Home | Skip to Content | Skip to Search | Skip to Navigation | Skip to Footer |
Worldwide [change] |Register |About Cisco
Guest

Hierarchical Navigation

Cisco IOS Software Releases 12.2 Special and Early Deployments

Cisco Easy VPN Remote Phase II

Downloads

Table Of Contents

Cisco Easy VPN Remote Phase II

Feature Overview

Modes of Operation

Enhancements Specific to Phase II

Manual Tunnel Control

Multiple Inside Interface Enhancements

Multiple Outside Interfaces Support

NAT Interoperability Support

Local Address Support for Easy VPN Remote

Cable DHCP Proxy Enhancement

Peer Hostname Enhancement

Proxy DNS Server Support

PIX Interoperability Support

Cisco IOS Firewall Support

Simultaneous Easy VPN Client and Server Support

Cisco Easy VPN Remote Web Manager

Differences Between Cisco Easy VPN Remote Phase II and Phase I

Benefits

Restrictions

Related Documents

Platform-Specific Documentation

IPsec and VPN Documentation

Supported Platforms

Supported Standards, MIBs, and RFCs

Prerequisites

Configuration Tasks

Configuring Manual Tunnel Control

Configuring Multiple Inside Interfaces

Configuring Multiple Outside Interfaces

Verifying Outside Interface Configuration

Configuring Easy VPN Remote Using Cable DHCP Proxy

Configuring Easy VPN Remote with a Static IP Address

Configuring Proxy DNS Server Support

Verifying Proxy DNS Server Support

Configuring and Using the Cisco Easy VPN Remote Web Manager

Configuring the DHCP Server Pool

Verifying the DHCP Server Pool

Troubleshooting Tips

Configuring and Assigning the Cisco Easy VPN Remote Configuration

Verifying the Cisco Easy VPN Configuration

Configuring the Cisco VPN 3000 Series Concentrator

Troubleshooting Tips

Configuration Examples

Cable DHCP Proxy Enhancement Configuration Examples

Local Address Support for Easy VPN Remote Example

PIX Interoperability Support Example

Client Mode Configuration Examples

Cisco Easy VPN Client in Client Mode (Cisco uBR905 and Cisco uBR925) Example

Cisco Easy VPN Client in Client Mode (Cisco 806) Example

Cisco Easy VPN Client in Client Mode (Cisco 827) Example

Cisco Easy VPN Client in Client Mode (Cisco 1700 Series) Example

Network Extension Mode Configuration Examples

Cisco Easy VPN Client in Network-Extension Mode (Cisco uBR905 and Cisco uBR925) Example

Cisco Easy VPN Client in Network-Extension Mode (Cisco 806) Example

Cisco Easy VPN Client in Network-Extension Mode (Cisco 827) Example

Cisco Easy VPN Client in Network-Extension Mode (Cisco 1700 Series) Example

VPN Remote Access Server Configuration Examples

VPN Remote Access Server Without Split Tunneling Example

VPN Remote Access Server Configuration With Split Tunneling Example

VPN Remote Access Server Configuration With XAUTH Example

Command Reference

cable-modem dhcp-proxy

clear crypto ipsec client ezvpn

crypto ipsec client ezvpn xauth

crypto ipsec client ezvpn (global configuration)

crypto ipsec client ezvpn (interface configuration)

crypto ipsec client ezvpn connect

ip http ezvpn

show crypto ipsec client ezvpn

show tech-support

debug crypto ipsec client ezvpn

Glossary


Cisco Easy VPN Remote Phase II

Feature History

Release
Modification

12.2(4)YA

Support for Phase I of this feature was introduced for Cisco 806, Cisco 826, Cisco 827, and Cisco 828 routers; Cisco 1700 series routers; and Cisco uBR905 and Cisco uBR925 cable access routers.

12.2(8)YJ

Support for Phase II of this feature was introduced for Cisco 806, Cisco 826, Cisco 827, and Cisco 828 routers; Cisco 1700 series routers; and Cisco uBR905 and Cisco uBR925 cable access routers.


This document describes the Cisco Easy VPN Remote Phase II feature for Cisco 806, Cisco 826, Cisco 827, and Cisco 828 routers; Cisco 1700 series routers; and Cisco uBR905 and Cisco uBR925 cable access routers in Cisco IOS Release 12.2(8)YJ. This document provides information on configuring and monitoring the Cisco Easy VPN Remote Phase II feature to create IPSec Virtual Private Network (VPN) tunnels between a supported router and another Cisco router that supports this form of IPSec encryption and decryption.

This document includes the following sections:

•Feature Overview

•Supported Platforms

•Supported Standards, MIBs, and RFCs

•Prerequisites

•Configuration Tasks

•Configuration Examples

•Command Reference

•Glossary

Feature Overview

Cable modems, xDSL routers, and other forms of broadband access provide high-performance connections to the Internet, but many applications also require the security of VPN connections that perform a high level of authentication and that encrypt the data between two particular endpoints. However, establishing a VPN connection between two routers can be complicated, and typically requires tedious coordination between network administrators to configure the two routers' VPN parameters.

The Cisco Easy VPN Remote Phase II feature eliminates much of this tedious work by implementing Cisco Unity Client Protocol, which allows most VPN parameters to be defined at a VPN remote access server. This server can be a dedicated VPN device such as a Cisco VPN 3000 concentrator or a Cisco PIX Firewall, or a Cisco IOS router that supports the Cisco Unity Client Protocol.

After the VPN remote access server has been configured, a VPN connection can be created with minimal configuration on an IPSec client, such as a Cisco uBR905 or Cisco uBR925 cable access router, as well as on the Cisco 806/826/827/828 and Cisco 1700 series routers. When the IPSec client then initiates the VPN tunnel connection, the VPN remote access server pushes the IPSec policies to the IPSec client and creates the corresponding VPN tunnel connection.

The Cisco Easy VPN Remote Phase II feature provides for automatic management of the following details:

•Negotiating tunnel parameters—Addresses, algorithms, lifetime, and so on.

