|
|
Groups and users are core concepts in managing the security of VPNs and in configuring the VPN Concentrator. Groups and users have attributes, configured via parameters, that determine their access to and use of the VPN. Users are members of groups, and groups are members of the base group. If you do not assign a user to a particular group, that user is by default a member of the base group. This section of the Manager lets you configure those parameters.
Groups simplify system management. To streamline the configuration task, the VPN Concentrator provides a base group that you configure first. The base-group parameters are those that are most likely to be common across all groups and users. As you configure a group, you can simply specify that it "inherit" parameters from the base group; and a user can also "inherit" parameters from a group. Thus you can quickly configure authentication for large numbers of users.
Of course, if you decide to grant identical rights to all VPN users, then you do not need to configure specific groups. But VPNs are seldom managed that way. For example, you might allow a Finance group to access one part of a private network, a Customer Support group to access another part, and an MIS group to access other parts. Further, you might allow specific users within MIS to access systems that other MIS users cannot access.
You can configure detailed parameters for groups and users on the VPN Concentrator internal authentication server. External RADIUS authentication servers also can return group and user parameters that match those on the VPN Concentrator; other authentication servers do not; they can, however, authenticate users. The Cisco software CD-ROM includes a copy of the Cisco Secure ACS RADIUS server.
The VPN Concentrator internal authentication server is adequate for a small user base. The maximum number of groups and users (combined) that you can configure in the internal server depends on your VPN Concentrator model. (See Table 14-1.) For larger numbers of users, we recommend using the internal server to configure groups (and perhaps a few users) and using a RADIUS server to authenticate the users.
Table 14-1 Maximum Number of Groups and Users for the Internal Authentication Server
| VPN Concentrator Model | Maximum Number of Groups and Users (Combined) |
|---|---|
The VPN Concentrator checks authentication parameters in this order:
If you use a non-RADIUS server, only the IPSec tunnel-group or base-group parameters apply to users.
Some additional points to note:
For PPTP and L2TP authentication protocols, you can allow specific groups and users to use fewer protocols than the base group, but not more.
For all other parameters, groups' and users' rights can be greater than the base group. For example, you can give a specific user 24-hour access to the VPN, but give the base group access during business hours only.
We recommend that you define groups when planning your VPN, and that you configure groups and users on the VPN Concentrator in this order:
Before configuring groups and users, you should configure:
This section of the Manager lets you configure base-group, group, and individual user parameters. These parameters determine access and use of the VPN Concentrator.
This Manager screen lets you configure the default, or base-group, parameters. Base-group parameters are those that are most likely to be common across all groups and users, and they streamline the configuration task. Groups can "inherit" parameters from this base group, and users can "inherit" parameters from their group or the base group. You can override these parameters as you configure groups and users. Users who are not members of a group are, by default, members of the base group.
On this screen, you configure the following kinds of parameters:
Before configuring these parameters, you should configure:
This screen includes three tabbed sections. Click each tab to display its parameters. As you move from tab to tab, the Manager retains your settings. When you have finished setting parameters on all tabbed sections, click Apply or Cancel.
This tab lets you configure general security, access, performance, and protocol parameters that apply to the base group.
Click the Access Hours drop-down menu button and select the named hours when remote-access users can access the VPN Concentrator. Configure access hours on the Configuration | Policy Management | Access Hours screen. Default entries are:
Additional named access hours that you have configured also appear on the list.
Enter the number of simultaneous logins permitted for a single internal user. The minimum is 0, which disables login and prevents user access; default is 3. While there is no maximum limit, allowing several could compromise security and affect performance.
Enter the minimum number of characters for user passwords. The minimum is 1, the default is 8, and the maximum is 32. For security purposes, we strongly recommend 8 or higher.
Check the Allow Alphabetic-Only Passwords check box to allow user passwords with alphabetic characters only (the default). This option applies only to users who are configured in and authenticated by the VPN Concentrator internal authentication server. To protect security, we strongly recommend that you not allow such passwords. Require passwords to be a mix of alphabetic characters, numbers, and symbols, such as 648e&9G#.
Enter the idle timeout period in minutes. If there is no communication activity on a user connection in this period, the system terminates the connection. The minimum is 1 minute, the default is 30 minutes, and the maximum is 2147483647 minutes (over 4000 years). To disable timeout and allow an unlimited idle period, enter 0.
 |
Note This parameter does not apply to individual users as they authenticate to the remote network. The idle timeout value set in the Hardware Client tab of the Configuration | User Management | Base Group or/Groups | Add/Modify screen is the timeout value that applies. |
Enter the maximum user connection time in minutes. At the end of this time, the system terminates the connection. The minimum is 1 minute, and the maximum is 2147483647 minutes (over 4000 years). To allow unlimited connection time, enter 0 (the default).
