client branch sites and headquarters passes through a Virtual Private
Network (VPN) of IP Security (IPSec) encrypted tunnels.
Techniques used include Internet Key Exchange (IKE) dead peer detection (DPD), split tunneling,
and group policy on the server with Domain Name Server (DNS) information, Windows Information
Name Service (WINS) information, domain name, and an IP address pool for clients.
Headquarters uses an EzVPN concentrator, a Cisco 3800 series router, with an ATM interface.
One branch uses a Cisco 2800 series router and employs a network-mode EzVPN client with a serial
interface, while another branch uses a Cisco 1800 series router and uses client mode EzVPN with
an SHDSL interface.
The various
show
commands demonstrate configurations for the Internet Security Association Key
Management Protocol (ISAKMP) and IPSec Security Associations (SAs) on the EzVPN
concentrator, as well as IPSec client EzVPN status on the clients.
•
•
•
Corporate Headquarters:
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Copyright © 2004 Cisco Systems, Inc. All rights reserved.
Configuration Example: Easy VPN
Before You Begin
List of Terms
ATM—Asynchronous
Transfer Mode. A connection switching protocol that organizes data into 53-byte
cell units, transmitting them via digital signals. Each cell is processed asynchronously (hence the name)
relative to the transmission or arrival of other cells within a single message. Cells are also queued before
being transmitted in a multiplexing fashion. ATM can be used for many different services, including
voice, video, or data.
DNS—Domain
Name Server. Maps names to Internet Protocol (IP) addresses and addresses to names.
Domain Name Servers maintain lists of domain name and IP address mappings.
DPD—Dead
peer detection. An implementation of a client keepalive functionality, to check the
availability of the VPN device on the other end of an IPSec tunnel.
IKE—Internet
Key Exchange. IKE establishes a shared security policy and authenticates keys for
services (such as IPSec) that require keys. Before any IPSec traffic can be passed, each
router/firewall/host must verify the identity of its peer. This can be done by manually entering preshared
keys into both hosts or can be done by a certification authority (CA) service.
IPSec—IP
Security. A framework of open standards that provides data confidentiality, data integrity, and
data authentication between participating peers. IPSec provides these security services at the IP layer.
IPSec uses IKE to handle the negotiation of protocols and algorithms based on local policy and to
generate the encryption and authentication keys to be used by IPSec. IPSec can protect one or more data
flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a
host.
ISAKMP—Internet
Security Association Key Management Protocol. A protocol for key exchange
encryption and authentication. ISAKMP requires at least one pair of messages to be exchanged between
two VPN-connected peers before a secure link can be established.
NETBEUI—NetBIOS
extended user interface. A transport protocol associated with Microsoft-based
networks. Unlike TCP/IP, NETBEUI is not a routable network protocol.
NetBIOS—Network
Basic Input/Output System. A peer-to-peer low-level networking protocol dating
back to the 1980s, NetBIOS links network operating systems with network hardware. NetBIOS is not
routable and must be encapsulated with TCP/IP to pass through routers.
SA—Security
association. This is a unidirectional channel negotiated by IPSec, with a pair of SAs
required for two-way communication. SAs are used to index session keys and initialization vectors.
SHDSL—Symmetrical
High-Speed Digital Subscriber Line. An implementation of DSL that operates
at equal speeds in both transmission directions, at rates from 192 kbps to 2.3 Mbps.
WINS—Windows
Internet Naming Service. A service in Microsoft-based networks that translates
hostnames into IP addresses. Using NETBEUI protocol, it is also compatible with NetBIOS.
Before You Begin
The following are the requirements for using this configuration example.
Conventions
For more information on document conventions, see the
Cisco Technical Tips Conventions.
