-
User Guide for Cisco Security Manager 3.2
-
Preface
-
Getting Started with Security Manager
-
Managing User Accounts
-
Working with the Security Manager User Interface
-
Using Map View
-
Preparing Devices for Management
-
Managing the Device Inventory
-
Managing Policies
-
Managing Activities
-
Managing Objects
-
Managing Site-to-Site VPNs
-
Managing Remote Access VPNs
-
Managing SSL VPNs
-
Managing Firewall Services
-
Managing IPS Services
-
Managing Routers
-
Managing Firewall Devices
-
Managing Cisco Catalyst Switches and Cisco 7600 Series Routers
-
Managing IPS Devices
-
Managing Deployment
-
Managing FlexConfigs
-
Managing the Security Manager Server
-
Using Monitoring, Troubleshooting, and Diagnostic Tools
-
Administrative Settings User Interface Reference
-
Map View User Interface Reference
-
Device Inventory User Interface Reference
-
Policy User Interface Reference
-
Activities User Interface Reference
-
Policy Object Manager User Interface Reference
-
Site-to-Site VPN User Interface Reference
-
Remote Access VPN User Interface Reference
-
SSL VPN User Interface Reference
-
Firewall Services User Interface Reference
-
Router Platform User Interface Reference
-
PIX/ASA/FWSM Platform User Interface Reference
-
Catalyst Platform User Interface Reference
-
IPS User Interface Reference
-
Deployment User Interface Reference
-
FlexConfig User Interface Reference
-
Index
-
Table Of Contents
Remote Access VPN User Interface Reference
Remote Access Configuration Wizard
Tunnel Group Editor Dialog Box
Tunnel Group Editor > General Tab
Tunnel Group Editor > IPsec Tab
Tunnel Group Editor > Advanced Tab
Tunnel Group Editor > Client VPN Software Update Tab
Remote Access VPN Defaults Page
IPsec Proposal Editor Dialog Box (for PIX and ASA Devices)
IPsec Proposal Editor Dialog Box (for IOS Routers and Catalyst 6500/7600 Devices)
VPNSM/VPN SPA Settings Dialog Box
FWSM Settings Tab (IPsec Proposal Editor)
Dynamic VTI/VRF Aware IPsec Tab (IPsec Proposal Editor)
Public Key Infrastructure Page
DN Rule Dialog Box (Upper Pane)
DN Rule Dialog Box (Lower Pane)
Remote Access VPN User Interface Reference
The pages that you access by selecting the Remote Access VPN folder from the Policy selector in Device View enable you to configure remote access VPNs. The following topics describe the pages that help you configure remote access VPNs for Cisco IOS security routers, PIX Firewalls, Catalyst 6500 /7600 devices, and Adaptive Security Appliance (ASA) devices and the policies that will be assigned to them.
Note
You must have read-write permissions to modify a remote access VPN policy. For more information, see Modify Policies Permissions, page 2-13.
You can also discover policies on devices in remote access VPNs that are already deployed in your network, so that Security Manager can manage them. For more information, see Discovering Remote Access VPN Policies, page 11-2.These topics describe the main pages available from the Remote Access VPN folder:
•
•
•
•
Remote Access Configuration Wizard
Use the Remote Access Configuration wizard to configure your device with the policies that enable it to act as a remote access VPN server.
Depending on the device type, you must configure a user group or tunnel group policy first. A user group policy is configured on an IOS security router, PIX Firewall, or Catalyst 6500/7600 device. Tunnel group policies are configured on ASA devices or PIX Firewalls version 7.0. Other policies are then assigned to the device. These can be factory default policies provided by Security Manager or shared policies that were created in Security Manager. See Assigning the Default Remote Access VPN Policies, page 11-11.
Note
The following topics describe the steps in the Remote Access Configuration wizard:
•
Tip
Navigation Path
1.
2.
3.
Related Topics
•
User Group Policy Page
Use the User Group Policy page to specify the user groups you want to use for your remote access VPN server.
Note
Navigation Path
Do one of the following in Device view:
•
•
Note
Related Topics
•
•
•
•
•
Field Reference
Tunnel Group Policy Page
Use the Tunnel Group Policy page to view the tunnel group policies defined on your remote access VPN server. From this page, you can create tunnel group policies or edit existing policies.
Note
Navigation Path
Do one of the following in Device view:
•
•
Note
Related Topics
•
•
•
•
Field Reference
Table H-2 Tunnel Group Policy (PIX 7.0/ASA) Page
Tunnel Group Name
The name of the tunnel group that contains the policies for the tunnel connection.
Group Policy Name
The name of the group policy to be applied to the tunnel group.
A group policy is a collection of user-oriented attribute/value pairs stored either internally on the device or externally on a RADIUS server.
Create button
Click to create a tunnel group policy. The Tunnel Group Policy Editor dialog box opens. See Tunnel Group Editor Dialog Box.
Edit button
Select the row of a tunnel group in the table, then click to open the Tunnel Group Policy Editor dialog box for editing the selected tunnel group. See Tunnel Group Editor Dialog Box.