Filters consist of rules that determine whether to allow or reject tunneled data packets coming through the VPN Concentrator, based on criteria such as source address, destination address, and protocol. Cisco supplies three default filters, which you can modify. To configure filters and rules, see the Configuration | Policy Management | Traffic Management screens.
Click the Filter drop-down menu button and select the base-group filter:
Additional filters that you have configured also appear on the list.
Enter the IP address, in dotted decimal notation, of the primary DNS server for base-group users. The system sends this address to the client as the first DNS server to use for resolving host names. If the base group doesn't use DNS, leave this field blank. See the Note on DNS and WINS entries section under Configuration | User Management | Groups | Add or Modify (Internal).
Enter the IP address, in dotted decimal notation, of the secondary DNS server for base-group users. The system sends this address to the client as the second DNS server to use for resolving host names.
Enter the IP address, in dotted decimal notation, of the primary WINS server for base-group users. The system sends this address to the client as the first WINS server to use for resolving host names under Windows NT. If the base group does not use WINS, leave this field blank. (See the Note on DNS and WINS entries under on).
Enter the IP address, in dotted decimal notation, of the secondary WINS server for base-group users. The system sends this address to the client as the second WINS server to use for resolving host names under Windows NT.
The VPN Concentrator can contain up to four SEP (Scalable Encryption Processing) modules that handle encryption functions, which are compute-intensive. Two SEP modules handle a number of sessions (users) up to the system maximum. The system maximum is 1000 sessions for the VPN Concentrator 3080 and 5000 sessions for the VPN Concentrator 3060. Two additional modules can provide automatic failover for the first two. This parameter lets you configure the load on each SEP module.
Check the SEP Card Assignment check box to assign the load to a given SEP module. By default, all boxes are checked, and we recommend that you keep the default. If your system does not have a given SEP module, the parameter is ignored.
Check the desired Tunneling Protocols check boxes to select the VPN tunneling protocols that user clients can use. Configure parameters on the IPSec or PPTP/L2TP tabs as appropriate. Clients can use only the selected protocols.
You cannot check both IPSec and L2TP over IPsec. The IPSec parameters differ for these two protocols, and you cannot configure the base group for both.
|
Note If no protocol is selected, no user clients can access or use the VPN. |
Check the Strip Realm check box to remove the realm qualifier of the user name during authentication. If you check this Strip Realm box, authentication is based on the username alone. Otherwise, authentication is based on the full username@realm string. You must check this box if your server is unable to parse delimiters.
This tab lets you configure IP Security Protocol parameters that apply to the base group. If you checked IPSec or L2TP over IPSec under Tunneling Protocols on the General Parameters tab, configure this section.
Click the IPSec SA drop-down menu button and select the IPSec Security Association (SA) assigned to IPSec clients. During tunnel establishment, the client and server negotiate a Security Association that governs authentication, encryption, encapsulation, key management, etc. You configure IPSec Security Associations on the Configuration | Policy Management | Traffic Management | Security Associations screens.
To use IPSec with remote-access clients, you must assign an SA. With IPSec LAN-to-LAN connections, the system ignores this selection and uses parameters from the Configuration | System | Tunneling Protocols | IPSec LAN-to-LAN screens.
The VPN Concentrator supplies these default selections:
Additional SAs that you have configured also appear on the list.
Click the IKE Peer Identity Validation drop-down menu button, and select the type of peer identity validation.
|
Note This option applies only to tunnel negotiations based on certificates. |
During IKE tunnel establishment, the peer provides its identity: either an IP address, a fully qualified domain name (FQDN), or a distinguished name (DN). It also presents a certificate, which contains none, some, or all of these fields. If IKE peer identity validation is enabled, the VPN Concentrator compares the peer's identity to the like field in the certificate to see if the information matches. If the information matches, then the peer's identity is validated and the VPN Concentrator establishes the tunnel. If the information does not match, the VPN Concentrator drops the tunnel. This feature provides an additional level of security.
IKE Peer Identity Validation can be useful for binding a peer to a particular IP address or domain name. For example, if the IP address that the peer provided as an identification during tunnel establishment does not match the IP address in its certificate, the VPN Concentrator fails to validate the peer and drops the tunnel.
Ideally all the VPN Concentrator peers are configured to provide matching types of identity and certificate fields. In this case, enabling Peer Identity Validation ensures that the VPN Concentrator checks the validity of every peer, and only validated peers connect. But in actuality, some peers might not be configured to provide this data. The peer provides a certificate, but that certificate might not contain any of the matching fields required for an identity check. (For example, the peer might provide an IP address for its identity and its certificate might contain only a distinguished name.) If a peer does not provide sufficient information for the VPN Concentrator to check its identity, there are two possibilities: the VPN Concentrator either establishes the session or drops it. If you want the VPN Concentrator to drop sessions of peers that do no provide sufficient information to perform an identity check, choose Required. If you want the VPN Concentrator to establish sessions for peers that do not provide sufficient identity information to perform a check, select If supported by Certificate.