•Establishing tunnels according to the parameters.

•Automatically creating the Network Address Translation (NAT)/Port Address Translation (PAT) and associated access lists that are needed, if any.

•Authenticating users—Making sure that users are who they say they are by way of usernames, group names, and passwords.

•Managing security keys for encryption and decryption.

•Authenticating, encrypting, and decrypting data through the tunnel.

Modes of Operation

The Cisco Easy VPN Remote Phase II feature supports two modes of operation:

•Client—Specifies that NAT/PAT be done, so that the PCs and other hosts at the client end of the VPN tunnel form a private network that does not use any IP addresses in the destination server's IP address space.

In client mode, the Cisco Easy VPN Remote Phase II feature automatically configures the NAT/PAT translation and access lists that are needed to implement the VPN tunnel. These configurations are automatically created when the IPSec VPN connection is initiated. When the tunnel is torn down, the NAT/PAT and access list configurations are automatically deleted.

The NAT/PAT configuration is created with the following assumptions:

–The ip nat inside command is applied to all inside interfaces, including default inside interfaces. The default inside interface is the Ethernet0 interface (for the Cisco 806, Cisco 826, Cisco 827, Cisco 828 routers, and the Cisco uBR905 and Cisco uBR925 cable access routers).

–The ip nat outside command is applied to the interface that is configured with the Cisco Easy VPN Remote Phase II configuration. On the Cisco uBR905 and Cisco uBR925 routers, this is always the Cable-modem0 interface. On the Cisco 800 series and Cisco 1700 series routers, this is the outside interface configured with the Cisco Easy VPN Remote Phase II configuration. On the Cisco 1700 series routers, multiple outside interfaces can be configured.

Tip The NAT/PAT translation and access-list configurations that are created by the Cisco Easy VPN Remote Phase II feature are not written to either the startup-configuration or running-configuration files. These configurations, however, can be displayed using the show ip nat statistics and show access-list commands.

•Network Extension—Specifies that the PCs and other hosts at the client end of the VPN tunnel should be given IP addresses that are fully routable and reachable by the destination network over the tunneled network, so that they form one logical network. PAT is not used, which allows the client PCs and hosts to have direct access to the PCs and hosts at the destination network.

Both modes of operation also optionally support split tunneling, which allows secure access to corporate resources through the VPN tunnel while also allowing Internet access through a connection to an Internet Service Provider (ISP) or other service—thereby eliminating the corporate network from the path for web access.

Authentication can also be done using Extended Authentication (XAUTH). In this situation, when the VPN remote access server requests XAUTH authentication, the following messages are displayed on the router's console: 

EZVPN: Pending XAuth Request, Please enter the following command:

EZVPN: crypto ipsec client ezvpn xauth

The user can then provide the necessary user ID, password, and other information by entering the crypto ipsec client ezvpn xauth command and responding to the prompts that follow.

Note The timeout for entering the username and password is determined by the configuration of the VPN remote access server. For servers running Cisco IOS software, this timeout value is specified by the crypto isakmp xauth timeout command.

Figure 1 illustrates the client mode of operation. In this example, the Cisco uBR905 cable access router provides access to two PCs, which have IP addresses in the 10.0.0.0 private network space. These PCs connect to the Ethernet interface on the Cisco uBR905 router, which also has an IP address in the 10.0.0.0 private network space. The Cisco uBR905 router performs NAT/PAT translation over the VPN tunnel so that the PCs can access the destination network.

Figure 1 Cisco Easy VPN Client Connection

Note The diagram in Figure 1 could also represent a split tunneling connection, in which the client PCs can access public resources in the global Internet without including the corporate network in the path for the public resources.

Figure 2 also illustrates the client mode of operation, in which a VPN concentrator provides destination endpoints to multiple xDSL clients. In this example, Cisco 800 series routers provide access to multiple small business clients, each of which uses IP addresses in the 10.0.0.0 private network space. The Cisco 800 series routers perform NAT/PAT translation over the VPN tunnel, so that the PCs can access the destination network.

Figure 2 Cisco Easy VPN Client Connection (using VPN concentrator)

Figure 3 illustrates the network extension mode of operation. In this example, the Cisco uBR905 cable access router and Cisco 1700 series router both act as Cisco Easy VPN Clients, connecting to a Cisco VPN 3000 concentrator.

The client hosts are given IP addresses that are fully routable by the destination network over the tunnel. These IP addresses could be either in the same subnet space as the destination network, or they could also be in separate subnets, as long as the destination routers are configured to properly route those IP addresses over the tunnel.

In this example, the PCs and hosts attached to the two routers have IP addresses that are in the same address space as the destination enterprise network. The PCs connect to the Cisco uBR905 router's Ethernet interface, which also has an IP address in the enterprise address space. This provides a seamless extension of the remote network.

Figure 3 Cisco Easy VPN Network Extension Connection

Note For information on configuration the VPN 3000 concentrator for use with the Cisco Easy VPN Remote Phase II feature, please see the "Configuring the Cisco VPN 3000 Series Concentrator" section.

Enhancements Specific to Phase II

The Phase II implementation of the Cisco Easy VPN Remote feature provides enhancements and additional capabilities to Phase I features. In Phase II, the Cisco Easy VPN Remote feature provides the following enhancements:

•Manual Tunnel Control—Establishes and terminates the IPSec VPN tunnel on demand.

•Multiple Inside Interface Enhancements—Configures up to three inside interfaces on the Cisco Easy VPN client.

•Multiple Outside Interfaces Support—Configures up to four outside tunnels for outside interfaces.

•NAT Interoperability Support—Automatically restores the NAT configuration when the IPSec VPN tunnel is disconnected.

•Local Address Support for Easy VPN Remote—The Cisco Easy VPN Remote feature is enhanced to support an additional local-address attribute that specifies which interface is used to determine the IP address used to source the Easy VPN tunnel traffic.

