Table Of Contents
Site-to-Site VPN Configuration
Configuring Crypto Connections
Resetting the Tunnel Interface
Site-to-Site VPN Configuration
A Virtual Private Network (VPN) is an encrypted network connection between devices on a network and provides the same network connectivity for remote users over a public infrastructure as they would have over a private network. Site-to-site VPNs securely connect multiple fixed sites over a public network using IPSec technology.
CVDM-VPNSM allows you to manage and configure site-to-site VPNs on your device, which includes configuring crypto connections and GRE tunnels.
This chapter contains the following topics:
•
Configuring Site-to-Site VPNs
•
Configuring Site-to-Site VPNs
To view information about the site-to-site VPNs configured on the device, click Setup at the top of the window and click Site-to-Site from the left-most pane to display the main Site-to-Site VPN page (see Figure 3-1). This page displays all site-to-site crypto connections with and without crypto maps.
Figure 3-1 Site-to-Site VPN page
:
Configuring Crypto Connections
Click Setup at the top of the window, click Site-to-Site from the left-most pane, and select Crypto Connections from the selector to display the main Crypto Connections page.
Note
The upper portion of the Crypto Connections page contains a graphical display of the crypto connection configured on the device. The lower portion of the page shows the following information.
From this page, you can access functions to do the following:
•
•
•
Adding Crypto Connections
You can create crypto connections between the inside VLAN and the outside port on this site-to-site VPN.
Note
Step 1
Step 2
Step 3
Interface VLAN field
Specify the interface VLAN, which is the Layer 3 VLAN that contains only the VPN module inside port.
Before a router can forward the packets using the correct routing table entries, the router needs to know which interface that a packet was received on. For each port VLAN, you need to create another VLAN so that the packets from every switch outside port are presented to the router with the corresponding VLAN number.
Note
You can create a VLAN or select from an available VLAN.
Click
and do one of the following:
•
•
You can select Clear VLAN to clear the VLAN that is specified in this field.
IP Address field
Enter the IP address of the interface VLAN.
Mask list
Select the subnet mask of the interface VLAN from the list or enter it in the field.
Crypto Map field
Specify the crypto map attached to the interface VLAN. Click
You can also clear the crypto map entry by clicking
Note
Connection Mode radio button
Specify the connection mode; you can select the Access/Trunk radio button to specify an access port or trunk port as the outside port, or you can select the Routed Port radio button to specify a routed port as the outside port.
If you select the Access/Trunk radio button, do the following:
•
–
–
You can select Clear VLAN to clear the VLAN that is specified in this field.
•
to open the Port Selector dialog box. For more information, see Port Selector.
•
If you select the Routed Port radio button, you must select a routed port. From the Routed Port field, click
Standby Group Name field
Specify the Hot Standby Routing Protocol (HSRP) standby group name. Click
An HSRP group is a set of routers that work together as a single virtual router to the hosts on the network. The group name should be unique for all VLANs.
Standby IP Address field
Specify the IP address (instead of the VLAN IP address) that is used for the VPN connection.
Priority field
Enter the HSRP priority value. The default value is 100. The range of values you can use is 0 to 255.
The router with the highest priority immediately becomes the active router. Priority is determined first by the configured priority value, and then by the IP address. In each case, a higher value is of greater priority.
Preempt check box
Select this check box to enable HSRP preemption; this allows the device with highest priority to immediately become the active router. Priority is determined first by the HSRP priority value, then by IP address.
Next, do the following:
•
•
Minimum (Sec) field
Enter the time, in seconds, to postpone the local router from taking over the active role.
The default value is 1. The range of values you can use is 0 to 10000.
Reload (Sec) field
Enter the time, in seconds, to postpone the local router from taking over the active role after the router has reloaded. This delay value applies to the first interface-up event after the router has reloaded.
The default value is 5. The range of values you can use is 0 to 10000.
Hello Interval (Sec) field
Enter the time, in seconds, between hello packets before other devices declare the active router to be down.
The default value is 3. The range of values you can use is 1 to 254.
You can select the Millisecond check box to enter the hello interval in milliseconds. The range of values you can use is 15 to 254000.
Hold Time (Sec) field
Enter the hold time, in seconds, before other devices declare the active router to be down.
The default value is 10. The range of values you can use is 1 to 256.
You can select the Millisecond check box to enter the hold time in milliseconds. The range of values you can use is 50 to 256000.