Delete button
Select the rows of one or more tunnel groups, then click to delete.
Save button
Available if you opened this page from the Remote Access VPN Policies folder, and if you are authorized to modify this policy.
Saves your changes to the server but keeps them private.
Note
Tunnel Group Editor Dialog Box
Use the Tunnel Group Editor dialog box to create or edit tunnel group policies on your remote access VPN server.
Note
The following tabs are available on the Tunnel Group Policy Editor dialog box:
•
•
•
•
Navigation Path
Open the Tunnel Group Policy Page, then click Create, or select a device in the table and click Edit. For more information, see Table H-2.
Related Topics
•
•
•
Tunnel Group Editor > General Tab
Use the General tab of the Tunnel Group Policy Editor to specify the global AAA settings for your tunnel group. On this tab you can also select the method (or methods) of address assignment to use.
Navigation Path
Open the Tunnel Group Editor Dialog Box, or click the General tab from any other tab on the Tunnel Group Policy Editor.
Related Topics
•
•
•
•
•
•
Field Reference
Table H-3 Tunnel Group Editor Dialog Box > General Tab
Tunnel Group Name
The name of the tunnel group that contains the policies for this IPsec connection.
Group Policy
The group policy to be applied to the tunnel group. A group policy is a collection of user-oriented attribute/value pairs stored either internally on the device or externally on a RADIUS server.
Click Select to open a dialog box that lists all available ASA user groups and enables you to create an ASA group policy object.
Authentication Server Group
The name of the authentication server group (LOCAL if the users are defined on the local device).
Note
Click Select to open a dialog box that lists all available AAA server groups and enables you to create AAA server group objects.
Note
If an AAA server with SDI protocol is selected, RADIUS SDI authentication is enabled. For more information, see Tunnel Group Policies in Remote Access VPNs, page 11-8.User LOCAL if Server Group fails
When selected, enables fallback to the local database for authentication, if the selected authentication server group fails.
Authorization Server Group
The name of the authorization server group (LOCAL, external server, or none).
Click Select to open a dialog box that lists all available AAA server groups and enables you to create AAA server group objects.
User must exist in the authorization database to connect
When selected, specifies that the username of the remote client must exist in the database so that a successful connection can be established. If the username does not exist in the authorization database, then the connection is denied.
Accounting Server Group
The name of the accounting server group (LOCAL, external server, or none).
Click Select to open a dialog box that lists all available AAA server groups and enables you to create AAA server group objects.
Strip Realm from Username
When selected, removes the realm from the username before passing the username to the AAA server. A realm is an administrative domain. Enabling this option allows the authentication to be based on the username alone.
You must select this check box if your AAA server cannot parse delimiters.
Strip Group from Username
When selected, removes the group name from the username before passing the username to the AAA server. Enabling this option allows the authentication to be based on the username alone.
You must select this check box if your server cannot parse delimiters.
DHCP Server
The servers to use for client address assignments. The server uses the DHCP servers in the order listed. You can add up to 10 servers.
The DHCP Server field displays a default DHCP server. DHCP servers are network objects. If you want to use a different DHCP server, or select additional DHCP servers, click Select to open the Network/Hosts selector that lists all available network hosts and enables you to create network host objects.
Address Pools
The local address pools from which IP addresses will be assigned. The server uses these pools in the order listed. If all addresses in the first pool have been assigned, it uses the next pool, and so on. You can specify up to 6 pools.
Address pools are predefined network objects. If you want to use a different address pool, or select additional address pools, click Select to open the Network/Hosts selector that lists all available network hosts and enables you to create network host objects.
OK button
Saves your changes locally on the client and closes the dialog box.
Tunnel Group Editor > IPsec Tab
Use the IPsec tab of the Tunnel Group Policy Editor to specify IPsec and IKE parameters for the tunnel group policy.
Navigation Path
Open the Tunnel Group Editor Dialog Box, then click the IPsec tab.
Related Topics
•
•
•
Field Reference
Table H-4 Tunnel Group Editor Dialog Box > IPsec Tab
Preshared Key
The value of the preshared key for the tunnel group. The maximum length of a preshared key is 128 characters.
Trustpoint Name
Select the trustpoint name if any trustpoints are configured, and if certificates are to be used for authentication. A trustpoint represents a CA/identity pair and contains the identity of the CA, CA-specific configuration parameters, and an association with one enrolled identity certificate.
IKE Peer ID Validation
Select whether IKE peer ID validation is ignored, required, or checked only if supported by a certificate. During IKE negotiations, peers must identify themselves to one another.
Note
Enable sending certificate chain
When selected, enables the sending of the certificate chain for authorization. A certificate chain includes the root CA certificate, identity certificate, and key pair.
Enable password update with RADIUS authentication
When selected, enables passwords to be updated with the RADIUS authentication protocol.
For more information, see Supported AAA Server Types, page 9-23.
Monitor Keep Alive
When selected (the default), enables you to configure IKE keepalive as the default failover and routing mechanism. For more information, see Understanding ISAKMP/IPsec Settings, page 10-78.