•Cable DHCP Proxy Enhancement—The cable-modem dhcp-proxy interface configuration command is enhanced to support the loopback interface for Cisco uBR905 and Cisco uBR925 cable access routers, so that a public IP address is automatically assigned to the loopback interface.

•Peer Hostname Enhancement—When a peer is defined as a hostname, the hostname is stored and the Domain Name System (DNS) lookup is done at time of tunnel connection.

•Proxy DNS Server Support—Configures the router in a Cisco Easy VPN Remote configuration to act as a proxy DNS server for LAN connected users.

•PIX Interoperability Support—Supports Cisco PIX Firewall Version 6.2.

•Cisco IOS Firewall Support—Supports Cisco IOS Firewall configurations on all platforms.

•Simultaneous Easy VPN Client and Server Support—Configures simultaneous Easy VPN Client and Cisco Easy VPN Server support on the same Cisco 1700 series routers.

•Cisco Easy VPN Remote Web Manager—Users can manage the Cisco Easy VPN Remote feature on the Cisco uBR905 and Cisco uBR925 cable access routers using a built-in web interface.

In addition, as part of configuring the Cisco VPN 3000 series concentrator—for the Cisco Easy VPN Remote Phase II image—you do not need to create a new IPSec Security Association. Use the default Internet Key Exchange (IKE) and IPSec client lifetime configured on the Cisco VPN 3000 series concentrator.

Manual Tunnel Control

The IPSec Virtual Private Network (VPN) tunnel is automatically connected when the Cisco Easy VPN Remote feature is configured on an interface. If the tunnel times out or fails, the tunnel automatically reconnects and retries indefinitely. Cisco Easy VPN Remote Phase II implements manual control of IPSec VPN tunnels so that you can establish and terminate the IPSec VPN tunnel on demand.

The Easy VPN Remote configuration command, crypto ipsec client ezvpn name, is enhanced with a new subcommand, connect [auto | manual], to allow you to specify manual tunnel control.

Automatic is the default setting because it was the initial Phase I functionality. If automatic is the configuration, then you do not need to use the subcommand.

The manual setting means that the Cisco Easy VPN Client will wait for a command before attempting to establish the Cisco Easy VPN Remote connection. When the tunnel times out or fails, then subsequent connections will have to wait for the command also.

If the configuration is manual, then the tunnel is connected only after you issue the new command, crypto ipsec client ezvpn connect name.

The clear command, clear crypto ipsec client ezvpn [name], is enhanced to disconnect a given tunnel.

See "Configuring Manual Tunnel Control" section for information on how to configure manual control of a tunnel.

Multiple Inside Interface Enhancements

The Cisco Easy VPN Client Phase I feature supported only one inside interface, which by default was the Fastethernet interface on the Cisco 1700 series and the ethernet interface on the Cisco 800 series and Cisco uBR900 series.

The inside interface support is enhanced in Cisco Easy VPN Remote Phase II to support multiple inside interfaces for all platforms. Inside interfaces can be manually configured with the enhanced command and subcommand: 

interface interface-name

crypto ipsec client ezvpn name [outside | inside]

If you want to disable the default inside interface and configure another inside interface on the Cisco uBR905, Cisco uBR925, and on a Cisco 800 series router, you must configure the other inside interface first and then disable the default inside interface. You can use the following command to disable the default inside interface: 

no crypto ipsec client ezvpn <name> inside

If you did not configure the other inside interface first before disabling the default inside interface, you receive a message such as the following: 

ezvpn_client_37(config)#int e0

ezvpn_client_37(config-if)#no crypto ipsec client ezvpn hw-client inside

Cannot remove the single inside interface unless

one other inside interface is configured

See "Configuring Multiple Inside Interfaces" section for information on how to configure more than one inside interface.

The multiple inside interface enhancements support the following capabilities:

•Up to three inside interfaces are supported on the Cisco 1700 and 800 series routers. The Cisco uBR 925 only supports up to two inside interfaces (Ethernet and USB). The Cisco uBR905 is not affected as it only supports one inside interface (Ethernet).

•When multiple tunnels are configured, there can be confusion as to which tunnel gets the default inside interface. The Cisco 1700 series router has no default inside interface, and any inside interface must be configured. The Cisco 800 series and Cisco uBR905 and Cisco uBR925 series cable access routers have default inside interfaces (Ethernet interface). However, any inside interfaces for these platforms can be manually configured and the default inside interface can be disabled.

•At least one inside interface must be configured for each outside interface; otherwise, the Cisco Easy VPN Remote Phase II feature does not establish a connection.

•Adding a new inside interface or removing an existing inside interface automatically resets the Cisco Easy VPN Remote connection (the currently established tunnel). You must reconnect a manually configured tunnel, and if extended authentication (XAUTH) is required by the Cisco Easy VPN Server, the user is re-prompted. If you have set the Cisco Easy VPN Remote Phase II configuration to connect automatically and no XAUTH is required, then no user input is required.

Configuration information for the default inside interface is shown with the show crypto ipsec client ezvpn command. All inside interfaces, whether they belong to a tunnel, are listed in interface configuration mode as an inside interface, along with the tunnel name.

Multiple Outside Interfaces Support

The Cisco Easy VPN Client Phase I feature supported the configuration of only one tunnel for a single outside interface. The Phase II enhancement adds support for configuration of multiple tunnels for outside interfaces, by establishing one tunnel per outside interface. This functionality is applicable to multiple outside interface platforms such as the Cisco 1700 series routers. The Cisco 800 series router, and uBR905 and uBR925 cable access routers are not affected, because these routers support only one outside interface.

You can configure a maximum of four tunnels. This is done by the enhanced command, crypto ipsec client ezvpn name outside.

Note Each inside or outside interface supports only one tunnel. Multiple inside interfaces can be mapped to one outside interface.

To disconnect or clear a specific tunnel, the enhanced command, clear crypto ipsec ezvpn <name>, specifies the IPSec VPN tunnel name. If there is no tunnel name specified, then all existing tunnels are cleared.