Track Interfaces table
You can add interfaces and VLANs to track. Interface tracking allows you to specify another interface on the device for the HSRP process to monitor and to alter the HSRP priority for a given group. If the line protocol of the specified interface goes down, the HSRP priority of this device is reduced, allowing another HSRP device with higher priority to become active.
You can do the following:
•
•
•
Step 4
VLAN Selector
This dialog box displays the available VLANs that you can select from. Select a VLAN from the table and click OK.
Create VLAN Dialog Box
This dialog box allows you to create a new VLAN. Enter the following information and click OK.
VLAN ID
Enter the ID number of the VLAN.
VLAN Name
Enter the name of the VLAN.
Media Type
Type of VLAN.
Port Selector
The Port Selector allows the user to browse and select ports for configuration. The following table describes how to use the Port Selector.
Available Ports column
The table in the Available Ports column displays all physical ports that are available and supported on this switch. It displays ports that are associated with the selected port connection mode.
From the table, select the port you want to configure. To select multiple ports, press the Ctrl key as you select random ports or press the Shift key as you select contiguous ports to configure.
Note
Depending on what type of port you select, the table in the Available Ports column may contain the following columns:
•
•
•
•
•
Add>> button
With ports selected in the Available Ports column, click to add selected ports to the Selected Port(s) column.
<<Remove button
With ports selected in the Selected Port(s) table, click to remove selected ports from that table.
Clear All button
Click to remove all ports listed in the Selected Port(s) table and put them back in the Available Ports table.
Selected Port(s) column
Displays all selected ports. With either Access or Trunk port mode selected, the ports listed here are assigned to the VLAN specified in the VLAN field.
The Name field indicates the name of a selected port.
Note
Select Crypto Map Dialog Box
This dialog box is launched from several pages; use this dialog box to select a crypto map.
Select Routed Port Dialog Box
Use this dialog box to select a routed port.
Select HSRP Group Dialog Box
This dialog box appears when you are specifying an HSRP standby group. This dialog box contains a table that displays the following information:
Select Interfaces to Track Dialog Box
This dialog box appears when you add an interface to track for HSRP.
Interfaces column
The table in the Interfaces column, displays all interfaces and VLANs on the device.
From the table, select the interface you want to configure. To select multiple interfaces, press the Ctrl key as you select random interfaces or press the Shift key as you select contiguous interfaces to configure.
When you select an interface to track, the table displays the following columns:
•
•
•
When you select a VLAN to track, the table displays the following column:
•
Add>> button
With interfaces selected in the Interfaces column, click to add selected interfaces to the Tracked Interfaces table.
<<Remove button
With interfaces selected, click to remove selected interfaces from that table.
Clear All button
Click to remove all interfaces listed in the Tracked Interfaces table and put them back in the Available Ports table.
Tracked Interfaces table
Displays all selected interfaces to track. The Name column indicates the name of a selected interface.
Interface tracking allows you to specify another interface on the device for the HSRP process to monitor and alter the HSRP priority for a given group. If the line protocol of the specified interface goes down, the HSRP priority of this device is reduced, allowing another HSRP device with higher priority to become active.
Editing Crypto Connections
You can edit crypto connections between the inside VLAN and the outside port on this site-to-site VPN.
Step 1
Step 2
Step 3
Interface VLAN field
Interface VLAN ID. You cannot edit this field.
IP Address field
Enter the IP address of the interface VLAN.
Mask list
Select the subnet mask of the interface VLAN from the list or enter it in the field.
Crypto Map field
Specify the crypto map attached to the interface VLAN. Click
You can also clear the crypto map entry by clicking
Note
Connection Mode radio button
Specify the connection mode; you can select the Access/Trunk radio button to specify an access port or trunk port as the outside port, or you can select the Routed Port radio button to specify a routed port as the outside port.
If you select the Access/Trunk radio button, do the following:
•
–
–
You can select Clear VLAN to clear the VLAN that is specified in this field.
•
•
If you select the Routed Port radio button, you must select a routed port. From the Routed Port field, click
Standby Group Name field
Specify the Hot Standby Routing Protocol (HSRP) standby group name. Click
An HSRP group is a set of routers that work together as a single virtual router to the hosts on the network. The group name should be unique for all VLANs.
Standby IP Address field
Specify the IP address (instead of the VLAN IP address) that is used for the VPN connection.
Priority field
Enter the HSRP priority value. The default value is 100. The range of values you can use is 0 to 255.
The router with the highest priority immediately becomes the active router. Priority is determined first by the configured priority value, and then by the IP address. In each case, a higher value is of greater priority.