OL-6340-01
2
Configuration Example: Easy VPN
Configure
Components Used
The information in this document is based on these software and hardware versions:
•
•
•
•
•
•
At Headquarters, a Cisco 3845 router with a Cisco CallManager cluster, and with ATM access to the
Internet
At Branch 1, a Cisco 1841 router with a WIC-1SHDSL interface card installed, and with DSL access
to the Internet
At Branch 2, a Cisco 2811 router with a serial interface connection to the Internet
For Cisco 1800 series routers and Cisco 2800 series routers: Cisco IOS Release 12.3(8)T4
For Cisco 3800 series routers: Cisco IOS Release 12.3(11)T
Advanced Enterprise Services feature set
The information presented in this document resulted from the use of devices in a specific lab setup and
environment. All the devices used in this document started with a cleared (default) configuration. If you
are working in a live network, ensure that you understand the potential impact of any command before
you use it.
Related Products
This configuration can also be used with the following hardware:
•
•
•
Cisco 1800 series routers
Cisco 2800 series routers
Cisco 3800 series routers
Configure
This section presents the information for configuring the features described in this document.
Note
For additional information on the commands used in this document, use the
Cisco IOS Command
Lookup tool.
You must have an account on Cisco.com. If you do not have an account or have forgotten
your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Configuration Tips
•
•
Make sure that the tunnels work before you apply the crypto maps.
Apply IPSec crypto maps to both the tunnel interface and the physical interface
OL-6340-01
3
Configuration Example: Easy VPN
Configure
Network Diagram
This document uses the network setup shown in the following illustration:
8
3
1
2
4
6
5
7
IP
IP
IP
9
117861
IP
IP
IP
IP
IP
IP
Following are the callout terms and definitions for the diagram, identified by number:
1. Headquarters location
2. ATM link from the Headquarters router to the
Internet
3. VPN tunnel through the Internet to Branch 1
4. VPN tunnel through the Internet to Branch 2
5. The Internet, represented by the cloud
The Headquarters location (callout 1) uses a Cisco 3845 router with these characteristics:
•
•
•
•
•
6. DSL link from the Branch 1 router to the
Internet
7. Serial link from the Branch 2 router to the
Internet
8. Branch 1 location
9. Branch 2 location
EzVPN server
ATM access to the Internet
Operating in a Cisco CallManager cluster
Public IP address: 10.32.152.26
Private IP address pool: 192.168.1.0/24
EzVPN client using client mode
DSL access to the Internet
WIC-1SHDSL interface card installed
Public IP address: 10.32.152.46
Private IP address pool: 192.168.3.0/24
The Branch 1 location (callout 8) uses a Cisco 1841 router with these characteristics:
•
•
•
•
•
OL-6340-01
4
Configuration Example: Easy VPN
Configure
The Branch 2 location (callout 9) uses a Cisco 2811 router with these characteristics:
•
•
•
•
EzVPN client using network mode
Serial access to the Internet
Public IP address: 10.32.150.46
Private IP address pool: 192.168.3.1/24
Configurations
This example uses these configurations:
•
•
•
Headquarters Office Configuration (Cisco 3845 Router), page 5
Branch 1 Router Configuration (Cisco 1841 Router), page 8
Branch 2 Router Configuration (Cisco 2811 Router), page 10
Headquarters Office Configuration (Cisco 3845 Router)
EzVPN-Hub#
show running-config
Building configuration...
Current configuration : 6824 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname EzVPN-Hub
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$t8oN$hXnGodPh8ZM/ka6k/9aO51
!
username admin secret 5 $1$cfjP$kKpB7e3pfKXfpK0RIqX/E.
username ezvpn-spoke2 secret 5 $1$vrSS$AhSPxEUnPOsSpJkGdzjXg/
username ezvpn-spoke1 secret 5 $1$VK0p$4D0YXNOtC6K7MR4/vinUL.
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
aaa new-model
!
!
aaa authentication login USER_AAA local
aaa authentication login USERLIST local
aaa authorization network GROUP_AAA local
aaa session-id common
ip subnet-zero
!
ip cef
no ip domain lookup
ip domain name cisco.com
ip audit notify log
ip audit po max-events 100
OL-6340-01
5

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin