Defining IPsec Networks and Customers
Available Languages
Table Of Contents
Defining IPsec Networks and Customers
Defining the IPsec Network Elements
Defining Targets by Importing Router Configuration Files
Automatic Removal of Configuration Files Not Generated by VPN Solutions Center
Setting the Passwords for Multiple Edge Device Routers
Specifying the Transport Method for Each Edge Device Router
Specifying the IP Address for the Router's Loopback Interface
Setting the SNMPv3 Parameters for VPNSC Target Routers
Adding a New Router to the Network
Populating IP Address Information to the Repository
Deleting Targets From a Network
Defining a New IPsec VPN Customer
Assigning an Edge Device to a Site
Defining a Device's Secured, Nonsecured, and Tunnel Endpoint Interfaces
Assigning the Management Interface on an Edge Device
Defining Devices as Managed or Unmanaged
Automating SLA Probe Provisioning
Provisioning an SLA Probe Inside an IPsec Tunnel
Creating Customer-Specific Policies
Deleting a Customer from VPN Solutions Center
Defining Terminal Servers in VPN Solutions Center Software
Defining a Target as a Terminal Server
Associating Edge Device Routers with a Terminal Server
Running IOS Commands from the VPN Console
Modifying a Router's Configuration From the VPN Console
Retrieving a Previous Version of a Configuration File
Using the Download Console to Modify a Configuration
Defining IPsec Networks and Customers
Defining the IPsec Network Elements
In this product, a VPN network is a unique group of targets; a target can be a member of only one network. Thus, a VPN network allows a provider to partition the working space into manageable segments that are unique and do not overlap other networks.
A configlet is a partial IOS configuration file that contains a set of Cisco IOS commands created by the VPN Solutions Center provisioning process. The IOS commands in the configlet consist only of the commands necessary for modifying the router's current configuration to enable service request deployment. VPN Solutions Center downloads the configlet to the router, executing the commands in the configlet to change the router's configuration. VPN Solutions Center then collects the updated version of the configuration file from the router; it is this version of the configuration file that VPNSC uses to audit service request deployment. A configlet is also referred to as a "VPNSC configlet."
In the set-up phase of VPN Solutions Center provisioning, you complete the following tasks:
•
Defining a New IPsec VPN Customer
•
•
•
Defining Target Routers
Every device that the VPN Solutions Center software manages must be defined as a target. A target is any device from which the VPN Solutions Center software can collect information (a router or Netflow Collector). In most cases, these targets are Cisco routers that function as an edge router in the IPsec VPN.
Tips
Note
There are two methods for defining targets and organizing them into the appropriate networks (or target groups):
•
VPN Solutions Center automatically populates the interface information into the Repository for each imported target, using the interface specifications in the configuration files.
•
You can define targets manually when you want to create, edit, or delete targets in a network. When you define targets manually, VPN Solutions Center does not automatically populate the interface information into the Repository. For details, see the "Adding a New Router to the Network" section.
Defining Targets by Importing Router Configuration Files
Importing your router configuration files into the VPN Solutions Center software is a quick way to define the MPLS VPN networks and the targets in them. This method lets you specify a directory of router configuration files and the network for these routers. VPN Solutions Center creates the network and the targets (routers) in the network based on the imported configuration files.
When employing this method, note that not all the necessary information is present after you import the files. You must then proceed to define the additional target information, such as the IP addresses, passwords, and so forth.
When you import router configuration files in VPN Solutions Center, this task does not create new target entries in the Repository—it only adds new datasets for existing targets.
To import router configuration files, follow these steps:
Step 1
Device names within each directory must be unique.
A typical set includes edge routers in the customer's network.
Step 2
An informational window displays the following information:
This will create targets based on the router configuration files in a specified directory. A network will be created for the new targets.
You will be asked to enter the following information:
•
The default convention for naming configuration files is device_name.domain_name.com. But adherence to this nomenclature is not required.
•
•
Specifying the domain name is necessary only if a fully domain-qualified hostname is needed to resolve the IP address of the target (router).
Step 3
The Create Targets From Router Configurations dialog box appears (see Figure 4-1).
Figure 4-1 Creating Targets From Router Configuration Files
Step 4
a.
To browse for the directory path, click Select and choose the appropriate directory.
Figure 4-2 Browsing for the Configuration File Directory
b.
The network name should reflect the customer's name.
c.