Check the IKE Keepalives check box to enable IKE keepalives. (IKE keepalives is enabled by default.) This feature lets the VPN Concentrator monitor the continued presence of a remote peer and to report its own presence to that peer. If the peer becomes unresponsive, the VPN Concentrator removes the connection. Enabling IKE keepalives prevents hung connections when the IKE peer loses connectivity.
There are various forms of IKE keepalives. For this feature to work, both the VPN Concentrator and its remote peer must support a common form. This feature works with the following peers:
Non-Cisco VPN clients do not support IKE keepalives.
If you are configuring a group of mixed peers, and some of those peers support IKE keepalives and others do not, enable IKE keepalives for the entire group. The feature does not affect the peers that do not support it.
If you disable IKE keepalives, connections with unresponsive peers remain active until they time out, so we recommend you keep your idle timeout short. To change your idle timeout, see the Configuration | User Management | Groups | Add screen, General tab.
|
Note To reduce connectivity costs, disable IKE keepalives if this group includes any clients connecting via ISDN lines. ISDN connections normally disconnect if idle, but the IKE keepalives mechanism prevents connections from idling and therefore from disconnecting. |
|
Note If you have a LAN-to-LAN configuration using IKE main mode, make sure the two peers have the same IKE keepalives configuration: both must have IKE keepalives enabled or both must have it disabled. |
Check the Reauthentication on Rekey check box to enable reauthentication, or uncheck the box to disable it.
The VPN Concentrator prompts the user to enter an ID and password during Phase 1 IKE negotiations. If you enable reauthentication, the VPN Concentrator also prompts for user authentication whenever a rekey occurs. Reauthentication provides additional security.
If the configured rekey interval is very short, users might find the repeated authorization requests inconvenient. With interactive hardware client authentication enabled, a short rekey interval causes the tunnel to drop. In either case, either make the rekey interval a long one, or disable reauthentication. (To check your VPN Concentrator's configured rekey interval, see the Lifetime Measurement, Data Lifetime, and Time Lifetime fields on the Configuration | System | Tunneling Protocols | IPSec | IKE Proposals | Add or Modify screen.)
Click the Tunnel Type drop-down menu button and select the type of IPSec tunnel that clients use:
These base-group parameters apply to remote-access IPSec client connections only. If you select Remote Access for Tunnel Type, configure these parameters.
Check the Group Lock check box to restrict users to remote access through this group only. The IPSec client connects to the VPN Concentrator via a group name and password, and then the system authenticates a user via a username and password. If this box is unchecked (the default), the system authenticates a user without regard to the user's assigned group.
Whenever a VPN software or VPN 3002 hardware client attempts a tunneled connection to a network behind a VPN Concentrator, that client is authenticated by means of a username and password. This authentication occurs when the tunnel initiates.
Click the Authentication drop-down menu button and select the authentication method (authentication server type) to use with this group's remote-access IPSec clients. Both VPN Clients and VPN 3002 hardware clients authenticate on the first server of the type you configure.
This selection identifies the authentication method, not the specific server. Configure authentication servers on the Configuration | System | Servers | Authentication screens or Configuration | User Management | Groups | Authentication Servers screens.
For the VPN 3002, this selection applies to authentication using a saved username and password and to interactive hardware client authentication. Individual users behind the VPN 3002 authenticate according to the priority order of all authentication servers configured, regardless of type. For more information on the different ways in which a VPN 3002 can authenticate, see the section, "HW Client Parameters Tab."
|
Note To configure user-based authentication for Cisco VPN Clients, choose an Authentication method,
then follow the additional steps outlined under Configuration | System | Tunneling Protocols | IPSec | IKE Proposals | Add, Modify, or Copy. |
Selecting any authentication method (other than None) enables ISAKMP Extended Authentication, also known as XAUTH.
Enabling RADIUS with Expiry allows the VPN Concentrator to use MS-CHAP-v2 when authenticating an IPSec client to an external RADIUS server. That RADIUS server must support both MS-CHAP-v2 and the Microsoft Vendor Specific Attributes. Refer to the documentation for your RADIUS server to verify that it supports these capabilities.
Because of the use of MS-CHAP-v2, when you enable RADIUS with Expiry on the VPN Concentrator, the VPN Concentrator can provide enhanced login failure messages to the VPN Client describing specific error conditions. These conditions are:
If all members of this group are remote dial-in users connecting with modems, enabling data compression might speed up their data transmission rates. Data compression shrinks data by replacing repeating information with symbols that use less space. Click the IPComp drop-down menu button to enable data compression using IPComp.
 |
Caution Data compression increases the memory requirement and CPU utilization for each user session and consequently decreases the overall throughput of the VPN Concentrator. For this reason, we recommend that you enable data compression only if every member of the group is a remote user connecting with a modem. If any members of the group connect via broadband, do not enable data compression for the group. Instead, divide the group into two groups, one for modem users and the other for broadband users. Enable data compression only for the group of modem users. |
Enter the preshared secret. Use a minimum of four and a maximum of 32 alphanumeric characters.