Preempt check box
Select this check box to enable HSRP preemption; this allows the device with highest priority to immediately become the active router. Priority is determined first by the HSRP priority value, then by IP address.
Next, do the following:
•
•
Minimum (Sec) field
Enter the time, in seconds, to postpone the local router from taking over the active role.
The default value is 1. The range of values you can use is 0 to 10000.
Reload (Sec) field
Enter the time, in seconds, to postpone the local router from taking over the active role after the router has reloaded. This delay value applies to the first interface-up event after the router has reloaded.
The default value is 5. The range of values you can use is 0 to 10000.
Hello Interval (Sec) field
Enter the time, in seconds, between hello packets before other devices declare the active router to be down.
The default value is 3. The range of values you can use is 1 to 254.
You can select the Millisecond check box to enter the hello interval in milliseconds. The range of values you can use is 15 to 254000.
Hold Time (Sec) field
Enter the hold time, in seconds, before other devices declare the active router to be down.
The default value is 10. The range of values you can use is 1 to 256.
You can select the Millisecond check box to enter the hold time in milliseconds. The range of values you can use is 50 to 256000.
Track Interfaces table
You can add interfaces and VLANs to track. Interface tracking allows you to specify another interface on the device for the HSRP process to monitor and to alter the HSRP priority for a given group. If the line protocol of the specified interface goes down, the HSRP priority of this device is reduced, allowing another HSRP device with higher priority to become active.
You can do the following:
•
•
•
Step 4
Deleting Crypto Connections
Step 1
Step 2
Step 3
Configuring GRE Tunnels
A tunnel is an encapsulated traffic flow. Generic routing encapsulation (GRE) is a tunneling protocol that can encapsulate different protocol packet types inside encrypted IP packets.
You configure GRE tunnels using CVDM-VPNSM for traffic flow on your site-to-site VPNs.
Click Setup at the top of the window, click Site-to-Site from the left-most pane, and select GRE from the selector.
The GRE Tunnels page is displayed and shows the following information.
From this page, you can access functions to do the following:
•
•
•
•
Adding GRE Tunnels
Note
Note
Step 1
Step 2
Step 3
Tunnel Interface field
Name of the tunnel interface. This field cannot be edited.
IP Address field
Enter the IP address of the tunnel interface.
Mask list
Enter the subnet mask address. of the tunnel interface.
Keepalive field
Enter the tunnel keepalive value, in seconds; this is the number of seconds that the device waits between sending keepalive packets on the tunnel.
The default value is 10. The range of values you can use is 0 to 32767.
MTU field
Enter the maximum transmission unit (MTU) value, in kilobytes, of the data packets that can be sent on the tunnel.
The default value is 1514. The range of values you can use is 256 to 1000000.
Destination IP Address field
Specify the IP address of the destination on the GRE tunnel.
Source VLAN field
Specify the source VLAN.
Click
Routes table
Contains the following columns:
•
•
•
From this table, you can do the following:
•
•
Step 4
Add Static Route Dialog Box
This dialog box appears when you add a static route to a GRE tunnel.
Edit Static Route Dialog Box
This dialog box appears when you edit a static route on a GRE tunnel.
Editing GRE Tunnels
Step 1
Step 2
Step 3
Tunnel Interface field
Name of the tunnel interface. This field cannot be edited.
IP Address field
Enter the IP address of the tunnel interface.
Mask list
Enter the subnet mask address. of the tunnel interface.
Keepalive field
Enter the tunnel keepalive value, in seconds; this is the number of seconds that the device waits between sending keepalive packets on the tunnel.
The default value is 10. The range of values you can use is 0 to 32767.
MTU field
Enter the maximum transmission unit (MTU) value, in kilobytes, of the data packets that can be sent on the tunnel.
The default value is 1514. The range of values you can use is 256 to 1000000.
Destination IP Address field
Specify the IP address of the destination on the GRE tunnel.
Source VLAN field
Specify the source VLAN.
Click
Routes table
Contains the following columns:
•
•
•
From this table, you can do the following:
•
•
Step 4
Deleting GRE Tunnels
Step 1
Step 2
Step 3
Resetting the Tunnel Interface
You can shut down a tunnel interface and then restart it.
CVDM-VPNSM issues a shutdown command (# shutdown), followed by a no shutdown command (# no shutdown).
CVDM-VPNSM then refreshes and updates the Admin and Oper Status values.
Note