Caution
Step 5
You receive the following message:
You're about to import router configurations into an existing network. The effect will be additive. Do you want to continue?
Step 6
The VPN Solutions Center software imports the router configuration files from the indicated directory. For every valid configuration file, the VPN Solutions Center software creates a target, and defines the target's role as Cisco router. A valid configuration file is one in which the hostname statement is present in the file. If a configuration file does not contain the hostname statement, VPN Solutions Center software regards the file as invalid and does not import the configuration file into the Repository.
Under the Networks folder in the hierarchy pane, the software adds the specified network name.
Step 7
Figure 4-3 VPN Console Network Window
The targets (routers) that you imported are displayed in the Network window.
Automatic Removal of Configuration Files Not Generated by VPN Solutions Center
Having pre-existing configuration files that were not generated by the VPN Solutions Center software could lead to problems in provisioning the IPsec VPNs. As part of the provisioning process, VPN Solutions Center automatically removes the pre-existing, manually created IPsec configuration files and replaces these files with those generated by the VPN Solutions Center software.
This feature is set in the csm.properties file with the following property:
netsys.provisioning.nonVpnIpsecOverride = true
The default setting for this property is true, which enables the automatic removal of configuration files that were not generated by the VPN Solutions Center software.
Finding a Specific Network
To find a specific network, follow these steps:
Step 1
The Find dialog box appears with the category Network already selected (see Figure 4-4).
Figure 4-4 Find Network Dialog Box
Step 2
Step 3
Step 4
Step 5
The VPNSC software locates the indicated network and highlights it in the hierarchy pane, as shown in Figure 4-5.
Figure 4-5 Network Found in VPNSC Hierarchy Pane
Step 6
Setting the Passwords for Multiple Edge Device Routers
Now that you have imported the router configuration files and assigned them to a VPN network (acme_net in our example), you have completed the initial phase required to define the targets. Now you must enter the rest of the information the product software requires to implement the targets.
The first task is to set the passwords for the edge device routers in the customer network. The values and parameters you set here must be identical to the values and parameters set on the corresponding edge device routers.
Step 1
Step 2
As shown in Figure 4-3, the Network window appears in the data pane on the right, displaying the name of each router in the selected network, along with its domain name and role (in this case, Cisco Router).
At this point, you have the option to enter information for a single target (router) or multiple targets. If the targets share some characteristics, such as the same login or enable passwords, you can define those parameters once for multiple routers, then return to the Network window to edit individual targets for those parameters that are unique for each router. This is the procedure described in the following steps.
Step 3
To select multiple targets from the list, hold down the Ctrl key while you click the desired targets.
Step 4
The Edit Multiple Targets dialog box appears, with the Passwords dialog box displayed (see Figure 4-6). From this dialog box, you can also set the Retries and Timeout parameters for SNMP and Telnet.
Figure 4-6 Setting Passwords for Multiple Edge Device Routers
Step 5
Step 6
Step 7
Step 8
Specifying the Transport Method for Each Edge Device Router
After setting the passwords for the edge device routers in the customer network, specify the configuration file transport method for each edge device router.
Step 1
Step 2
As shown in Figure 4-3, the Network window appears in the data pane on the right, displaying the name of each router in the selected network, along with its domain name and role.
Step 3
Step 4
The Edit Target dialog box appears (see Figure 4-7).
Figure 4-7 Edit Target Dialog Box
The Network, Target Name, and Domain fields are filled in based on your selection from the Networks window.
Step 5
•
•
For details, see the "Enabling TFTP on the VPN Solutions Center Workstation" section.
•
Step 6
At this point, you can either complete this task by clicking OK, or proceed to the next task, specifying the IP address on the selected router. If you choose to complete this task for this router, specify the transport method for the other routes in the network by repeating this procedure for each router.
Specifying the IP Address for the Router's Loopback Interface
After setting the configuration transport method for the selected edge device router, specify the IP address for the router's loopback interface.
Step 1
Step 2
Figure 4-8 Specifying the IP Address
Step 3
The IP Addresses dialog box now displays the newly assigned IP address (see Figure 4-9).
Figure 4-9 IP Address Assigned to an Edge Device Router
Step 4
Setting the SNMPv3 Parameters for VPNSC Target Routers
Simple Network Management Protocol Version 3 (SNMPv3) is an interoperable standards-based protocol for network management. SNMPv3 provides secure access to devices by a combination of authenticating and encrypting packets over the network.
This section describes how to set the SNMPv3 parameters on the routers defined in VPN Solutions Center software.
Tips
If you do not require security levels in SNMP operations, setting these parameters is not necessary. In this case, SNMP operations use the SNMPv2C model by matching community strings.
Authentication is the process of ensuring message integrity and protection against message replays. Authentication includes both data integrity and authenticating data origin.
VPN Solutions Center 2.0 supports two SNMPv3 security levels:
•
•
See Table 2-1 for more details on SNMP security models and levels.
To set the SNMPv3 parameters for the target edge device routers defined in VPN Solutions Center, follow these steps:
Step 1
Step 2
The Network window appears in the data pane on the right, displaying the name of each router in the selected network, along with its domain name and role.
Step 3
Step 4
The Edit Target dialog box appears (see Figure 4-7).
Step 5
The SNMPv3 Parameters dialog box appears (see Figure 4-10).
Figure 4-10 SNMPv3 Parameters Dialog Box
Step 6
•
•
•
Step 7
•
•
•
•
•
Step 8
Adding a New Router to the Network
When you manually add a new router (target) to the network, you must complete two tasks:
•
•
In the event you need to add a new target (router) to an IPsec VPN network, follow these steps:
Step 1
Step 2
Step 3
The Network window appears, displaying the names of the devices in the selected network.
Step 4
Figure 4-11 Defining a New Target
Step 5
a.
b.
c.
d.
e.
The Transport field configures the method of communication between the VPN Solutions Center workstation and the specified router The default is TGS_SSH for IPsec operations.
f.
Specifying the Device Passwords and SNMP and Telnet Parameters
Step 6
The New Target Passwords dialog box appears (see Figure 4-12).
Note
Figure 4-12 New Target Passwords Dialog Box
Step 7
a.
b.
c.
d.
e.
f.
g.
Specifying the IP Addresses for the New Target
Step 8
Step 9
The Add IP Address dialog box appears (see Figure 4-13).
Figure 4-13 Add IP Address Dialog Box
Step 10
•
For information about the management interface, see the "Assigning the Management Interface on an Edge Device" section.
The address you entered is displayed in the "IP Addresses for reaching this target" area (see Figure 4-14).
Figure 4-14 New Target IP Addresses Dialog Box
You can also specify an IP address as the management interface from this dialog box.
To add additional IP addresses for this device, repeat Steps 9 and 10.
Specifying the SNMPv3 Parameters
Step 11
The SNMPv3 Parameters dialog box appears (see Figure 4-15).
Figure 4-15 SNMPv3 Parameters Dialog Box
Step 12
•
•
•
Step 13
•
•
•
•
•
Step 14
Associating a Terminal Server with the New Device
Step 15
The Terminal Server dialog box appears (see Figure 4-16).
Figure 4-16 Terminal Server for New Target Router
a.
•
b.
c.
Populating IP Address Information to the Repository
After you manually add a new device to a network, you must populate the IP addresses into the Repository database as follows:
Step 1
Step 2
This wizard sets up a scheduled task that polls for information about router interfaces. It extracts the interface name, index number, and IP address and subnet mask for each interface. The collected interface information is stored with each router definition.
Deleting Targets From a Network
If you need to delete a target from a VPN Solutions Center network, make sure that the target router is not part of any active service request or a service request that could be activated.
To delete a target from a network, follow these steps:
Step 1
Step 2
The Networks window appears (see Figure 4-17).
Figure 4-17 List of Devices in the Selected Network
Step 3
Step 4
You receive the following message:
WARNING! When a target in a persistent task is deleted, it can cause problems.
Are you sure you want to delete the selected target(s)?
Step 5
Creating Default Policies
Before you define VPN Customers and VPNS, it is a good idea to set the default policies. You can create a set of default policies that can then be automatically applied to new Customers and incorporated into new service requests without requiring further modification.
Default customer default policies that are created after a new Customer is defined are not accessible by that new Customer. Thus, any new default policies cannot be assigned to service requests for that Customer.
To create a set of default policies, follow these steps:
Step 1
The dialog box shown in Figure 4-18 appears.
Figure 4-18 Entering the Policy Name
Step 2
The Edit Policy dialog box appears (see Figure 4-19).
Figure 4-19 Editing Global Parameters for the Default Policy
Step 3
The IPsec Lifetime parameters are global lifetime settings. A Lifetime is associated with each security association, beyond which the SA cannot be used. There are two lifetimes: a timed lifetime, specified in terms of the duration of the SA; and a traffic-volume lifetime, specified the number of bytes secured using this SA. A security association expires after the first of these lifetimes is reached.