See "Configuring Multiple Outside Interfaces" section for more information on configuring more than one outside interface.

NAT Interoperability Support

Cisco Easy VPN Remote Phase II supports interoperability with Network Address Translation (NAT). You can have a NAT configuration and a Cisco Easy VPN Remote Phase II configuration coexist. When an IPSec VPN tunnel is down, the NAT configuration works.

The Cisco Easy VPN Remote Phase II feature automatically creates a NAT configuration, with the corresponding access lists, to implement client mode and split tunneling. In the initial release of the Cisco Easy VPN Client feature, this automatic NAT and access list configuration overrode any previous NAT and access list configuration. When a tunnel timed out or disconnected—due to manual tunnel control, for example—the automatic NAT and access configuration was automatically removed, which prevented any Internet access even to non-tunnel destinations.

In Phase II of the Cisco Easy VPN Remote feature, the router automatically restores the previous NAT configuration when the IPSec VPN tunnel is torn down. The user-defined access lists are not disturbed. Users can continue to access non-tunnel areas of the Internet when the tunnel times out or disconnects.

Local Address Support for Easy VPN Remote

The Cisco Easy VPN Remote Phase II feature is enhanced to support an additional local-address attribute that specifies which interface is used to determine the IP address used to source the Easy VPN Remote tunnel traffic. After specifying the interface with the local-address subcommand, you can manually assign a static IP address to the interface or use the cable-modem dhcp-proxy interface command to automatically configure the specified interface with a public IP address. See Configuring Easy VPN Remote with a Static IP Address and Configuring Easy VPN Remote Using Cable DHCP Proxy for configuration information. See "Cable DHCP Proxy Enhancement" section for more information on the cable-modem dhcp-proxy interface command.

The local-address support is available for all platforms, but it is more applicable to the Cisco uBR905 and Cisco uBR925 cable access routers in conjunction with the cable-modem dhcp-proxy interface command. Typically, the loopback interface is the interface used to source tunnel traffic for the Cisco uBR905 and Cisco uBR925 cable access routers.

Cable DHCP Proxy Enhancement

In a typical DOCSIS network, the Cisco uBR905 and Cisco uBR925 cable access routers are normally configured with a private IP address on the cable-modem interface. In Cisco Easy VPN Client Phase I, a public IP address was required on the cable-modem interface to support the Easy VPN Client.

In Phase II, cable providers can use the Cable DHCP Proxy feature to obtain a public IP address and assign it to the cable modem interface, which is usually the loopback interface.

To support the Cisco Easy VPN Remote Phase II feature on the uBR905 and uBR925 cable access routers, the existing cable-modem dhcp-proxy interface configuration command is enhanced to support the loopback interface. The router automatically configures the loopback interface with the public IP address obtained from the DHCP server. You must create the loopback interface, which is a virtual interface, first before issuing the cable-modem dhcp-proxy interface command.

See "Configuring Easy VPN Remote Using Cable DHCP Proxy" section for information on how to configure the Cable DHCP Proxy feature.

For more information on the cable-modem dhcp-proxy interface command, refer to the "Cable CPE Commands" chapter at http://www.cisco.com/univercd/cc/td/doc/product/cable/bbccmref/bbcmcpe.htm in the Cisco Broadband Cable Command Reference Guide at http://www.cisco.com/univercd/cc/td/doc/product/cable/bbccmref/index.htm.

Note The cable-modem dhcp-proxy interface command is only supported for the Cisco uBR905 and Cisco uBR925 cable access routers.

Peer Hostname Enhancement

The peer in a Cisco Easy VPN Remote Phase II feature configuration can be defined as an IP address or a hostname. Typically when a peer is defined as a hostname, a Domain Name System (DNS) lookup is done immediately to get an IP address. In the Cisco Easy VPN Remote Phase II feature, the peer hostname operation is enhanced to support DNS entry changes. The text string of the hostname is stored so that the DNS lookup is done at the time of the tunnel connection, not when the peer is defined as a hostname.

See "Configuring and Assigning the Cisco Easy VPN Remote Configuration" section for information on enabling the peer hostname functionality.

Proxy DNS Server Support

When the WAN connection is down—that is, the IPSec VPN tunnel is down—the Domain Name System (DNS) addresses of the ISP or cable provider should be used to resolve DNS requests. When the WAN connection is up, the enterprise's DNS addresses should be used.

As a way of implementing use of the cable provider's DNS addresses when the WAN connection is down, the router in a Cisco Easy VPN Remote Phase II configuration can be configured to act as a proxy DNS server. The router, acting as a proxy DNS server for LAN connected users, receives DNS queries from local users on behalf of the real DNS server. The DHCP server then is able to send out the router's LAN address as the DNS server's IP address. Then after the WAN connection comes up, the router forwards the DNS queries to the real DNS server and caches the DNS query records.

See "Configuring Proxy DNS Server Support" section for information on enabling the proxy DNS server functionality.

PIX Interoperability Support

The Cisco Easy VPN Remote Phase II feature supports Cisco PIX Firewall Version 6.2.

See "PIX Interoperability Support Example" section for an example output.

You can refer to Cisco PIX Firewall and VPN Configuration Guide Version 6.2 documentation on Cisco.com at the following URL:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/config/index.htm

Cisco IOS Firewall Support

The Cisco Easy VPN Remote Phase II feature works in conjunction with Cisco IOS Firewall configurations on all platforms.

Simultaneous Easy VPN Client and Server Support

You can configure simultaneous Cisco Easy VPN Client and Cisco Easy VPN Server support on the same Cisco 1700 series routers. You can configure one outside interface as a Cisco Easy VPN Server and another outside interface on the same router as a Cisco Easy VPN Client. This support is applicable for multiple outside interface platforms, such as the Cisco 1700 series routers.