Note
Confidence Interval
The number of seconds that a device waits between sending IKE keepalive packets. The default is 300 seconds.
Retry Interval
The number of seconds a device waits between attempts to establish an IKE connection with the remote peer. The default is 2 seconds.
User Entire DN as the Username
Select to use the entire distinguished name (DN) as the identifier for the username.
A distinguished name (DN) is a unique identification, made up of individual fields, that can be used as the identifier when matching users to a tunnel group. Distinguished name (DN) rules are used for enhanced certificate authentication on PIX Firewalls and ASA devices.
For more information, see DN Matching Policies, page 11-31.
Specify individual DN fields as the username
When selected (the default), enables you to use individual DN fields as the username when matching users to the tunnel group.
A DN certificate is made up of different field identifiers that can be used to match users to tunnel groups.
Primary DN Field
Available if you selected the option to use individual DN fields as the username.
Select the primary DN field identifier to be used for identification from the list. The default is UID (User ID).
Secondary DN Field
Available if you selected the option to use individual DN fields as the username.
Select the secondary DN field identifier to be used for identification, from the list. Select None if no secondary field identifier is required.
OK button
Saves your changes locally on the client and closes the dialog box.
Tunnel Group Editor > Advanced Tab
Use the Advanced tab of the Tunnel Group Policy Editor to specify interface-specific information for your tunnel group.
Navigation Path
Open the Tunnel Group Editor Dialog Box, then click the Advanced tab.
Related Topics
•
•
•
•
•
•
Field Reference
Tunnel Group Editor > Client VPN Software Update Tab
Use the Client VPN Software Update tab of the Tunnel Group Policy Editor to view and edit the client type, VPN client revisions, and image URL for each client VPN software package installed.
Navigation Path
Open the Tunnel Group Editor Dialog Box, then click the Client VPN Software Update tab.
Related Topics
•
•
•
Field Reference
Remote Access VPN Defaults Page
Use the VPN Defaults page of the Remote Access Configuration wizard to view and select the default policies that will be assigned to the device you are configuring as a remote access VPN server.
The page displays all the available policy types that can be assigned to your device. Each policy type has a list from which you can select to assign either the factory default or a shared policy that was created (and submitted or approved, depending on the workflow mode) using Security Manager.
Navigation Path
•
Related Topics
•
•
Field Reference
Table H-7 Remote Access Configuration Wizard > VPN Defaults Page
Policy type
For each policy type, select the default remote access VPN policy to assign to your device.
You can accept the Factory Default policy or select a shared VPN policy that appears in the list.
Note
View Content button
Opens a page that displays the contents of the selected remote access VPN policy.
Note
IPsec Proposal Page
An IPsec proposal defines the external interface through which remote access clients connect to the server, and the encryption and authentication algorithms used to protect the data in the VPN tunnel.
Use the IPsec Proposal page to create or edit IPsec policy definitions for your remote access VPN. For more information on IPsec proposals, see Understanding IPsec Tunnel Policies, page 10-72 and About Crypto Maps, page 10-73.
Navigation Path
1.
2.
3.
Note
Related Topics
•
•
•
•
•
•
Field Reference
Table H-8 IPsec Proposal Page
Endpoint
The external interface (or inside VLAN for a Catalyst 6500/7600 device) through which remote access clients will connect to the server.
Transform Sets
The transform set(s) selected for the policy (the default is tunnel_3des_sha).
Transform sets specify which authentication and encryption algorithms will be used to secure the traffic in the tunnel.
RRI
Shows whether Reverse Route Injection (RRI) is enabled or disabled on the crypto map for the support of VPN clients.
For more information, see About Reverse Route Injection, page 10-75.
AAA Authorization
Supported on Cisco IOS routers and Catalyst 6500 /7600 devices only.
Displays the selected AAA server groups for authorization.
AAA Authorization defines the order in which group policies are searched and whether they are configured on the local server or on an external AAA server.
AAA Authentication
Supported on Cisco IOS routers and Catalyst 6500 /7600 devices only.
Displays selected AAA server groups for authentication.
AAA authentication is required to enable IKE Extended Authentication (Xauth) as the user authentication method. It determines the username and password storage location. Usernames and passwords can be stored on the device (local) or on an external AAA server, which can provide authentication to numerous other databases.
VRF
Supported on Cisco IOS routers and Catalyst 6500 /7600 devices only.
Shows whether VRF settings for the proposal are enabled or disabled. For more information, see Understanding VRF-Aware IPsec, page 10-51.
DVTI
Supported on Cisco IOS routers only.
Shows whether a dynamic virtual template interface is configured on the device. For more information, see PVC Dialog Box—QoS Tab, page K-63.
Create button
Click to open the IPsec Proposal Editor dialog box to create an IPsec proposal.
If the device is a PIX Firewall or ASA device, see IPsec Proposal Editor Dialog Box (for PIX and ASA Devices).
If the device is a Cisco IOS router or Catalyst 6500/7600, see IPsec Proposal Editor Dialog Box (for IOS Routers and Catalyst 6500/7600 Devices).