If you change a global lifetime, the new lifetime value will not be applied to existing security associations. If you wish to use the new values immediately, you can clear all or part of the security association database.
The IKE Keepalive parameters are a Cisco proprietary extension to IKE that detects failures in IKE negotiation. After an IKE session is established, each node sends keepalive packets to its peers. When a peer does not respond, the sending node tears down the IKE/IPsec tunnel with the non-responding peer.
a.
b.
c.
d.
e.
Diffie-Hellman is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecure communications channel. IKE uses Diffie-Hellman to establish session keys.
•
VPN Solutions Center supports two Diffie-Hellman groups: Group 1—a MODP group with a 768-bit modulus; Group 2—a MODP group with a 1024-bit modulus.
•
Step 4
The Proposals dialog box appears (see Figure 4-20).
Figure 4-20 Proposals Dialog Box for Default Customer Policies
Step 5
a.
•
•
•
b.
•
•
c.
•
•
d.
•
•
e.
Step 6
a.
•
•
•
b.
•
•
•
c.
•
•
•
•
d.
•
•
e.
f.
Note that a security association expires after the first of these lifetimes is reached.
Step 7
The Save Status dialog box appears, which notes the path and filename of the Default Customer Policy.
Step 8
You can also create Customer Policies for individual customers. For details, see the "Creating Customer-Specific Policies" section.
Defining a New IPsec VPN Customer
Defining an IPsec VPN customer requires the following tasks:
•
•
•
•
•
•
•
To define a new VPN customer, follow these steps:
Step 1
The Enter Customer Name dialog box appears (see Figure 4-21).
Figure 4-21 Entering the Customer Name
Step 2
The first character in the customer name must be a letter. The customer name can contain letters, numbers, and these punctuation characters: period, underscore, and dash. The Customer name cannot exceed 63 characters.
The Edit Customer dialog box appears (see Figure 4-22).
Figure 4-22 Edit Customer Dialog Box
Step 3
Step 4
Next, define the sites for the current customer (see the next section).
Defining Customer Sites
To define the sites for a new or existing Customer, follow these steps:
Step 1
Step 2
The Customer menu appears (see Figure 4-23).
Figure 4-23 Customer Menu
Step 3
The Enter Customer Site Name dialog box appears (see Figure 4-24).
Figure 4-24 Entering the Customer Site Name
Step 4
The first character in the Customer Site name must be a letter. The customer name can contain letters, numbers, and these punctuation characters: period, underscore, and dash. The Customer Site name cannot exceed 63 characters.
The Edit Site dialog box is displayed (see Figure 4-25).
Figure 4-25 Site Information Displayed
Step 5
Step 6
Next, assign an edge device to each customer site (see the next section).
Assigning an Edge Device to a Site
Once you create one or more sites in VPN Solutions Center, your next task is to assign at least one edge device router to each site. To do so, follow these steps:
Step 1
Step 2
Figure 4-26 Customer Sites List
Step 3
The Edit Site dialog box displays the name of the selected site.
Step 4
You can also select the name of the site and right-click. From the menu, choose Add Edge Device.
The Add IPsec Edge Device dialog box appears (see Figure 4-27).
Figure 4-27 Add IPsec Edge Device Dialog Box
Step 5
a.
b.
c.
d.
The newly added router is assigned to the site. As shown in Figure 4-28, you can see the device displayed in the Edge Devices folder for the site.
Figure 4-28 Newly Added Edge Devices Displayed in the Customers Tab
Step 6
Next, define the secured and nonsecured interfaces on each edge device in the customer's VPN (see the next section).
Defining a Device's Secured, Nonsecured, and Tunnel Endpoint Interfaces
An edge device router must have a secured (encrypted) interface and a nonsecured (unencrypted) interface associated with the device. The secured interface faces the service provider network, and the nonsecured interface faces the customer's intranet.
The edge device router must also have a secured tunnel endpoint. The tunnel endpoint interface can be either a loopback interface (with the IP address in the service provider's address space) or an interface that is not a loopback.
Note
To define the secured, nonsecured, and tunnel endpoint interfaces for a device, follow these steps:
Step 1
Step 2
Step 3
As shown in Figure 4-29, the Edge Device menu appears.