Cisco Easy VPN Remote Web Manager

The Cisco Easy VPN Remote Web Manager is a web interface used to manage the Cisco Easy VPN Remote Phase II feature for Cisco uBR905 and Cisco uBR925 cable access routers. Users do not need access to the command-line interface (CLI) to manage the Cisco Easy VPN Remote Phase II connection. The web interface allows the user to:

•See the current status of theCisco Easy VPN Remote Phase II tunnel.

•Connect a tunnel that is configured for manual control.

•Disconnect a tunnel that is configured for manual control or reset a tunnel configured for automatic connection.

•Be prompted for Xauth information if Xauth information is needed.

See Configuring and Using the Cisco Easy VPN Remote Web Manager for more information.

Differences Between Cisco Easy VPN Remote Phase II and Phase I

Table 1 summarizes the major differences between the Cisco Easy VPN Remote Phase II feature and the Cisco Easy VPN Client Phase I feature.

Table 1 Differences Between Cisco Easy VPN Remote Phase II and Phase I

Item
Phase II
Phase I

IPSec VPN tunnel

Establishes and terminates a tunnel on demand.

Tunnel is automatically connected only when the Cisco Easy VPN Client is configured on an interface.

Inside interface

Supports multiple inside interfaces.

Supports only the default inside interface.

Outside interface

Supports multiple tunnels, one tunnel for each outside interface.

Supports only one tunnel for a single outside interface.

Default inside interface

•Cisco 1700 series routers no longer have a default inside interface. Inside interfaces must be configured manually.

•On Cisco 1700 series routers, the last inside interface of a tunnel can be unconfigured only after unconfiguring the outside interface.

•Default inside interfaces on the Cisco 800 series and Cisco uBR905 and Cisco uBR925 cable access routers can be manually disabled if one other inside interface has been configured on the router.

•The default inside interface is the FastEthernet0 interface for the Cisco 1700 series, and the Ethernet0 interface for the Cisco 806, Cisco 826, Cisco 827, Cisco 828 routers, and the Cisco uBR905 and Cisco uBR925 cable access routers.

Cable DHCP proxy enhancement

The cable-modem dhcp-proxy interface configuration command is enhanced to support the loopback interface for Cisco uBR905 and Cisco uBR925 cable access routers, so that a public IP address is automatically assigned to the loopback interface.

Not supported.

NAT interoperability support

A manually assigned NAT configuration on an interface works with the Cisco Easy VPN Remote Phase II configuration.

NAT configurations not supported.

IOS Firewall support

Cisco Easy VPN Remote Phase II feature works in conjunction with Cisco IOS firewall configurations.

IOS firewall configurations not supported.

show crypto ipsec client ezvpn command

Output shows the list of inside and outside interfaces for each tunnel.

No inside and outside interfaces are shown.


Benefits

•Allows dynamic configuration of end-user policy, requiring less manual configuration by end users and field technicians, thus reducing errors and further service calls.

•Allows the provider to change equipment and network configurations as needed, with little or no reconfiguration of the end-user equipment.

•Provides for centralized security policy management.

•Enables large-scale deployments with rapid user provisioning.

•Eliminates the need for end users to purchase and configure external VPN devices.

•Eliminates the need for end users to install and configure VPN client software on their PCs.

•Offloads the creation and maintenance of the VPN connections from the PC to the router.

•Reduces interoperability problems between the different PC-based software VPN clients, external hardware-based VPN solutions, and other VPN applications.

Restrictions

Sub-interfaces Not Supported

Establishing Cisco Easy VPN Remote Phase II tunnels over sub-interfaces is not supported in Cisco IOS Release 12.2(8)YJ.

Cisco Easy VPN Remote Web Manager Does Not Support Cable-Monitor Web Interface

The Cisco Easy VPN Remote Web Manager does not work with the cable -monitor web interface in Cisco IOS 12.2(8)YJ Release. To access the cable-monitor web interface, you must first disable the Cisco Easy VPN Remote web interface with the no ip http ezvpn command, and then enable the Cable Monitor with the ip http cable-monitor command.

Only One Destination Peer Supported

The Cisco Easy VPN Remote Phase II feature supports the configuration of only one destination peer and tunnel connection. If your application requires the creation of multiple VPN tunnels, you must manually configure the IPSec VPN and NAT/PAT parameters on both the client and the server.

Required Destination Servers

The Cisco Easy VPN Remote Phase II feature requires that the destination peer be a VPN remote access server or VPN concentrator that supports the Cisco Easy VPN Server feature. At the time of publication, this includes the following platforms when running the indicated software releases:

•Cisco 806, Cisco 826, Cisco 827, and Cisco 828 routers—Cisco IOS Release 12.2(8)T or later release

•Cisco 1700 series—Cisco IOS Release 12.2(8)T or later release

•Cisco 2600 series—Cisco IOS Release 12.2(8)T or later release

•Cisco 3620—Cisco IOS Release 12.2(8)T or later release

•Cisco 3640—Cisco IOS Release 12.2(8)T or later release

•Cisco 3660—Cisco IOS Release 12.2(8)T or later release

•Cisco 7100 series VPN routers—Cisco IOS Release 12.2(8)T or later release

•Cisco 7200 series routers—Cisco IOS Release 12.2(8)T or later release

•Cisco 7500 series routers—Cisco IOS Release 12.2(8)T or later release

•Cisco uBR905 and Cisco uBR925 cable access routers—Cisco IOS Release 12.2(8)T or later release

•Cisco VPN 3000 series—Software Release 3.11 or later release

•Cisco PIX 500 series—Software Release 6.2 or later release

Digital Certificates Not Supported

In Cisco IOS Release 12.2(8)YJ, the Cisco Easy VPN Remote Phase II feature does not support authentication using digital certificates. Authentication is supported using preshared keys and Extended Authentication (XAUTH).

