-
VPN 3000 Series Concentrator Reference Volume I: Configuration, Release 4.7
-
A PDF Version of the Entire Book
-
Preface
-
Using the VPN Concentrator Manager
-
Configuration
-
Interfaces
-
System Configuration
-
Servers
-
Address Management
-
IP Routing
-
Management Protocols
-
Events
-
General
-
Client Update
-
Load Balancing Cisco VPN Clients
-
User Management
-
Policy Management
-
Tunneling and Security
-
Configuring an External Server for VPN Concentrator User Authorization
-
Configuring the VPN Concentrator for WebVPN
-
WebVPN End User Set-up
-
Index
-
Table Of Contents
VPN 3000 Series Concentrator Documentation
VPN 3002 Hardware Client Documentation
Documentation on VPN Software Distribution CDs
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Preface
The VPN Concentrator provides an HTML-based graphic interface, called the VPN Concentrator Manager, that allows you to configure, administer, and monitor your device easily. The VPN Concentrator Manager has three sets of screens that correspond to these tasks: Configuration screens, Administration screens, and Monitoring screens.
VPN 3000 Series Concentrator Reference Volume I: Configuration is the first in the two volume VPN 3000 Series Concentrator Reference. Together, both volumes document all the screens of the VPN Concentrator Manager.
•
VPN 3000 Series Concentrator Reference Volume I: Configuration explains how to start and use the VPN Concentrator Manager. It details the Configuration screens and explains how to configure your device beyond the minimal parameters you set during quick configuration.
•
This manual contains no information about installing the VPN Concentrator and initially configuring it. For information about set-up and initial configuration, refer to the VPN 3000 Series Concentrator Getting Started.
Audience
We also assume you are an experienced system administrator or network administrator with appropriate education and training, who knows how to install, configure, and manage internetworking systems. However, virtual private networks and VPN devices might be new to you. You should be familiar with Windows system configuration and management, and you should be familiar with Microsoft Internet Explorer or Netscape Navigator or Communicator browsers.
Prerequisites
We assume you have read the VPN 3000 Series Concentrator Getting Started manual, set up your VPN Concentrator, and followed the minimal configuration steps in quick configuration.
Organization
The chapters and sections of this guide correspond to the Configuration part of the VPN Concentrator Manager table of contents (the left frame of the Manager browser window) and are in the same order they appear there.
This guide is organized as follows:
Chapter 1
Log in, navigate, and use the VPN Concentrator Manager with a browser. It explains both HTTP and HTTPS browser connections, and how to install the SSL certificate for a secure (HTTPS) connection.
Chapter 2
Access the Configuration screens.
Chapter 3
Configure the VPN Concentrator Ethernet interfaces, the system power supply, and voltage sensor alarms.
Chapter 4
Access the System Configuration screens.
Chapter 5
Configure the VPN Concentrator to communicate with and access servers for user authentication, user authorization, user accounting, converting host names to IP addresses (DNS), assigning client IP addresses (DHCP), Zone Labs Integrity Firewall, NetBIOS Name, and network time synchronization (NTP).
Chapter 6
Configure the client IP addresses available in your private network addressing scheme to let the client function as a VPN tunnel endpoint.
Chapter 7
Configure static routes, default gateways, and OSPF in the VPN Concentrator IP routing subsystem; DHCP global parameters; and redundant systems using VRRP.
Chapter 8
Configure built-in VPN Concentrator servers that provide management functions: FTP, HTTP, TFTP, Telnet, SNMP, and XML.
Chapter 9
Configure the system to handle events such as alarms, traps, error conditions, network problems, task completion, or status changes. You can specify several ways to record and send event messages.
Chapter 10
Configure the system identification, date, time, maximum session limit, and global authentication parameters.
Chapter 11
Configure the VPN Concentrator to manage, from a central location, distribution of software and firmware updates to VPN Clients and VPN 3002 hardware clients deployed in diverse locations.
Chapter 12
Configure two or more VPN Concentrators to share their remote access session loads.
Chapter 13
Configure groups and users with attributes that determine their access to and use of the VPN. Configuring groups and users correctly is essential for managing the security of your VPN.
Chapter 14
Configure network lists, filters, rules, and Security Associations, all of which are policies that govern what data traffic can flow through the VPN. You should develop and configure policies first, since you apply them to groups, users, and interfaces. This chapter also describes NAT configuration.
Chapter 15
Configure system-wide parameters for PPTP and L2TP, IPSec LAN-to-LAN connections; IKE proposals for IPSec; SSH, SSL, and WebVPN connections.
Appendix A
Configuring an External Server for VPN Concentrator User Authorization
Configure an external LDAP or RADIUS authentication server to interoperate with the VPN Concentrator.
Appendix B
Set up the VPN Concentrator to support WebVPN.
Appendix C
Set up configurations for WebVPN end users.
Note
Related Documentation
Refer to the following documents for further information about Cisco VPN applications and products.