This option allows the following VPN clients to connect to the VPN Concentrator:
Check the Mode Configuration check box to use Mode Configuration with IPSec clients (also known as the ISAKMP Configuration Method or Configuration Transaction). This option exchanges configuration parameters with the client while negotiating Security Associations. If you check this box, configure the desired Mode Configuration Parameters; otherwise, ignore them. The box is checked by default.
To use split tunneling, you must check this box.
If you checked L2TP over IPSec under Tunneling Protocols, do not check this box.
|
Note IPSec uses Mode Configuration to pass all configuration parameters to a client: IP address, DNS and WINS addresses, etc. You must check this box to use Mode Configuration. Otherwise, those parameters—even if configured with entries—are not passed to the client. |
These base-group parameters apply to IPSec clients using Mode Configuration. If you checked Mode Configuration on the IPSec Parameters tab, configure these parameters as desired; otherwise, ignore them.
Enter the banner, or welcome text, that this group's IPSec clients see when they log in. The maximum length is 510 characters. You can use any characters, including newline (the Enter key, which counts as two characters).
Check the Allow Password Storage on Client check box to allow IPSec clients to store their login passwords on their local client systems. If you do not allow password storage (the default), IPSec users must enter their password each time they seek access to the VPN. For maximum security, we recommend that you not allow password storage.
This parameter has no bearing on interactive hardware client authentication or individual user authentication for a VPN 3002.
Split tunneling lets an IPSec client conditionally direct packets over an IPSec tunnel in encrypted form, or to a network interface in cleartext form. Packets not bound for destinations on the other side of the IPSec tunnel do not have to be encrypted, sent across the tunnel, decrypted, and then routed to a final destination. Split tunneling thus eases the processing load, simplifies traffic management, and speeds up untunneled traffic.
|
Note If you enable both split tunneling and individual user authentication for a VPN 3002, users must authenticate only when sending traffic bound for destinations on the other side of the IPSec tunnel. |
Split tunneling is primarily a traffic management feature, not a security feature. In fact, for optimum security, we recommend that you not enable split tunneling. However, since only the VPN Concentrator—and not the IPSec client—can enable split tunneling, you can control implementation here and thus protect security. Split tunneling is disabled by default on both the VPN Concentrator and the client. You enable and configure the feature on the VPN Concentrator, and then the VPN Concentrator uses Mode Configuration to push it to, and enable it on, the IPSec client.
Split tunneling applies only to single-user remote-access IPSec tunnels, not to LAN-to-LAN connections.
The default split tunneling policy is Tunnel Everything. Tunnel Everything disables split tunneling. When Tunnel Everything is configured, all traffic from remote clients in this group travels over the secure IPSec tunnel in encrypted form. No traffic goes in the clear or to any other destination than the VPN Concentrator. Remote users in this group reach internet networks through the corporate network and do not have access to local networks.
If users in this group need access to local networks, choose Allow Networks in List to Bypass Tunnel. This option allows you to define a list of networks to which traffic goes in the clear. This feature is useful for remote users who want to access devices on their local network, such as printers, while they are connected to the corporate network through a tunnel.
To configure the Allow Networks in List to Bypass Tunnel option, choose VPN Client Local LAN from the Split Tunnel Network List menu. The VPN Client Local LAN option allows all users in the group to access all devices on their local networks. If you want to restrict users' access to particular devices on their local network, you need to know the addresses of the local devices the remote users in this group want to access. Create a network list of these addresses, then choose that network list from the Split Tunneling Network List menu. You can apply only one network list to a group, but one network list can contain up to 10 network entries. (See the Configuration | Policy Management | Traffic Management | Network Lists screens for more information on creating network lists.) You also must enable Local LAN Access on the VPN Client. See the VPN Client Administrator Guide for more details.
|
Note The Allow Networks in List to Bypass Tunnel option allows remote users to access only devices that are located on the same network interface as the tunnel. If a remote user's local LAN is located on a different network interface than the tunnel, the user cannot access it. |
To allow remote users to access internet networks without tunneling through the corporate network, enable split tunneling. To enable split tunneling, choose Only Tunnel Networks in List. To configure this option, create a network list of addresses to tunnel. Then select this network list from the Split Tunneling Network List menu. Data to all other addresses is sent in the clear and routed by the remote user's internet service provider.