Edit button
Select the row of a proposal from the table, then click to open the IPsec Proposal Editor dialog box to edit the selected proposal.
If the device is a PIX Firewall or ASA device, see IPsec Proposal Editor Dialog Box (for PIX and ASA Devices).
If the device is a Cisco IOS router or Catalyst 6500/7600, see IPsec Proposal Editor Dialog Box (for IOS Routers and Catalyst 6500/7600 Devices).
Delete button
Select the rows of one or more proposals, then click to delete.
Save button
Available only if you are authorized to modify this policy.
Saves your changes to the server but keeps them private.
Note
IPsec Proposal Editor Dialog Box (for PIX and ASA Devices)
Use the IPsec Proposal Editor to create or edit an IPsec proposal for a device in your remote access VPN.
The elements in this dialog box differ according to the selected device. Table H-9 describes the elements in the IPsec Proposal Editor dialog box when a PIX 7.0 or ASA device is selected.
Note
Navigation Path
Open the IPsec Proposal Page, then click Create, or select a proposal from the list and click Edit.
Related Topics
•
•
•
•
Field Reference
Table H-9 IPsec Proposal Editor (for PIX and ASA Devices)
External Interface
The external interface (endpoint) through which remote access clients connect to the server.
An endpoint can be an interface or a set of interfaces that are defined by a particular interface role. Click Select to open a dialog box that lists all available interfaces and sets of interfaces defined by interface roles, and enables you to create interface role objects.
Transform Sets
The transform set or sets to use for your tunnel policy (the default is tunnel_3des_sha).
Transform sets specify which authentication and encryption algorithms will be used to secure the traffic in the tunnel.
A default transform set is displayed. If you want to use a different transform set or select additional transform sets, click Select to open a dialog box that lists all available transform sets and enables you to create transform set objects. For more information, see IPsec Transform Sets Page, page F-467.
If more than one of your selected transform sets is supported by both peers, the transform set that provides the highest security will be used.
Note
For more information, see About Transform Sets, page 10-74.
Reverse Route Injection
Note
Select the required option to configure Reverse route Injection (RRI) on the crypto map in your tunnel policy:
•
•
For more information, see About Reverse Route Injection, page 10-75.
Enable Network Address Translation Traversal
Note
When selected (the default), enables you to configure NAT traversal on the device.
You use NAT traversal when a device (referred to as the middle device) is located between a VPN-connected hub and spoke, that performs NAT on the IPsec flow.
For more information, see Understanding NAT, page 10-79.
User Authentication (Xauth)/AAA Authentication Method
Note
The AAA or Xauth user authentication method that defines the order in which user accounts are searched.
Xauth allows all Cisco IOS software AAA authentication methods to perform user authentication in a separate phase after the IKE authentication phase 1 exchange.
Click Select to open a dialog box that lists all available AAA server groups and enables you to create AAA server group objects.
OK button
Saves your changes locally on the client and closes the dialog box.
The changes appear in the table of the IPsec Proposal page.
IPsec Proposal Editor Dialog Box (for IOS Routers and Catalyst 6500/7600 Devices)
Use the IPsec Proposal Editor to create or edit an IPsec proposal for a device in your remote access VPN.
If you select an IOS router, the IPsec Proposal Editor dialog box displays two tabs—General and Dynamic VTI/VRF Aware IPsec. If you select a Catalyst 6500/7600, the FWSM Settings tab is also displayed.
Click the appropriate tab to specify general IPsec settings, configure Dynamic VTI or VRF Aware IPsec, or both, on the selected device, or configure FWSM on a Catalyst 6500/7600 device.
Navigation Path
Open the IPsec Proposal Page, then click Create, or select a proposal from the list and click Edit. The IPsec Proposal Editor dialog box opens, displaying the General tab.
Related Topics
•
•
•
•
•
•
Field Reference
Table H-10 describes the elements in the General tab of the IPsec Proposal Editor dialog box, if you selected an IOS router or Catalyst 6500/7600.
Note
Table H-10 IPsec Proposal Editor > General Tab
External Interface
The external interface through which remote access clients will connect to the server.
An external interface can be defined by a specific interface role. Interface roles are predefined objects. Click Select to open a dialog box that lists all available interfaces and sets of interfaces defined by interface roles, and enables you to create interface role objects.
Inside VLAN
Note
The inside VLAN that serves as the inside interface to the VPN Services Module (VPNSM) or VPN SPA.
Click Select to open a dialog box in which you define the settings that enable you to configure a VPN Services Module (VPNSM) external interface or a VPN SPA blade on the Catalyst 6500/7600 device. See VPNSM/VPN SPA Settings Dialog Box.
For information about configuring a VPNSM, see Configuring a Catalyst VPN Services Module (VPNSM) VPN Interface, page 10-39.
For information about configuring a VPN SPA, see Configuring a Catalyst VPN Shared Port Adapter (VPN SPA) Blade, page 10-41.
Transform Sets
The transform set or sets to use for your tunnel policy. Transform sets specify which authentication and encryption algorithms are used to secure the traffic in the tunnel.