Only ISAKMP Policy Group 2 Supported on IPSec Servers

The Unity Protocol supports only ISAKMP policies that use group 2 (1024-bit Diffie-Hellman) IKE negotiation, so the IPSec server being used with the Cisco Easy VPN Remote Phase II feature must be configured for a group 2 ISAKMP policy. The IPSec server cannot be configured for ISAKMP group 1 or group 5 when being used with a Cisco Easy VPN Client.

Perfect Forward Secrecy Not Supported

The Cisco Easy VPN Remote Phase II feature does not support the Perfect Forward Secrecy (PFS) feature that is available on the Cisco VPN 3000 concentrator.

Transform Sets Supported

To ensure a secure tunnel connection, the Cisco Easy VPN Remote Phase II feature does not support transform sets that provide encryption without authentication (ESP-DES and ESP-3DES) or transform sets that provide authentication without encryption (ESP-NULL ESP-SHA-HMAC and ESP-NULL ESP-MD5-HMAC).

Changing the IP Address on the LAN Interface on Cisco 800 Series Routers

The Ethernet 0 LAN interface on the Cisco 800 series routers defaults to a primary IP address in the private network of 10.10.10.0. You can change this IP address to match the local network's configuration by using either the ip address CLI command or the Cisco Router Web Setup (CRWS) web interface.

These two techniques differ slightly in how the new IP address is assigned. When the CLI command is used, the new IP address is assigned as the primary address for the interface. When the CRWS interface is used, the new IP address is assigned as the secondary address and the existing IP address is preserved as the primary address for the interface. This allows the CRWS interface to maintain the existing connection between the PC web browser and the Cisco 800 series router.

Because of this behavior, the Cisco Easy VPN Remote Phase II feature assumes that if a secondary IP address exists on the Ethernet 0 interface, the secondary address should be used as the IP address for the inside interface for the NAT/PAT configuration. If no secondary address exists, the primary IP address is used for the inside interface address, as is normally done on other platforms. If this behavior is not desired, use the ip address CLI command to change the interface's address, instead of using the CRWS web interface.

VPN 3000 Configuration

The configuration of the Cisco VPN 3000 concentrator has some restrictions when used with the Cisco Easy VPN Remote Phase II feature. See the "Configuring the Cisco VPN 3000 Series Concentrator" section for more details.

See the "PIX Interoperability Support" section for information on Cisco PIX Firewall Version 6.2 support.

Related Documents

This section lists other documentation related to the configuration and maintenance of the Cisco Easy VPN Remote Phase II feature and the supported routers.

Platform-Specific Documentation

Cisco 800 Series Routers

•Cisco 806 Router Hardware Installation Guide

•Cisco 806 Router and SOHO 71 Router Hardware Installation Guide

•Cisco 826 Router Hardware Installation Guide

•Cisco 826 and SOHO76 Router Hardware Installation Guide

•Cisco 827 Router Hardware Installation Guide

•Cisco 827 and SOHO 77 Routers Hardware Installation Guide

•Cisco 828 and SOHO 78 Routers Hardware Installation Guide

•Cisco 806 Software Configuration Guide

•Cisco 827 Router Software Configuration Guide

•Cisco 828 Router and SOHO 78 Router Software Configuration Guide

Cisco uBR905 and Cisco uBR925 Cable Access Routers

•Cisco uBR925 Cable Access Router Hardware Installation Guide

•Cisco uBR905 Hardware Installation Guide

•Cisco uBR905/uBR925 Cable Access Router Software Configuration Guide

•Cisco uBR925 Cable Access Router Subscriber Setup Quick Start Card

•Cisco uBR905 Cable Access Router Subscriber Setup Quick Start Card

•Cisco uBR925 Cable Access Router Quick Start User Guide

Cisco 1700 Series Routers

•Cisco 1700 Series Router Software Configuration Guide

•Cisco 1710 Security Router Hardware Installation Guide

•Cisco 1710 Security Router Software Configuration Guide

•Cisco 1720 Series Router Hardware Installation Guide

•Cisco 1721 Access Router Hardware Installation Guide

•Cisco 1750 Series Router Hardware Installation Guide

•Cisco 1751 Router Hardware Installation Guide

•Cisco 1751 Router Software Configuration Guide

•Cisco 1760 Modular Access Router Hardware Installation Guide

Also see the Cisco IOS release notes for Cisco IOS Release 12.2(4)YA:

•SOHO 70 and Cisco 800 Series—Release Notes for Release 12.2(4)YA

•Release Notes for Cisco uBR905 and Cisco uBR925 Cable Access Routers for Cisco IOS Release 12.2 YA

•Cisco 1700 Series—Release Notes for Release 12.2(4)YA

IPsec and VPN Documentation

For information on the VPN Remote Access Enhancements feature, which provides Cisco Unity client support for the Cisco Easy VPN Remote Phase II feature, see the VPN Remote Access Enhancements feature module for Cisco IOS Release 12.2(8)T.

For general information on IPSec and VPN subjects, see the following information in the product literature and IP technical tips sections on Cisco.com:

•Deploying IPsec—Provides an overview of IPsec encryption and its key concepts, along with sample configurations. Also provides a link to many other documents on related topics.

•Certificate Authority Support for IPsec Overview—Describes the concept of digital certificates and how they are used to authenticate IPsec users.

•An Introduction to IP Security (IPsec) Encryption—Provides a step-by-step description of how to configure IPsec encryption.

The following technical documents, available on Cisco.com and the Documentation CD-ROM, also provide more in-depth configuration information:

•Cisco IOS Security Configuration Guide, Cisco IOS Release 12.2—Provides an overview of Cisco IOS security features.

•Cisco IOS Security Command Reference, Cisco IOS Release 12.2—Provides a reference for each of the Cisco IOS commands used to configure IPsec encryption and related security features.

•Cisco IOS Software Command Summary, Cisco IOS Release 12.2—Summarizes the Cisco IOS commands used to configure all Release 12.1 security features.

Note Additional documentation on IPSec becomes available on Cisco.com and the Documentation CD-ROM as new features and platforms are added. Cisco Press also publishes several books on IPSec—go to http://www.ciscopress.com for more information on Cisco Press books.

