Configuring the FlexVPN Client

The FlexVPN client can be connected automatically or manually through user intervention. The FlexVPN client connects automatically to the tunnel when the FlexVPN configuration is complete. If the tunnel times out or fails, the tunnel automatically reconnects and retries the connection indefinitely. To configure an automatic tunnel connection, use the connect command with the auto keyword in the IKEv2 FlexVPN profile.

In a manual connection, the FlexVPN client waits for user intervention to execute a command before establishing a connection. When the client times out or fails to connect, subsequent connections require user intervention. To configure a manual connection, use the crypto ikev2 client flexvpn connect command with the flexvpn-name argument in privileged EXEC mode. To terminate the connection, use the clear crypto ikev2 client flexvpn connect command with the flexvpn-name argument.

• Tracking-Based Tunnel Activation

A FlexVPN client can connect to various peers or servers in a predetermined order. The list of peers is called the gateway list or backup gateway list and is built using the following lists:

• Static backup gateway list or static list
• Downloaded backup gateway list or downloaded list

The static backup gateway list is configured in the FlexVPN profile by providing a list of peers with a sequence number. The downloaded backup gateway list is downloaded dynamically and is obtained during the mode configuration response. The downloaded list complements the static gateway list to build the backup gateway list. The downloaded list is inserted after the peer from which the list is downloaded.

If an existing connection with a peer from the gateway list goes down, the client tries to establish a connection with the next peer in the gateway list. If a downloaded list is available and connection with a static peer fails, the client tries to connect, in sequence, with the peers from the downloaded list. If the client fails to establish a connection with all the peers in the downloaded list, the client tries to connect to the next peer in the static list, and the downloaded list is deleted.

• Backup Gateways
• Reactivate Primary Peer
• Dial Backup (Primary or Backup Tunnels)
• Backup Group

The Dual FlexVPN Support feature provides the ability to configure two FlexVPN tunnels that share the same inside and outside interfaces. The two FlexVPN tunnels use route injections to direct appropriate traffic through the corresponding tunnel interface. When the tunnel is up, the tunnel "learns" the network list from the server. If the server forwards a network list, FlexVPN installs specific routes to the destination networks in its routing table, directing the traffic to these networks out of the tunnel interface.

Note	Only one FlexVPN connection can be established with a default route through the tunnel interface.

The Split DNS functionality enables the FlexVPN client to act as a Domain Name System (DNS) proxy. During FlexVPN negotiations, the DNS list is downloaded during mode configuration. This list is configured as a DNS view list on the inside interfaces associated with the FlexVPN profile. The view list is used to match requests based on the domain names with the DNS query and then forward the match requests to the DNS server. Other DNS queries are used to match the default view (global DNS configuration) and are forwarded to the ISP DNS.

If no inside interfaces are mentioned in the FlexVPN client profile, the DNS view is applied to all interfaces except the tunnel interface and the tunnel source interfaces of all configured profiles. When the DNS query request reaches the inside interface, the matching DNS view is obtained, and the request is forwarded to the DNS IP address.

The Network Address Translation (NAT) feature in FlexVPN enables traffic to be translated to an IP address based on the interface to which the traffic is routed. If a packet is received on one interface that is configured with the ip nat inside command and is being sent out another interface that is configured with the ip nat outside command, the packet is translated to the IP address configured on the second interface.

• Network List from the Server
• Default Route List from the Server

The FlexVPN client learns about the list of networks behind a peer in one of the following ways:

• Mode configuration push--The FlexVPN server sends the list of network attributes as a configuration mode parameter to the client. The FlexVPN client installs the routes to these networks through the tunnel interface that has the highest metric. The client also communicates its networks to the server in the mode configuration SET/ACK exchange so that the server can add those routes via the virtual access interface.
• Running routing protocols--The FlexVPN client and server run routing protocols over the tunnel interface to establish network routes, which allows the client and the server the flexibility to add or remove networks without disconnecting the existing session. The tunnel addresses are communicated during mode configuration to establish routes with peers.

The FlexVPN server pushes the domain name, Windows Internet Naming Service (WINS), or Network Behind Mobile Subscribers (NBMS) server attributes during mode configuration. These attributes are dynamically updated to the DHCP server that is running on the FlexVPN client.

The Event Tracing feature is used for debugging purposes. Events posted to the FlexVPN client are logged, and the information is used for debugging. Event tracing is a combination of a fast mechanism that logs a few bytes of trace information in a buffer area and a display mechanism that extracts and decodes the debug data. The FlexVPN client maintains its buffer and can be enabled during normal operation.

The FlexVPN client supports EAP as a local authentication method. Supported EAP authentication methods are Microsoft Challenge Handshake Authentication Protocol Version 2 (MSCHAPv2), message digest algorithm 5 (MD5), and Generic Token Card (GTC). The EAP authentication process is as follows:

• Use the authentication local eap command in IKEv2 profile configuration mode to authenticate the FlexVPN client by using EAP.
• After the FlexVPN client receives the IKE_AUTH response from the peer, enter the crypto eap credentials command.
• If the EAP-Identity Request is received in the IKE_AUTH response, the EAP username and password must be specified.
• If an EAP-Identity Request is not received in the IKE_AUTH response, only the password is specified because the local IKEv2 identity is used as the username.