A default transform set is displayed. If you want to use a different transform set or select additional transform sets, click Select to open a dialog box that lists all available transform sets and enables you to create transform set objects. For more information, see IPsec Transform Sets Page, page F-467.
If more than one of your selected transform sets is supported by both peers, the transform set that provides the highest security is used.
Note
For more information, see About Transform Sets, page 10-74.
Reverse Route Injection
Select one of the following options to configure Reverse Route Injection (RRI) on the crypto map:
•
•
•
•
Note
For more information, see About Reverse Route Injection, page 10-75.
Group Policy Lookup/AAA Authorization Method
The AAA authorization method list that defines the order in which the group policies are searched. Group policies can be configured on the local server or on an external AAA server.
Note
Click Select to open a dialog box that lists all available AAA server groups and enables you to create AAA server group objects.
User Authentication (Xauth)/AAA Authentication Method
The AAA or Xauth user authentication method that defines the order in which user accounts are searched.
Note
Xauth allows all Cisco IOS software AAA authentication methods to perform user authentication in a separate phase after the IKE authentication phase 1 exchange.
For more information about defining user accounts, see Defining Accounts and Credential Policies, page 15-73.
Click Select to open a dialog box that lists all available AAA server groups and enables you to create AAA server group objects.
OK button
Saves your changes locally on the client and closes the dialog box.
The changes appear in the table of the IPsec Proposal page.
VPNSM/VPN SPA Settings Dialog Box
Note
Use the VPNSM/VPN SPA Settings dialog box to specify the settings for configuring a VPN Services Module (VPNSM) or a VPN Shared Port Adapter (VPN SPA) on a Catalyst 6500/7600 device.
Note
Before you configure VPNSM or VPN SPA with VRF-Aware IPsec on a device, verify that an IPsec proposal with VRF-Aware IPsec and an IPsec proposal without VRF-Aware IPsec were not configured on the device.For more information about VPNSM, see Configuring a Catalyst VPN Services Module (VPNSM) VPN Interface, page 10-39.
For more information about VPN SPA, see Configuring a Catalyst VPN Shared Port Adapter (VPN SPA) Blade, page 10-41.
Navigation Path
1.
2.
Related Topics
•
•
•
Field Reference
FWSM Settings Tab (IPsec Proposal Editor)
Note
Use the FWSM tab of the IPsec Proposal Editor dialog box to specify settings that enable you to connect between a Firewall Services Module (FWSM) and an IPsec VPN Services Module (VPNSM) or VPN SPA blade that is already configured on a Catalyst 6500/7600 device.
For more information, see Configuring a Firewall Services Module (FWSM) Interface with VPNSM or VPN SPA, page 10-48.
Note
For more information, see:Configuring a Firewall Services Module (FWSM) Interface with VPNSM or VPN SPA, page 10-48
Discovering Policies, page 7-7
Creating or Editing VLANs, page 17-14Navigation Path
1.
2.
Related Topics
•
•
•
Field Reference
Table H-12 IPsec Proposal Editor > FWSM Tab
Enable FWSM Settings
When selected, enables you to configure the connection between the FWSM and the VPNSM or VPN SPA on the selected Catalyst 6500/7600 device.
FWSM Inside VLAN
The VLAN that serves as the inside interface to the Firewall Services Module (FWSM).
If required, click Select to open a dialog box that lists all available interfaces and sets of interfaces defined by interface roles, and in which you can make your selection, or create interface role objects.
FWSM Blade
From the list of available blades, select the blade number to which the selected FWSM inside VLAN interface is connected.
Security Context
You can partition an FWSM into multiple virtual firewalls, known as security contexts. Each security context has its own security policy, interfaces, and administrators. You can define security contexts when you import a Catalyst 6500/7600 device into the Security Manager inventory.
If the selected FWSM inside VLAN is part of a security context, enter its name in this field. The name is case-sensitive.
For more information, see Security Contexts Page, page L-275.
OK button
Saves your changes locally on the client and closes the dialog box.
Dynamic VTI/VRF Aware IPsec Tab (IPsec Proposal Editor)
Note
Use the Dynamic VTI/VRF Aware IPsec tab of the IPsec Proposal Editor to configure VRF Aware IPsec settings (on a Cisco IOS router or Catalyst 6500/7600 device), configure a dynamic virtual interface on a Cisco IOS router, or do both, in your remote access VPN.
For more information, see:
•
•
Navigation Path
1.
2.
Related Topics
•
•
•
•
Field Reference
Table H-13 IPsec Proposal Editor > Dynamic VTI/VRF Aware IPsec Tab
Enable Dynamic VTI
When selected, enables Security Manager to implicitly create a dynamic virtual template interface on an IOS router.
Note
For more information, see PVC Dialog Box—QoS Tab, page K-63.
Enable VRF Settings
When selected, enables you to configure VRF settings on the device for the selected hub-and-spoke topology.
Note
User Group
When you configure a remote access VPN server, remote clients must have the same group name as the user group object configured on the VPN server so that they can connect to the device.
Select the name of the user group associated with the device.