Supported Platforms

•Cisco 806, Cisco 826, Cisco 827, and Cisco 828 routers

•Cisco uBR905 and Cisco uBR925 cable access routers

•Cisco 1700 series routers

Determining Platform Support Through Feature Navigator

Cisco IOS software is packaged in feature sets that support specific platforms. To get updated information regarding platform support for this feature, access Feature Navigator. Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.

Feature Navigator is a web-based tool that enables you to quickly determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image.

To access Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions at http://www.cisco.com/register.

Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Feature Navigator home page at the following URL:

http://www.cisco.com/go/fn

Supported Standards, MIBs, and RFCs

Standards

No new or modified standards are supported by this feature.

MIBs

The following new or modified MIBs are supported by this feature:

•CISCO-IPSEC-FLOW-MONITOR-MIB—Contains attributes describing IPSec-based VPNs (IETF IPSec Working Group Draft).

•CISCO-IPSEC-MIB—Describes Cisco implementation-specific attributes for Cisco routers implementing IPSec VPNs.

•CISCO-IPSEC-POLICY-MAP-MIB—Extends the CISCO-IPSEC-FLOW-MONITOR-MIB to map dynamically instantiated structures to the policies, transforms, cryptomaps, and other structures that created or are using them.

To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

RFCs

No new or modified RFCs are supported by this feature.

Prerequisites

The following requirements are necessary to use the Cisco Easy VPN Remote Phase II feature:

•A Cisco 806, Cisco 826, Cisco 827, or Cisco 828 router; Cisco 1700 series router; or Cisco uBR905 or Cisco uBR925 cable access router running Cisco IOS Release 12.2(8)YJ or later, configured as a Cisco Easy VPN Client.

•Another Cisco router or VPN concentrator that supports the Cisco Easy VPN Server feature and configured as a VPN remote access server. See the "Required Destination Servers" section for a detailed list.

Configuration Tasks

See the following sections for configuration tasks for the Cisco Easy VPN Remote Phase II feature. Each task in the list is identified as either required or optional.

•Configuring Manual Tunnel Control (optional)

•Configuring Multiple Inside Interfaces (optional)

•Configuring Multiple Outside Interfaces (optional)

•Configuring Easy VPN Remote Using Cable DHCP Proxy (optional)

•Configuring Proxy DNS Server Support (optional)

•Configuring and Using the Cisco Easy VPN Remote Web Manager (optional)

•Configuring the DHCP Server Pool (required)

•Verifying the DHCP Server Pool (optional)

•Configuring and Assigning the Cisco Easy VPN Remote Configuration (required)

•Verifying the Cisco Easy VPN Configuration (optional)

•Configuring the Cisco VPN 3000 Series Concentrator (optional)

Configuring Manual Tunnel Control

To configure control of IPSec VPN tunnels manually so that you can establish and terminate the IPSec VPN tunnels on demand, use the following procedure beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto ipsec client ezvpn name

Assigns a Cisco Easy VPN Client configuration to an interface and enters Cisco Easy VPN Remote configuration mode. Specify the configuration name to be assigned to the interface.

Step 2 

Router(config-crypto-ezvpn)# connect [auto | manual]

Connects the VPN tunnel. Specify manual to configure manual tunnel control. Automatic is the default; you do not need to use this subcommand if your configuration is automatic.

Step 3 

Router(config-crypto-ezvpn)# exit

Exits Easy VPN Remote configuration mode.

Step 4 

Router(config)# exit

Exits global configuration mode and enters privileged EXEC mode.

Step 5 

Router# crypto ipsec client ezvpn connect name

Connects a given Cisco Easy VPN Remote Phase II configuration. Specify the IPSec VPN tunnel name.

Note If the tunnel name is not specified, the active tunnel is connected. If there is more than one active tunnel, the command fails with an error requesting that you specify the tunnel name.

Step 6 

Router# clear crypto ipsec client ezvpn [name]

(Optional) Disconnects a given Cisco Easy VPN Remote Phase II configuration. If the IPSec VPN tunnel name is specified, then that tunnel only is cleared. If no tunnel name is specified, then all active tunnels are cleared.

Note If the tunnel name is not specified, the active tunnel is disconnected. If there is more than one active tunnel, the command fails with an error requesting that you specify the tunnel name.

Configuring Multiple Inside Interfaces

You can configure up to three inside interfaces for all platforms. You need to manually configure each inside interface with the following procedure:

 
Command
Purpose

Step 1 

Router(config-if)# interface interface-name1

Selects the interface you want to configure by specifying the interface name.

Step 2 

Router(config-if)# crypto ipsec client ezvpn name1 [outside | inside]

Specifies the Cisco Easy VPN Remote configuration name to be assigned to the first inside interface. You must specify inside for each inside interface.

Step 3 

Router(config-if)# interface interface-name2

Selects the next interface you want to configure by specifying the next interface name.

Step 4 

Router(config-if)# crypto ipsec client ezvpn name2 [outside | inside]

Specifies the Cisco Easy VPN Remote configuration name to be assigned to the next inside interface. You must specify inside for each inside interface.

Repeat step 3 through step 4 to configure an additional tunnel if desired.

Configuring Multiple Outside Interfaces

You can configure multiple tunnels for outside interfaces, setting up a tunnel for each outside interface. You can configure a maximum of four tunnels using the following procedure for each outside interface:

 
Command
Purpose

Step 1 

Router(config-if)# interface interface-name1

Selects the first outside interface you want to configure by specifying the interface name.

Step 2 

Router(config-if)# crypto ipsec client ezvpn name1 [outside | inside]

Specifies the Cisco Easy VPN Remote configuration name to be assigned to the first outside interface. Specify outside (optional) for each outside interface.

If neither outside nor inside is specified for the interface, the default is outside.

Step 3 

Router(config-if)# interface interface-name2

Selects the next outside interface you want to configure by specifying the next interface name.