We recommend that you keep the base-group default, and that you enable and configure the split tunneling policy selectively for each group.
Click the drop-down menu button and select the split tunneling address list to use with this group's remote-access IPSec clients.
Both the Allow Networks in List to Bypass Tunnel option and the Only Tunnel Networks in List option make split tunneling decisions on the basis of a network list, which is a list of addresses on the private network. But the network list functions differently in each configuration.
In an Allow Networks in List to Bypass Tunnel configuration, The IPSec client uses the network list as an exclusion list: a list of addresses to which traffic should be sent in the clear. All other traffic is routed over the IPSec tunnel.
In an Only Tunnel Networks in List configuration, the IPSec client uses the network list as an inclusion list: a list of networks for which traffic should be sent over the IPSec tunnel. The IPSec client establishes an IPSec Security Association (SA) for each network specified in the list. Outbound packets with destination addresses that match one of the SAs are sent over the tunnel; everything else is sent as clear text to the locally connected network.
Enter the default domain name that the VPN Concentrator passes to the IPSec client, for the client's TCP/IP stack to append to DNS queries that omit the domain field. This domain name applies only to tunneled packets. For example, if this entry is xyzcorp.com, a DNS query for mail becomes mail.xyzcorp.com. The maximum name length is 255 characters. The Manager checks the domain name for valid syntax.
Check the IPSec over UDP check box to allow the Cisco VPN Client (IPSec client) or VPN 3002 hardware client to connect to the VPN Concentrator via UDP through a firewall or router using NAT. The box is unchecked by default. See the following discussion.
Enter the UDP port number to use if you allow IPSec through NAT. Enter a number in the range 4001 through 49151; default is 10000.
IPSec over UDP, sometimes called IPSec through NAT, lets you use the Cisco VPN Client or VPN 3002 hardware client to connect to the VPN Concentrator via UDP through a firewall or router that is running NAT. This feature is proprietary, it applies only to remote-access connections, and it requires Mode Configuration. Using this feature might slightly degrade system performance.
Enabling this feature creates runtime filter rules that forward UDP traffic for the configured port even if other filter rules on the interface drop UDP traffic. These runtime rules exist only while there is an active IPSec through NAT session. The system passes inbound traffic to IPSec for decryption and unencapsulation, and then passes it to the destination. The system passes outbound traffic to IPSec for encryption and encapsulation, applies a UDP header, and forwards it.
You can configure more than one group with this feature enabled, and each group can use a different port number. Port numbers must be in the 4001 through 49151 range, which is a subset of the IANA Registered Ports range.
The Cisco VPN Client must also be configured to use this feature (it is configured to use it by default). The VPN Client Connection Status dialog box indicates if the feature is being used. Refer to the VPN Client User Guide.
The VPN 3002 hardware client does not require configuration to use IPSec through NAT.
The Administration | Sessions and Monitoring | Sessions screens indicate if a session is using IPSec through NAT, and the Detail screens show the UDP port.
IPSec backup servers let a VPN 3002 Hardware Client connect to the central site when its primary central-site VPN Concentrator is unavailable. You configure backup servers for a VPN 3002 either on the VPN 3002, or on a group basis at the primary central-site VPN Concentrator. If you configure backup servers on the central-site VPN Concentrator, that VPN Concentrator pushes the backup server policy to the VPN 3002 hardware clients in the group.
By default the policy is to use the backup server list configured on the VPN 3002. Alternatively, the VPN Concentrator can push a policy that supplies a list of backup servers in order of priority (replacing the backup server list on the VPN 3002 if one is configured), or it can disable the feature and clear the backup server list on the VPN 3002 if one is configured.
Figure 14-5 illustrates how the backup server feature works.
XYZ corporation has large sites in three cities: San Jose, California; Austin, Texas; and Boston, Massachusetts. They just opened a regional sales office in Fargo, North Dakota. To provide access to the corporate network from Fargo, they use a VPN 3002 that connects to a VPN 3080 in San Jose (1). If the VPN 3002 is unable to contact the corporate network, Fargo cannot place orders. However, the IPSec backup server feature lets the VPN 3002 connect to one of several other sites, in this case using Austin (2) and Boston (3) as backup servers, in that order.
The VPN 3002 in Fargo first attempts to reach San Jose. If the initial IKE packet for that connection (1) times out (8 seconds), the VPN 3002 tries to connect to Austin (2). Should this negotiation also time out, the VPN 3002 tries to connect to Boston (3). These attempts continue until the VPN 3002 has tried all servers on its backup server list, to a maximum of 10.
Be aware of the following characteristics of the backup server feature:
You can configure the backup server feature from the primary VPN Concentrator or the VPN 3002. From the VPN Concentrator, configure backup servers on either of the Configuration | User Management | Base Group or Groups | Mode Configuration screens. On the VPN 3002, configure backup servers on the Configuration | System | Tunneling Protocols | IPSec screen.