If the user group is not included in the list, click Select to open a dialog box that lists all available user groups and enables you to create a user group object.
CA Server
Select the Certification Authority (CA) server to use for managing certificate requests for the device.
If the required CA server is not included in the list, click Select to open a dialog box that lists all available CA servers and enables you to create a PKI enrollment object. For more information, see PKI Enrollment Dialog Box, page F-481.
For more information about IPsec configuration with CA servers, see Public Key Infrastructure Policies in Remote Access VPNs, page 11-25.
Specify Virtual Template IP
Available if you selected the Enable Dynamic VTI check box.
Specify the virtual template interface to use by clicking one of the following radio buttons:
•
If required, click Select to open the Network/Hosts selector in which you can select a host to be used as the IP address.
•
Note
VRF Solution
Available if you selected the Enable VRF Settings check box.
Click one of the following radio buttons to configure the required VRF solution:
•
•
VRF Name
The name of the VRF routing table on the IPsec Aggregator. The VRF name is case-sensitive.
Route Distinguisher
The unique identifier of the VRF routing table on the IPsec Aggregator.
This unique route distinguisher maintains routing separation for each VPN across the MPLS core to the other PE routers.
The identifier can be in either of the following formats:
•
•
Note
Interface Towards Provider Edge
Available only if the 2-Box radio button is selected.
The VRF forwarding interface on the IPsec Aggregator towards the PE device.
Note
Interfaces and VLANs are predefined interface role objects. If required, click Select to open a dialog box that lists all available interfaces and sets of interfaces defined by interface roles, in which you can make your selection or create interface role objects.
Routing Protocol
Available only if the 2-Box radio button is selected.
Select the routing protocol to use between the IPsec Aggregator and the PE.
If the routing protocol for the secured IGP differs from the routing protocol between the IPsec Aggregator and the PE, select the routing protocol for redistributing the routing to the secured IGP.
The options are BGP, EIGRP, OSPF, RIPv2, or Static route.
For information about these protocols, see Chapter 14, "Managing IPS Services".
AS Number
Available only if the 2-Box radio button is selected.
The number to use to identify the autonomous system (AS) area between the IPsec Aggregator and the PE.
If the routing protocol for the secured IGP differs from the routing protocol between the IPsec Aggregator and the PE, enter an AS number that identifies the secured IGP into which the routing will be redistributed from the IPsec Aggregator and the PE. This is relevant only if GRE or DMVPN are applied.
The AS number must be between 1 and 65535.
Process Number
Available only if the 2-Box radio button is selected, and if the selected routing protocol is OSPF.
The routing process ID number to use to configure the routing between the IPsec Aggregator and the PE.
The process number must be between 1 and 65535.
OSPF Area ID
Available only if the 2-Box radio button is selected, and if the selected routing protocol is OSPF.
The ID number of the area in which the packet belongs. You can enter any number from 0 to 4294967295.
Note
Redistribute Static Route
Available only if the 2-Box radio button is selected, and for any selected routing protocol other than Static route.
When selected, enables static routes to be advertised in the routing protocol configured on the IPsec Aggregator towards the PE device.
Note
OK button
Saves your changes locally on the client and closes the dialog box.
The changes appear in the table of the IPsec Proposal page.
IKE Proposal Page
Use the IKE Proposal page to select the IKE proposals to use for your remote access VPN server.
Navigation Path
1.
2.
3.
Note
Related Topics
•
•
•
•
•
Field Reference
High Availability Page
Use the High Availability page to configure a High Availability (HA) policy on a Cisco IOS router in a remote access VPN.
Navigation Path
1.
2.
3.
Note
Related Topics
•
•
Field Reference
Public Key Infrastructure Page
Use the Public Key Infrastructure page to select the CA servers to use for creating a Public Key Infrastructure (PKI) policy for generating enrollment requests for CA certificates.
Navigation Path
1.
2.
3.
Note
Related Topics
•
•
•
•
•
Field Reference
Table H-16 Public Key Infrastructure Page
Available CA Servers
Lists the CA servers available for selection.
Select the required CA server(s) and click >>.
CA servers are defined as PKI enrollments objects that contain server information and enrollment parameters required for creating enrollment requests for CA certificates.
If the required CA server is not included in the list, click Create to open a dialog box that enables you to create a PKI enrollment object. You can also edit the properties of a CA server by selecting it and clicking Edit.
Note
Selected CA Servers
The selected CA servers.
To remove a CA server from this list, select it and click <<.
Note
>> button
Click to move one or more selected CA servers from the Available CA Servers list to the Selected CA Servers list.
<< button
Click to move one or more selected CA server from the Selected CA Servers list to the Available CA Servers list.
Save button
Available only if you are authorized to modify this policy.
Saves your changes to the server but keeps them private. To publish your changes, click the Submit button on the toolbar.
Note
VPN Global Settings Page
Use the VPN Global Settings page to define global settings for IKE, IPsec, NAT, and fragmentation that apply to devices in your remote access VPN.
The following tabs are available on the VPN Global Settings page:
Navigation Path
1.
2.
3.