VPN 3000 Series Concentrator Documentation
The VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring provides guidelines for administering and monitoring the VPN Concentrator. It explains and defines all functions available in the Administration and Monitoring screens. Appendixes to this manual provide troubleshooting guidance and explain how to access and use the alternate command-line interface.
The VPN Concentrator Manager also includes online help that you can access by clicking the Help icon on the toolbar in the Manager window.
The VPN 3000 Series Concentrator Getting Started manual takes you from unpacking and installing the VPN 3000 Series Concentrator, through configuring the minimal parameters to make it operational (called quick configuration).
The short document Upgrading Memory to 512 MB in the VPN 3000 Series Concentrator explains how to upgrade the VPN Concentrator memory. It also explains how to upgrade the VPN Concentrator software image and bootcode to versions that support the increased memory.
VPN Client Documentation
The Cisco VPN Client User Guide for Windows, the Cisco VPN Client User Guide for Linux and Solaris, and the Cisco VPN Client User Guide for Mac OS X explain how to install, configure, and use the VPN Client. The VPN Client lets a remote client use the IPSec tunneling protocol for secure connection to a private network through the VPN Concentrator.
The VPN Client Administrator Guide tells how to
•
•
•
•
•
VPN 3002 Hardware Client Documentation
The VPN 3002 Hardware Client Reference provides details on all the functions available in the VPN 3002 Hardware Client Manager.
The VPN 3002 Hardware Client Getting Started manual provides information to take you from unpacking and installing the VPN 3002, through configuring the minimal parameters to make it operational (called Quick Configuration).
The VPN 3002 Hardware Client Quick Start Card summarizes the information for quick configuration. This quick reference card is provided with the VPN 3002 and is also available online.
The VPN 3002 Hardware Client Basic Information sticky label summarizes information for quick configuration. It is provided with the VPN 3002 and you can also print it from the online version; you can affix the label to the VPN 3002.
Documentation on VPN Software Distribution CDs
The VPN 3000 Series Concentrator and VPN 3002 Hardware Client documentation are provided on the VPN 3000 Concentrator software distribution CD-ROM in PDF format. The VPN Client documentation is included on the VPN Client software distribution CD-ROM, also in PDF format. To view the latest versions on the Cisco web site, click the Support icon on the toolbar at the top of the VPN Concentrator Manager, Hardware Client Manager, or Client window. To open the documentation, you need Acrobat Reader 3.0 or later; version 4.5 is included on the Cisco VPN 3000 Concentrator software distribution CD-ROM and on the VPN Client software distribution CD-ROM.
Other References
Other useful references include:
•
•
•
•
Conventions
This document uses the following conventions:
Notes use the following conventions:
Note
Tips use the following conventions:
Tip
Cautions use the following conventions:
Caution
Warnings use the following conventions:
Warning
Data Formats
As you configure and manage the system, enter data in the following formats unless the instructions indicate otherwise:
Apply and Cancel Buttons
Use the Apply button on any screen to apply your settings to the active configuration. Use the Cancel button to discard your settings. These buttons are excluded from most screen descriptions for brevity; however, they are sometimes included to provide additional information. Take note when a description of Apply and Cancel is included, as it may call out non-obvious consequences of using these buttons.
Save Needed Reminder
The Manager saves all changes you apply to the active configuration. However, these changes are lost between restarts unless you save them to the boot configuration as well. The Save Needed icon appears at the top of the Manager window to alert you when you have made changes that should be saved to the boot configuration.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window. To discard your entries, click Cancel.
A reminder to click the Save Needed icon appears in several, but not all, screen descriptions in this documentation, as space allows. Always click the Save Needed icon if you want to make changes to the boot configuration, whether the screen description includes a reminder or not.
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation DVD
Cisco documentation and additional literature are available in a Documentation DVD package, which may have shipped with your product. The Documentation DVD is updated regularly and may be more current than printed documentation. The Documentation DVD package is available as a single unit.
Registered Cisco.com users (Cisco direct customers) can order a Cisco Documentation DVD (product number DOC-DOCDVD=) from the Ordering tool or Cisco Marketplace.
Cisco Ordering tool:
http://www.cisco.com/en/US/partner/ordering/
Cisco Marketplace:
http://www.cisco.com/go/marketplace/
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•
http://www.cisco.com/en/US/partner/ordering/
•
Documentation Feedback
You can send comments about technical documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you can perform these tasks:
•
•
•
A current list of security advisories and notices for Cisco products is available at this URL:
If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:
•
•
Tip
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one that has the most recent creation date in this public key server list:
http://pgp.mit.edu:11371/pks/lookup?search=psirt%40cisco.com&op=index&exact=on
In an emergency, you can also reach PSIRT by telephone:
•
•
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/go/marketplace/
•
•
•
http://www.cisco.com/go/iqmagazine
•
•
http://www.cisco.com/en/US/learning/index.html