Note

EAP as the local authentication method must be used with the FlexVPN client, but EAP can also be used with FlexVPN site-to-site on the IKEv2 initiator. If the EAP server initially proposes an unsupported authentication method, the FlexVPN EAP initiator responds with an EAP Negative Acknowledgment (NAK) packet, requesting EAP-MSCHAPv2, EAP-MD5, or EAP-GTC as the desired authentication method. The FlexVPN EAP responder selects one of the authentication methods.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface tunnel number

4.    ip address {ipv4-address | negotiated}

5.    tunnel mode gre ip

6.    tunnel mode ipsec ipv4

7.    tunnel source {ip-address | interface | dynamic}

8.    tunnel destination dynamic

9.    tunnel protection ipsec-profile profile-name

10.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	interface tunnel number Example: Device(config)# interface tunnel 1	Creates a tunnel interface and enters interface configuration mode.
Step 4	ip address {ipv4-address | negotiated} Example: Device(config-if)# ip address negotiated	(Optional) Assigns an IPv4 address to the tunnel interface.
Step 5	tunnel mode gre ip Example: Device(config-if)# tunnel mode gre ip	(Optional) Enables generic route encapsulation (GRE) mode for the tunnel interface.
Step 6	tunnel mode ipsec ipv4 Example: Device(config-if)# tunnel mode ipsec ipv4	(Optional) Enables IPsec encapsulation.
Step 7	tunnel source {ip-address | interface | dynamic} Example: Device(config-if)# tunnel source 10.0.0.1	Specifies the source for the tunnel interface.
Step 8	tunnel destination dynamic Example: Device(config-if)# tunnel destination dynamic	Specifies the destination for the tunnel interface. dynamic--Assigns the address dynamically.
Step 9	tunnel protection ipsec-profile profile-name Example: Device(config-if)# tunnel protection ipsec-profile ipsecprofile1	Associates a tunnel interface with an IPsec profile.
Step 10	end Example: Device(config-if)# end	Exits interface configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto ikev2 client flexvpn client-name

4.    peer sequence {ipv4-address | ipv6-address | fqdn fqdn-name [dynamic | ipv6]} [track track-number [up | down]]

5.    connect {manual | auto | track track-number [up | down]}

6.    client inside interface-type interface-number

7.    client connect tunnel interface-number

8.    source sequence-number interface-type interface-number track track-number

9.    peer reactivate

10.    backup group {group-number | default}

11.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	crypto ikev2 client flexvpn client-name Example: Device(config)# crypto ikev2 client flexvpn client1	Defines an IKEv2 FlexVPN client profile and enters IKEv2 FlexVPN client profile configuration mode.
Step 4	peer sequence {ipv4-address | ipv6-address | fqdn fqdn-name [dynamic | ipv6]} [track track-number [up | down]] Example: Device(config-ikev2-flexvpn)# peer 1 10.0.0.1	Defines a static peer using an IP address or hostname.
Step 5	connect {manual | auto | track track-number [up | down]} Example: Device(config-ikev2-flexvpn)# connect track 10 up	Connects the FlexVPN tunnel. Note    Any change to this command terminates the active session.
Step 6	client inside interface-type interface-number Example: Device(config-ikev2-flexvpn)# client inside GigabitEthernet 0/1	(Optional) Specifies the inside interface. You can specify more than one inside interface in a FlexVPN client profile. The inside interfaces can be shared across FlexVPN client profiles. Note    Any change to this command terminates the active session.
Step 7	client connect tunnel interface-number Example: Device(config-ikev2-flexvpn)# client connect tunnel 1	Assigns the tunnel interface created in the "Configuring the Tunnel Interface" task to the FlexVPN client. You can configure only one tunnel interface for a FlexVPN client profile. Note    Any change to this command terminates the active session.
Step 8	source sequence-number interface-type interface-number track track-number Example: Device(config-ikev2-flexvpn)# source 1 GigabitEthernet 0/1 track 11	Adds sequence numbers to the tunnel source address. The tunnel source address has the lowest sequence number for which the track object number is in UP state. Note    Any change to this command terminates the active session.
Step 9	peer reactivate Example: Device(config-ikev2-flexvpn)# peer reactivate	Enables the reactivate primary peer feature.
Step 10	backup group {group-number | default} Example: Device(config-ikev2-flexvpn)# backup group default	Assigns the client to a backup group. By default, all clients belong to backup group 0. Note    Any change to this command terminates the active session.
Step 11	end Example: Device(config-ikev2-flexvpn)# end	Exits IKEv2 FlexVPN client profile configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto ikev2 profile profile-name

4.    authentication local eap

5.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	crypto ikev2 profile profile-name Example: Device(config)# crypto ikev2 profile profile1	Defines an IKEv2 profile and enters IKEv2 profile configuration mode.
Step 4	authentication local eap Example: Device(config-ikev2-profile)# authentication local eap	Specifies EAP as the local authentication method. Note    This command is supported only on the IKEv2 initiator.
Step 5	end Example: Device(config-ikev2-profile)# end	Exits IKEv2 profile configuration mode and returns to privileged EXEC mode.