Note
ISAKMP/IPsec Settings Tab
Use the ISAKMP/IPsec Settings tab of the VPN Global Settings page to specify global settings for IKE and IPsec.
Navigation Path
Open the VPN Global Settings Page, or click the ISAKMP/IPsec Settings tab from any other tab in the VPN Global Settings page.
Related Topics
•
•
•
•
•
Field Reference
Table H-17 VPN Global Settings > ISAKMP/IPsec Settings Tab
Enable Keepalive
When selected, enables you to configure IKE keepalive as the default failover and routing mechanism for your devices.
Note
Interval (seconds)
The number of seconds that a device waits between sending IKE keepalive packets. The default is 10 seconds.
Retry (seconds)
The number of seconds a device waits between attempts to establish an IKE connection with the remote peer. The default is 2 seconds.
Periodic
Available only if Enable Keepalive is selected and supported on routers running IOS version 12.3(7)T and later, except 7600 devices.
When selected, enables you to send dead-peer detection (DPD) keepalive messages even if there is no outbound traffic to be sent. Usually, DPD keepalive messages are sent between peer devices only when no incoming traffic is received but outbound traffic needs to be sent.
For more information, see Understanding ISAKMP/IPsec Settings, page 10-78.
Identity
During Phase I IKE negotiations, peers must identify themselves to each other.
Select to use the IP address or the host name that the device will use to identify itself in IKE negotiations. You can also select a distinguished name (DN) to identify a user group name.
SA Requests System Limit
Supported on routers running Cisco IOS Release 12.3(8)T and later, except 7600 routers.
The maximum number of SA requests allowed before IKE starts rejecting them.
You can enter a value in the range of 0-99999.
Note
SA Requests System Threshold
Supported on Cisco IOS routers and Catalyst 6500 /7600 devices.
The percentage of system resources that can be used before IKE starts rejecting new SA requests.
Enable Lifetime
Select to enable you to configure the global lifetime settings for the crypto IPsec SAs on the devices in your remote access VPN.
Lifetime (secs)
The number of seconds a security association will exist before expiring. The default is 3,600 seconds (1 hour).
Lifetime (kbytes)
The volume of traffic (in kilobytes) that can pass between IPsec peers using a given security association before it expires. The default is 4,608,000 kilobytes.
Xauth Timeout (seconds)
Supported on Cisco IOS routers and Catalyst 6500 /7600 devices.
The number of seconds the device will wait for a system response to the Xauth challenge.
When negotiating tunnel parameters for establishing IPsec tunnels in a remote access configuration, Xauth adds another level of authentication that identifies the user who requests the IPsec connection. Using the Xauth feature, the client waits for a "username/password" challenge after the IKE SA was established. When the end user responds to the challenge, the response is forwarded to the IPsec peers for an additional level of authentication.
Max Sessions
Supported on PIX 7.0 and ASA devices.
The maximum number of SAs that can be enabled simultaneously on the device.
Enable IPsec via Sysopt (PIX and ASA only)
Supported on ASA devices, and PIX Firewalls versions 6.3 or 7.0.
When selected (the default), specifies that any packet that comes from an IPsec tunnel is implicitly trusted (permitted).
Save button
Available only if you are authorized to modify this policy.
Saves your changes to the server but keeps them private.
Note
NAT Settings Tab
Use the NAT Settings tab of the VPN Global Settings page to define global Network Address Translation (NAT) settings that enable devices that use internal IP addresses to send and receive data through the Internet.
Navigation Path
Open the VPN Global Settings Page, then click the NAT Settings tab.
Related Topics
•
•
•
Field Reference
Table H-18 VPN Global Settings > NAT Settings Tab
Enable Traversal Keepalive
When selected, enables you to configure NAT traversal keepalive on a device.
NAT traversal keepalive is used for the transmission of keepalive messages when there is a device (middle device) located between a VPN-connected hub and spoke, and that device performs NAT on the IPsec flow.
Note
For more information, see Understanding NAT, page 10-79.
Interval
Available when NAT Traversal Keepalive is enabled.
The interval, in seconds, between the keepalive signals sent between the spoke and the middle device to indicate that the session is active. The NAT keepalive value can be from 5 to 3600 seconds. The default is 10 seconds.
Enable Traversal over TCP
Supported on PIX 7.0 and ASA devices.
When selected, encapsulates both the IKE and IPsec protocols within a TCP packet and enables secure tunneling through both NAT and PAT devices and firewalls.
TCP Ports
Available only when Enable Traversal over TCP is selected.
The TCP ports for which you want to enable NAT traversal. You must configure TCP ports on the remote clients and on the VPN device. The client configuration must include at least one of the ports you set for the security appliance. You can enter up to 10 ports.
Save button
Available only if you are authorized to modify this policy.
Saves your changes to the server but keeps them private.
Note
General Settings Tab
Use the General Settings tab of the VPN Global Settings page to define fragmentation settings and other global settings on devices in your remote access VPN.
Navigation Path
Open the VPN Global Settings Page, then click the General Settings tab.
