VPN Device Manager Client for Cisco IOS Software (XSM Configuration)
Note For the primary documentaiton of the latest version of the VPN Device Manager (version 1.2), see the "Installation Guide and Release Notes for VPN Device Manager 1.2" at http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/vdm/vdm12rn.htm.
This document describes the command-line interface (CLI) Cisco IOS commands required to activate the VPN Device Manager (VDM) client and includes the following sections:
•Supported Standards, MIBs, and RFCs
•Configuration Examples for VDM
•Feature Information for VPN Device Manager Client
VDM software is installed directly onto Cisco VPN devices. It allows network administrators to use a web browser to manage and configure site-to-site VPNs on a single device. VDM implements a wizard-based GUI that allows simplified VPN configuration of the device on which it resides and peer-to-peer interfaces from that device to remote devices. VDM requires configuration of some Cisco IOS commands before it can be fully operational.
Note In addition to having the relevant Cisco IOS image installed on your device, make sure the VDM client software has been preinstalled in the device Flash memory. If it has not been, you must download it from Cisco.com. See the Installation and Release Notes for VPN Device Manager for the product version you are using for details on completing this task. See the Cisco VPN Device Manager index (http://www.cisco.com/warp/public/cc/pd/nemnsw/vpdvmn) for further information.
VDM also monitors general system statistics and VPN-specific information such as tunnel throughput and errors. The graphing capability allows comparison of such parameters as traffic volume, tunnel counts, and system utilization. VDM supports site-to-site VPNs. Its step-by-step wizards simplify the configuration of common VPN setups, interfaces, and policies, including:
•Preshared keys and Internet Key Exchange (IKE) policies
Figure 1 shows a simplified VDM deployment within a VPN.
Figure 1 Simplified VDM Deployment
XML Subscription Manager
XML Subscription Manager (XSM) is an HTTP-based service for retrieving information from a Cisco device. Once remote applications (such as VDM) are connected to the XSM server, they can subscribe to data sets called XML Request Descriptors (XRDs). These are XML-formatted messages describing configuration (access-control lists (ACLs), interfaces, crypto-maps, and others) and monitoring information (CPU, memory usage, interface statistics, and others).
XSM provides remote applications such as VDM with a constantly updated stream of data about Cisco device status by supplying real-time data without repeated device polling.
CLI Commands for VDM
This document gives details about Cisco IOS commands specific to VDM functionality. These commands are not related to general VPN functions but are designed to manage VDM itself via the XSM server. By using the Java-enabled VDM application, you can perform all VPN-related configuration and monitoring tasks within the application.
These commands are designed to complement VDM. The following tasks are performed by specific Cisco IOS XSM commands (command name in parentheses):
•Enabling VDM to receive data from the XSM feature set on the device (xsm)
•Enabling basic device monitoring, configuration, and data delivery for VDM (xsm edm)
•Enabling VPN-specific monitoring, configuration, and data delivery for VDM (xsm vdm)
•Enabling access to switch operations (for example, configuring switch ports and VLANs) when running VDM on a switch (xsm dvdm)
•Enabling collection of selected statistics generic to embedded devices on the XSM server (xsm history edm)
•Enabling collection of specific selected VPN statistics on the XSM server (xsm history vdm)
•Clearing VDM client sessions (clear xsm)
•Displaying information about the XSM server and VDM (show xsm status)
•Displaying all XRDs available to VDM (show xsm xrd-list)
•Setting user privilege levels for viewing VDM monitoring and configuration data (xsm privilege monitor level and xsm privilege configuration level)
For more information on VDM, the Installation and Release Notes for VPN Device Manager for the product version you are using or the Documentation CD-ROM that shipped with the product. See the Cisco VPN Device Manager index (http://www.cisco.com/warp/public/cc/pd/nemnsw/vpdvmn) for further information.
Related Features and Technologies
•Virtual Private Networks (VPNs)
•Access VPN Solutions Using Tunneling Technology
•Access VPDN Dial-in Using L2TP
•Access VPDN Dial-in Using IPSec Over L2TP
•Cisco IOS Dial Technologies Command Reference, Release 12.2
•Cisco IOS Security Configuration Guide, Release 12.2
•Cisco IOS Security Command Reference, Release 12.2
•"Configuring Virtual Private Networks" chapter in the "Virtual Templates, Profiles, and Networks" part of the Cisco IOS Dial Technologies Configuration Guide, Release 12.2
•Installation and Release Notes for VPN Device Manager
•VDM chapter in the Cisco Enterprise VPN Configuration Guide
•Cisco VPN Device Manager
•IPSec VPN Acceleration Services Module Installation and Configuration Note
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for VPN Device Manager Client" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Supported Standards, MIBs, and RFCs
No new or modified standards are supported by this feature.
No new or modified MIBs are supported by this feature.
To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:
No new or modified RFCs are supported by this feature.
The VDM client software must be installed on your device. It might already have been installed if you chose the VPN option at the time of configuration.
See the following sections for configuration tasks for this feature. Each task in the list is identified as either required or optional.