The list you configure on the VPN 3002 applies only if the option, Use Client Configured List, is set in the IPSec Backup Servers parameter. To set this parameter, go to the Mode Configuration tab of the Configuration | User Management | Groups | Add/Modify screen for the primary VPN Concentrator to which the VPN 3002 connects.
|
Note The group name, user name, and passwords that you configure for the VPN 3002 must be identical for the primary VPN Concentrator and all backup servers. Also, if you require interactive hardware client authentication and/or individual user authentication for the VPN 3002 on the primary VPN Concentrator, be sure to configure it on backup servers as well. See the HW Client Parameters Tab for more information. |
To configure backup servers on the primary central-site VPN Concentrator, accept the default, Use list below in the IPSec Backup Servers drop down menu.
Enter either the IP addresses or the hostnames of the VPN Concentrators that are to be backup servers. The IP address is the IP address of the VPN Concentrator public interface.
|
Note If you are using hostnames, it is wise to have backup DNS and WINS servers on a separate network from that of the primary DNS and WINS servers. Otherwise, if clients behind the VPN 3002 obtain DNS and WINS information from the VPN 3002 through DHCP, and the connection to the primary server is lost, and the backup servers have different DNS and WINS information, clients cannot be updated until the DHCP lease expires. Further, if you use hostnames and the DNS server is unavailable, significant delays can occur. |
You can enter up to 10 backup servers, in order of highest to lowest priority. Enter each backup server on a single line, using the Enter or Return key for each new line.
Should there be a backup server list already configured on the VPN 3002, this list on the central-site VPN Concentrator replaces it, and becomes the list of backup servers on the VPN 3002 hardware client.
If you change the configuration of backup servers, or delete a backup server during an active session between a VPN 3002 and a backup server, the session continues without adopting that change. New settings take effect in the next new session.
To configure backup servers on the VPN 3002, accept the default, Use client configured list in the IPSec Backup Servers drop-down menu. You then configure backup servers in the VPN 3002 Configuration | System | Tunneling Protocols | IPSec screen. Refer to the Tunneling chapter in the VPN 3002 Hardware Client User Reference for instructions.
To disable the backup server feature, select Disable and clear client configured list in the IPSec Backup Servers drop-down menu. If you disable the feature from the primary VPN Concentrator, the feature is disabled and the list of backup servers configured on the VPN 3002, if there is one, is cleared.
This tab lets you configure firewall parameters for VPN Clients.
|
Note Only VPN Clients running Microsoft Windows can use these firewall features. They are presently not available to hardware clients or other (non-Windows) software clients. |
A firewall isolates and protects a computer from the Internet by inspecting each inbound and outbound individual packet of data to determine whether to allow or drop it. Firewalls provide extra security if remote users in a group have split tunneling configured. In this case, the firewall protects the user's PC, and thereby the corporate network, from intrusions by way of the Internet or the user's local LAN.
Remote users connecting to the VPN Concentrator with the VPN Client can choose from two possible firewall options.
In the first scenario, a remote user has a personal firewall installed on the PC. The VPN Client enforces firewall policy defined on the local firewall, and it monitors that firewall to make sure it is running. If the firewall stops running, the VPN Client drops the connection to the VPN Concentrator. (This firewall enforcement mechanism is called Are You There (AYT), because the VPN Client monitors the firewall by sending it periodic "are you there?" messages; if no reply comes, the VPN Client knows the firewall is down and terminates its connection to the VPN Concentrator.) The network administrator might configure these PC firewalls originally, but with this approach, each user can customize his or her own configuration.
In the second scenario, you might prefer to enforce a centralized firewall policy for personal firewalls on VPN Client PCs. A common example would be to block Internet traffic to remote PCs in a group using split tunneling. This approach protects the PCs, and therefore the central site, from intrusions from the Internet while tunnels are established. This firewall scenario is called push policy or Central Protection Policy (CPP). On the VPN Concentrator, you create a set of traffic management rules to enforce on the VPN Client, associate those rules with a filter, and designate that filter as the firewall policy. The VPN Concentrator pushes this policy down to the VPN Client. The VPN Client then in turn passes the policy to the local firewall, which enforces it.
By default, no firewall is required for remote users in this group. If you want users in this group to be firewall-protected, choose either the Firewall Required or Firewall Optional setting.
If you choose Firewall Required, all users in this group must use the designated firewall. The VPN Concentrator drops any session that attempts to connect without the designated, supported firewall installed and running. In this case, the VPN Concentrator notifies the VPN Client that its firewall configuration does not match.