Step 4 

Router(config-if)# crypto ipsec client ezvpn name2 [outside | inside]

Specifies the Cisco Easy VPN Remote configuration name to be assigned to the next outside interface. Specify outside (optional) for each outside interface.

If neither outside nor inside is specified for the interface, the default is outside.

Repeat step 3 through step 4 to configure additional tunnels if desired.

Verifying Outside Interface Configuration

The following is a partial example show run output on a Cisco 1760 router that shows an outside interface configured on hw1: 

1760#sh runn 

Building configuration...

Current configuration : 1246 bytes 

! 

version 12.2 

service timestamps debug uptime 

service timestamps log uptime 

no service password-encryption 

! 

hostname 1760 

! 

aaa new-model 

! 

! 

aaa session-id common 

! 

ip subnet-zero 

! 

! 

! 

! 

! 

! 

! 

! 

!interface Serial1/0 

ip address 6.6.6.2 255.255.255.0 

clockrate 4000000 

no cdp enable 

crypto ipsec client ezvpn hw1 outside

!ip classless 

no ip http server 

ip pim bidir-enable 

! 

! 

! 

radius-server retransmit 3 

radius-server authorization permit missing Service-Type 

! 

line con 0 

line aux 0 

line vty 0 4 

! 

no scheduler allocate 

end

Configuring Easy VPN Remote Using Cable DHCP Proxy

You can configure the Cisco Easy VPN Remote feature to automatically obtain a public IP address, which is required to support a tunnel interface for the Cisco uBR905 and Cisco uBR925 cable access routers, and assign it to the router's loopback interface. Use the following steps:

1. Configure the loopback interface with the local-address subcommand to specify that the loopback interface IP address is used as the local address for tunnel traffic.

2. Configure the loopback interface with the cable-modem dhcp-proxy interface command to automatically assign the IP address to the loopback interface.

 
Command
Purpose

Step 1 

Router# config t

Enters global configuration mode.

Step 2 

Router(config)# crypto ipsec client ezvpn name

Specifies the Cisco Easy VPN Remote configuration name to be assigned to an interface and enters Cisco Easy VPN Remote configuration mode.

Step 3 

Router(config-crypto-ezvpn)# local-address interface-name

Specifies that the loopback interface IP address is used as the local address for tunnel traffic originating from or destined to that interface. The loopback interface, loopback0, is usually specified as the local address interface (interface-name) because the loopback interface never goes down.

Step 4 

Router(config-crypto-ezvpn)# exit

Exits Cisco Easy VPN Remote configuration mode and enters global configuration mode.

Step 5 

Router(config)# interface loopback0

Creates the loopback interface and enters interface configuration mode.

Step 6 

Router(config-if)# cable-modem dhcp-proxy interface loopback0

Automatically configures the loopback interface with a public IP address obtained from the DHCP server.

Configuring Easy VPN Remote with a Static IP Address

You can configure the Cisco Easy VPN Remote feature with a manually assigned public IP address, which is required to support a tunnel interface for the Cisco uBR905 and Cisco uBR925 cable access routers, and assign it to the router's loopback interface. Use the following steps:

1. Configure the loopback interface with the local-address subcommand to specify that the loopback interface IP address is used as the local address for tunnel traffic.

2. Manually assign an IP address to the loopback interface.

 
Command
Purpose

Step 1 

Router# config t

Enters global configuration mode.

Step 2 

Router(config)# crypto ipsec client ezvpn name

Specifies the Cisco Easy VPN Remote configuration name to be assigned to an interface and enters Cisco Easy VPN Remote configuration mode.

Step 3 

Router(config-crypto-ezvpn)# local-address interface-name

Specifies that the loopback interface IP address is used as the local address for tunnel traffic originating from or destined to that interface. The loopback interface, loopback0, is usually specified as the local address interface (interface-name) because the loopback interface never goes down.

Step 4 

Router(config-crypto-ezvpn)# exit

Exits Cisco Easy VPN Remote configuration mode and enters global configuration mode.

Step 5 

Router(config)# interface loopback0

Creates the loopback interface and enters interface configuration mode.

Step 6 

Router(config-if)# ip address A.B.C.D

Manually assign an IP address to the loopback interface. A.B.C.D is the IP address you manually assign to the loopback interface

Configuring Proxy DNS Server Support

As a way of implementing the use of the cable provider's DNS addresses when the WAN connection is down, the router in a Cisco Easy VPN Remote configuration can be configured to act as a proxy DNS server. To enable the proxy DNS server functionality with the ip dns server command in global configuration mode, use the following commands beginning in global configuration mode.

 
Command
Purpose

Step 1 

Router(config)# ip dns server

Enables the router to act as a proxy DNS server.

Step 2 

Router(config)# dns servers A.B.C.D

Configures the DNS server connected to the router's LAN interface. A.B.C.D is the IP address of the router's LAN interface.

Step 3 

Router(config)# dns-server A.B.C.D

(Optional) Manually configures the DHCP pool on the customer premises equipment (CPE). A.B.C.D is the IP address of the router's LAN interface.

After configuring the router, you configure the VPN remote access server as follows:

•Under the crypto isakmp client configuration group groupname

dns A.B.C.D A1.B1.C1.D1

These DNS server addresses should be pushed from the server to the Cisco Easy VPN Client, and be dynamically added to or deleted from the router's running configuration.

Verifying Proxy DNS Server Support

When the tunnel is connected (up), you can see the following entries in the running configuration: 

ip name-server A.B.C.D 

ip name-server A1.B1.C1.D1

When the tunnel is disconnected (down), you can see the following entries are deleted from the running configuration: 

ip name-server A.B.C.D 

ip name-server A1.B1.C1.D1

Configuring and Using the Cisco Easy VPN Remote Web Manager

To configure and use the Cisco Easy VPN Remote Web Manager for the Cisco uBR905 and Cisco uBR925 cable access routers, follow these steps:

1. Enter configuration informati