•Enabling the XSM Server for VDM (required)
•Configuring XSM Privilege Levels for XRDs (optional)
•Disabling the XSM Server for VDM (optional)
•Verifying VDM Status on the XSM Server (optional)
•Clearing XSM Client Sessions (optional)
•Configuring XSM Statistics Collection (optional)
Enabling the XSM Server for VDM
Use the xsm command in global configuration mode to activate XSM clients (such as VDM) on your device. Enabling this command also enables the xsm vdm and xsm edm global configuration commands, so there is no need to enable them separately.
Enables XSM client access to the device.
Configuring XSM Privilege Levels for XRDs
To set the minimum required privilege levels and grant appropriate access to view, monitor, or configure the XSM client (such as VDM), use the following commands in global configuration mode. Privilege levels set on the device determine which access level users possess (configuration and monitoring, monitoring only, or neither).
Users with privilege levels lower than the required monitoring privilege level will not have access to either the configuration or monitoring data required for subscription to XML Request Descriptors (XRDs). The higher the number, the higher the privilege level. The privilege level for the xsm privilege configuration level command must be greater than or equal to that of the xsm privilege monitor level command.
Router(config)# xsm privilege configuration level number
Enables configuration privilege level to subscribe to XRDs.
•number—Privilege level (1-15).
Privilege level 15 is the default.
Router(config)# xsm privilege monitor level number
Enables monitor privilege level to subscribe to XRDs.
•number—Privilege level (1-15).
Privilege level 15 is the default.
Disabling the XSM Server for VDM
To disable the XSM server, use the command below in global configuration mode. Disabling this command also disables the xsm vdm and xsm edm global configuration commands.
Router(config)# no xsm
Disables XSM server.
Verifying VDM Status on the XSM Server
Use the show xsm status command to verify the status of clients (such as VDM) on the XSM server.
Router# show xsm status
Displays information and status about clients subscribed to the XSM server.
Use the show xsm xrd-list command to verify all XML Request Descriptors (XRDs) for XSM clients (such as VDM) made available by subscription to the XSM server.
Router# show xsm xrd-list
Displays all XRDs for clients subscribed to the XSM server.
Clearing XSM Client Sessions
Use the clear xsm command to clear data from XSM clients (such as VDM) on the XSM server. To disconnect a specific client, you must identify the session number. Use the show xsm status command to obtain specific session numbers.
Router# clear xsm [session number]
Clears XSM client sessions.
•session—XSM session ID.
•number—Number of the specific XSM client session you are clearing.
Configuring XSM Statistics Collection
To configure the XSM server and its related clients (such as VDM) for Embedded Device Manager (EDM) or VPN-specific statistics collection of up to 5 days of data, use the following commands in global configuration mode.
Router(config)# xsm history edm
Enables statistics collection for the EDM on the XSM server.
Router(config)# xsm history vdm
Enables specific VPN statistics collection on the XSM server.
Configuration Examples for VDM
This section provides the following configuration examples:
•Enabling the XSM Server for VDM Example
•Configuring XSM Privilege Levels for XRDs Example
•Disabling the XSM Server for VDM Example
•Configuring XSM Statistics Collection Example
Enabling the XSM Server for VDM Example
The following example shows how to enable the XSM client on the device:
Configuring XSM Privilege Levels for XRDs Example
The following example shows how to set a privilege level of 11, for subscription to XRDs:
xsm privilege monitor level 11
Disabling the XSM Server for VDM Example
The following example shows how to enable and then disable the XSM client on the device to troubleshoot VDM:
Configuring XSM Statistics Collection Example
The following example shows how to configure the XSM server and its related clients (such as VDM) for Embedded Device Manager (EDM) or VPN-specific statistics collection of up to 5 days of data:
xsm history edm
xsm history vdm
Feature Information for VPN Device Manager Client
Table 1 Feature Information for Event Tracer
VPN Device Manager Client
VDM software is installed directly onto Cisco VPN devices.
The following commands were introduced or modified:
•crypto mib topn
•show xsm status
•show xsm xrd-list
•xsm history edm
•xsm history vdm
•xsm privilege configuration level
•xsm privilege monitor level
Internet Key Exchange (IKE)—A key management protocol standard used in conjunction with IPSec and other standards. IPSec can be configured without IKE, but IKE enhances IPSec by providing additional features, flexibility, and ease of configuration for the IPSec standard. IKE authenticates the IPSec peers, negotiates IPSec keys, and negotiates IPSec security associations. Before any IPSec traffic can be passed, each router/firewall/host must be able to verify the identity of its peer. This can be done by manually entering preshared keys into both hosts or by a CA service.
IP security (IPSec)—A framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. IPSec provides these security services at the IP layer.
Virtual Private Network (VPN)—A virtual network that uses advanced encryption and tunneling to permit organizations to establish secure, end-to-end, private network connections over public IP infrastructure networks, such as the Internet or extranets.
VPN Device Manager (VDM)—A browser-based tool for configuring and monitoring VPNs on a VPN-enabled device. VDM allows users to configure and monitor advanced VPN functionality within Cisco devices.
XML Subscription Manager (XSM)— A Cisco IOS subsystem that allows embedded device managers such as VDM to receive XML-based configuration and monitoring information for managing network devices.
XML Request Descriptor (XRD)—A specific requested type of data from XSM.
Embedded Device Manager (EDM)—An XSM adapter that publishes general network device configuration and monitoring information for device managers such as VDM.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.