If you have remote users in this group who do not yet have firewall capacity, choose Firewall Optional. The Firewall Optional setting allows all the users in the group to connect. Those who have a firewall can use it; users that connect without a firewall receive a warning message. This setting is useful if you are creating a group in which some users have firewall support and others do not—for example, you may have a group that is in gradual transition, in which some members have set up firewall capacity and others have not yet done so.
Click the radio button to select a firewall setting:
|
Note If you require a firewall for a group, make sure the group does not include any clients other than Windows VPN Clients. Any other clients in the group (including VPN 3002 Hardware Clients) will be unable to connect. |
Choose a firewall for the users in this group. Keep in mind when choosing that the firewall you designate correlates with the firewall policies available. The specific firewall you configure determines which firewall policy options are supported. (See Table 14-3 for details.)
Click the drop-down menu button, and select the type of firewall required for users in this group.
|
Note You do not need to use the Custom option for Release 3.5. Currently, all supported firewalls are covered by the other Firewall menu options. |
On the VPN Concentrator, you can configure a custom firewall. Currently there are no supported firewall configurations that you can not choose from the menu on the VPN Concentrator. This feature is mainly for future use. Nevertheless, the following table lists the vendor codes and products that are currently supported.
Enter a single vendor code; enter one or more product codes.
The VPN Concentrator can support any firewall that the VPN Client supports. Refer to the VPN Client Administrator Guide for the latest list of supported clients.
Enter the vendor code for the firewall(s) that remote users in this group are using. Enter only one vendor.
Enter the product code or codes for the firewall(s) that remote users in this group are using. To indicate any supported product, enter 255. Separate multiple codes with commas. Indicate code ranges with hyphens, for example: 4-20.
Enter a description (optional) for the custom firewall.
Depending on which firewall you configured, certain Firewall Policy options are available. (See Table 14-3.)
Table 14-3 Firewall Policy Options Available for Each Firewall
| Firewall | Policy Defined by Remote Firewall |
Policy Pushed | Policy from Server |
|---|---|---|---|
Choose the source for the VPN Client firewall policy.
If the VPN Client also has a local firewall, the policy pushed from the VPN Concentrator works with the policy of the local firewall. Any packet that is blocked by the rules of either firewall is dropped.
The Hardware Client Parameters tab lets you configure interactive hardware client authentication and individual user authentication for the base group. You can enable either feature, both features together, or neither. By default, interactive hardware client authentication and individual user authentication are disabled.
Check the Require Interactive Hardware Client Authentication check box to enable interactive authentication for the VPN 3002.
Check the Require Individual User Authentication box to enable individual user authentication.
Enter the idle timeout period in minutes. If there is no communication activity on a user connection in this period, the system terminates the connection. The minimum is 1 minute, the default is 30 minutes, and the maximum is 2147483647 minutes (over 4000 years). To disable timeout and allow an unlimited idle period, enter 0.
Check the Cisco IP Phone Bypass box to allow IP phones to bypass the interactive individual user authentication processes. Interactive hardware client authentication remains in effect if you have enabled it.
Interactive hardware client authentication provides the central site with additional security by requiring the VPN 3002 to authenticate with a username and password that you enter manually each time the VPN 3002 initiates a tunnel. With this feature enabled the VPN 3002 does not have a saved username and password. When you enter the username and password, the VPN 3002 sends these credentials to the VPN Concentrator to which it connects. The VPN Concentrator facilitates authentication, on either the internal or an external authentication server. If the username and password are valid, the tunnel is established.
You configure interactive hardware client authentication in Hardware Client tab of the Configuration | User Management | Groups screen on the VPN Concentrator at the central site, which then pushes the policy to the VPN 3002.
You specify the type of authentication server in the IPSec tab of the Configuration | User Management | Groups screen on the VPN Concentrator. The VPN 3002 authenticates on the first server of that type that you configure in the Configuration | System | Servers | Authentication screen or Configuration | User Management | Groups | Authentication Servers screen. If the VPN 3002 cannot reach that server, it authenticates on the next server of that type in the list of authentication servers.
When you enable interactive hardware client authentication for a group, the VPN Concentrator pushes that policy to the VPN 3002s in the group. If you have previously set a username and password on the VPN 3002, the software deletes them from the configuration file. When you try to connect, the software prompts you for a username and password.
If, on the VPN Concentrator, you subsequently disable interactive hardware authentication for the group, it is enabled locally on the VPN 3002s, and the software continues to prompt for a username and password. This lets the VPN 3002 connect, even though it lacks a saved username and password, and the VPN Concentrator has disabled interactive hardware client authentication.
If you subsequently configure a username and password (in the VPN 3002 Configuration | System | Tunneling Protocols | IPSec screen), the feature is disable, and the prompt no longer displays. The VPN 3002 connects to the VPN Concentrator using the saved username and password.
Individual user authentication protects the central site from access by unauthorized persons on the same LAN as the VPN 3002.