Related Topics
•
•
•
Field Reference
ASA Cluster Load Balance Page
Use the Cluster Load Balance page to enable load balancing for an ASA device in your remote access VPN.
Note
Navigation Path
1.
2.
Note
3.
Note
Related Topics
•
•
•
Field Reference
Table H-20 ASA Cluster Load Balance Page
Participate in Load Balancing Cluster
Select to specify that the device belongs to the load-balancing cluster.
Cluster IP Address
The single IP address that represents the entire virtual cluster. The IP address should be in the same subnet as the external interface.
UDP Port
The UDP port for the virtual cluster in which the device is participating. If another application is using this port, enter the UDP destination port number that you want to use for load balancing.
The default is 9023.
Enable IPsec Encryption
Select this check box to ensure that all load-balancing information communicated between the devices is encrypted.
When the check box is selected, you must also specify and verify a shared secret. The security appliances in the virtual cluster communicate via LAN-to-LAN tunnels using IPsec.
IPsec Shared Secret
The shared secret to be communicated between IPsec peers if you enabled IPsec encryption. This can be a case-sensitive value between 4 and 16 characters, without spaces.
Accept default device value
When selected (the default), accepts the default priority value assigned to the device.
Configure same priority on all devices in the cluster
When selected, enables you to configure the same priority value to all the devices in the cluster. The priority indicates the likelihood of this device becoming the virtual cluster master, either at startup or when the existing master fails.
Enter a value between 1 and 10.
Public interfaces
The public interfaces to be used on the server.
Interfaces are predefined objects. You can click Select to open a dialog box that lists all available interfaces, and sets of interfaces defined by interface roles, in which you can make your selection, or create interface role objects.
Private Interfaces
The private interfaces to be used on the server.
Interfaces are predefined objects. You can click Select to open a dialog box that lists all available interfaces, and sets of interfaces defined by interface roles, in which you can make your selection, or create interface role objects.
Send FQDN to client instead of an IP address when redirecting
When selected, enables redirection using a FQDN on an ASA device configured with load balancing. For more information, see Enabling Redirection Using an FQDN, page 11-22.
This check box is available only for ASA devices running 8.0.2 or later.
Save button
Available only if you are authorized to modify this policy.
Saves your changes to the server but keeps them private.
Note
DN Matching Policy Page
Use the DN Matching Policy page to configure the DN rule matching policies for any remote client connecting to the device.
Distinguished Name (DN) rules are used for enhanced certificate authentication on PIX Firewalls version 7.0 and ASA devices.
Navigation Path
1.
2.
3.
Note
Related Topics
•
•
Field Reference
DN Matching Rules Page
Use the DN Matching Rules page to configure the DN rule matching rules and parameters for any remote client connecting to the device.
Distinguished Name (DN) rules are used for enhanced certificate authentication on PIX Firewalls version 7.0 and ASA devices.
Note
Navigation Path
1.
2.
3.
Note
Related Topics
•
•
•
•
Field Reference
Table H-22 DN Matching Rules Page
Mapped to Tunnel Group
The tunnel group to which the DN matching rule is mapped.
Priority
The priority number of the DN matching rule. A lower number has higher priority.
Create button
Click to open the dialog box for creating a DN matching rule. The DN Rule dialog box appears. See DN Rule Dialog Box (Upper Pane).
Edit button
Select the row of a DN matching rule from the upper pane, then click to open the dialog box for editing the selected DN matching rule. See DN Rule Dialog Box (Upper Pane).
Delete button
Select the rows of one or more rules, then click to delete.
Field
The specified field of the DN matching rule. The certificate field can be either Subject or Issuer.
Component
The matching component of the certificate for the DN matching rule.
Operator
The operator of the matching rule.
Value
The value of the matching rule. The displayed value must match the value in the client certificate.
Create button
Click to open the DN Rule dialog box for creating a new DN matching rule. See DN Rule Dialog Box (Lower Pane).
Edit button
Select the row of a DN matching rule from the lower pane, then click to open the dialog box for editing the selected DN matching rule. See DN Rule Dialog Box (Lower Pane).
Delete button
Select the rows or one or more rules, then click to delete.
Default Tunnel Group
Select the default tunnel group to be used if no matching rules are found.
Save button
Available only if you are authorized to modify this policy.
Saves your changes to the server but keeps them private.
Note
DN Rule Dialog Box (Upper Pane)
Use the upper pane of the DN Matching Rules page to specify the priority and tunnel groups to which the rules will be mapped. You can create a new DN matching rule or edit an existing one in the DN Rule dialog box.
Navigation Path
On the DN Matching Rules Page, click Create in the upper pane or select a row in the upper table and click Edit.
Related Topics
•
Field Reference
DN Rule Dialog Box (Lower Pane)
The lower pane of the DN Matching rules page displays the details of the tunnel group mapping selected in the upper pane. In this pane, you create the DN matching rules that must be satisfied for a remote client to connect to the device. You can create a DN matching rule or edit an existing one in the DN Rule dialog box.
Navigation Path
On the DN Matching Rules Page, click Create in the lower pane or select a row in the lower table and click Edit.
Related Topics
•
Field Reference