When you enable individual user authentication, each user that connects through a VPN 3002 must open a web browser and manually enter a valid username and password to access the network behind the VPN Concentrator, even though the tunnel already exists.
|
Note You cannot use the command-line interface to log in if user authentication is enabled. You must use a browser. |
Individual users authenticate according to the order of authentication servers that you configure for a group. To configure authentication servers for individual user authentication, see the sections, Configuration | User Management | Base Group/Groups | Authentication Servers | Add/Modify.
Table 14-4 summarizes how authentication of the VPN 3002 works by default, and how it works with interactive hardware client authentication and individual user authentication enabled. Be aware that you can use both interactive hardware client authentication or individual user authentication simultaneously, or either one and not the other.
Table 14-4 Authenticating the VPN 3002 Hardware Client and Users
When you configure a VPN 3002, you assign it to a group on the VPN Concentrator to which it connects. This is the tunnel group to which the VPN 3002 belongs. The attributes of the tunnel group determine how the VPN 3002 authenticates.
For purposes of authentication, you can associate users behind the VPN 3002 with a group other than the tunnel group. You accomplish this by embedding a different group name within the username. To embed this second group name, you configure and use a delimiter, (@, #, or !) that associates the second group with the user. The format to use is username<delimiter>groupname, for example, UserA@bluegroup.
When you embed a groupname within a username:
|
Note The VPN 3002 always gets settings for interactive hardware client authentication from the tunnel group, not the embedded group. |
Table 14-5 summarizes how UserA, UserB, and UserC connect to the central site through a VPN 3002.
Table 14-5 Example: How Authentication Servers Work Using Embedded Groups
To configure and use a group delimiter, follow these steps.
Step 2 In the General tab of the Configuration | User Management | Groups | Add/Modify screen, check the Strip Realm box to remove the group name embedded in the username during authentication.
To use a second group for individual user authentication, enter the username with the embedded group in the form username<delimiter>groupname in the username field in one of these screens:
Be sure to configure any backup servers for the VPN 3002 with the same values as the primary VPN Concentrator for interactive hardware client authentication and individual user authentication. For information about configuring backup servers, see the section, Mode Configuration Parameters Tab, earlier in this chapter.
If a VPN 3002 authenticates to a VPN Concentrator, and you have enabled accounting, the VPN Concentrator notifies the RADIUS accounting server when the VPN 3002 logs on and off. It also keeps track of individual users. See the section, Configuration | System | Servers | Accounting of this book.
This tab lets you configure PPTP and L2TP parameters that apply to the base group. During tunnel establishment, the client and server negotiate access and usage based on these parameters. Only clients that meet these criteria are allowed access. If you checked PPTP, L2TP, or L2TP over IPSec under Tunneling Protocols on the General Parameters tab, configure these parameters.
Check the Use Client Address check box to accept and use an IP address that the client supplies. A client must have an IP address to function as a tunnel endpoint; but for maximum security, we recommend that you control IP address assignment and that you do not allow client-supplied IP addresses (the default).
Make sure the setting here is consistent with the setting for Use Client Address on the Configuration | System | Address Management | Assignment screen.
Check the PPTP Authentication Protocols check boxes for the authentication protocols that PPTP clients can use. To establish and use a VPN tunnel, users should be authenticated in accordance with a protocol.
|
Caution Unchecking all authentication options means that no authentication is required. That is, PPTP users can connect with no authentication. This configuration is allowed so you can test connections, but it is not secure. |
These choices specify the allowable authentication protocols in order from least secure to most secure.
Check the PPTP Encryption check boxes for the data encryption options that apply to PPTP clients.
If all members of this group are remote dial-in users connecting with modems, enabling data compression might speed up their data transmission rates. Data compression shrinks data by replacing repeating information with symbols that use less space. Check the box to enable data compression for PPTP. PPTP data compression uses the Microsoft Point to Point Compression (MPPC) protocol.
|
Note MPPC data compression increases the memory requirement and CPU utilization for each user session. Consequently, using data compression reduces the overall throughput of the VPN Concentrator and lowers the maximum number of sessions your VPN Concentrator can support. We recommend you enable data compression only if every member of the group is a remote user connecting with a modem. If any members of the group connect via broadband, do not enable data compression for the group. Instead, divide the group into two groups, one for modem users and the other for broadband users. Enable data compression only for the group of modem users. |
|
Note PPTP data compression is only supported for clients that use stateless encryption. |
Check the L2TP Authentication Protocols check boxes for the authentication protocols that L2TP clients can use. To establish and use a VPN tunnel, users should be authenticated in accordance with a protocol.
|
Caution Unchecking all authentication options means that no authentication is required. That is, L2TP users can connect with no authentication. This configuration is allowed so you can test connections, but it is not secure. |
These choices specify the allowable authentication protocols in order from least secure to most secure.