Figure 4-29 Opening the Edge Device
Step 4
The Edit Edge Device dialog box appears (see Figure 4-30).
Figure 4-30 Device-Related Settings for the Selected Edge Device
Step 5
The IPsec Interfaces dialog box appears (see Figure 4-31).
Figure 4-31 Assigning the Device Interfaces
a.
The selected interface is displayed in the Secured Tunnel Endpoint pane.
The edge device router must have a secure tunnel endpoint. A tunnel endpoint is a virtual—not an actual—interface that is required by IPsec to define the end point of an IPsec tunnel. The tunnel endpoint interface can be either a loopback interface (with the IP address in the service provider's address space) or an interface that is not a loopback.
Note
If you assign a non-loopback interface as the tunnel endpoint interface, note the following:
•
•
b.
The selected interface is displayed in the Secured Interfaces pane.
If you selected a non-loopback interface as the tunnel endpoint, VPN Solutions Center already assigned it as the secured interface.
c.
The selected interface is displayed in the Nonsecured Interfaces pane (see Figure 4-32).
Figure 4-32 Functions for the Device Interfaces Assigned
The OSPF Area Border Router Attribute
Step 6
Tips
Step 7
Step 8
Assigning the Management Interface on an Edge Device
The VPN Solutions Center Network Management Subnet resides inside the service provider network, and communicates with edge device routers through an assigned management interface. Configuration changes are managed by VPN Solutions Center software and transported to the appropriate edge devices through the management interface.
Each edge device has one secured interface through which secure traffic flows to and from the other edge devices in an IPsec VPN. Cisco recommends that the secured tunnel endpoint interface and the management interface for that device should be configured to be the same interface. The secured tunnel endpoint can be either the secured interface or the loopback interface on the edge device.
To assign a device interface as the management interface, follow these steps:
Step 1
Step 2
Step 3
The Edge Device menu appears.
Step 4
The Edit Edge Device dialog box appears.
Step 5
Figure 4-33 Selecting the IP Address for the Management Interface
Step 6
Note
Step 7
The selected IP address in the list now displays with the designation "management interface"; for example:
192.168.115.85 (found on loopback0, management interface)Step 8
The change is added to the VPN Solutions Center Repository.
When you add an IP address to a target router, the Add IP Address dialog box provides an option to designate the interface the new IP address is assigned to as a management interface.
Defining Devices as Managed or Unmanaged
VPN Solutions Center 2.0 allows you to specify for each edge device whether it is a managed or unmanaged device.
•
•
For managed devices, you can specify whether these devices support SA Agent and can therefore collect SLA data—this is the Managed Device with SLA Probe option. For information on configuring a device so that SA Agent is enabled, see the "Enabling SA Agent on an Edge Device" section. When you enable the Managed Device with SLA Probe option, two additional options become available:
•
•
Automating SLA Probe Provisioning
When you enable the Automate SLA Probe Provisioning option, VPN Solutions Center automatically configures a set of user-specified SLA probe types between the peer edge devices specified in the service request. These settings are applied per edge device; that is, you can have SLA probes automatically configured on none, some, or all of the edge devices in a service request. Enabling this option makes it easier (and less error prone) to set up the standard set of probe types that you need to collect SLA data.
Note
VPN Solutions Center supports the following SLA probe types:
•
The default probe type is UDP Echo.
•
•
•
•
•
•
Step 1
Step 2
Step 3
The Edge Device menu appears.
Step 4
The Edit Edge Device dialog box appears (see Figure 4-34).
Figure 4-34 Device-Related Settings for the Selected Edge Device
Step 5
The Management dialog box appears (see Figure 4-35).
Figure 4-35 IPsec Management Dialog Box
Step 6
Step 7
When you enable the Automate SLA Probe Provisioning option, VPN Solutions Center automatically configures a set of user-specified SLA probe types between the peer edge devices specified in the service request. These settings are applied per edge device; that is, you can have SLA probes automatically configured on none, some, or all of the edge devices in a service request. Enabling this option makes it easier (and less error prone) to set up the standard set of probe types that you need to collect SLA data.
Step 8
Step 9
Editing the csm.properties File to Enable Additional SLA Probe Types
Since UDP Echo is the only SLA probe type configured by default, if you need to configure and run other probe types, you must specify those probe types by editing the csm.properties file to do so. Thus, if you wish to take advantage of the VPN Solutions Center's Automate SLA Probe Provisioning option, make sure that the corresponding list of desired probe types is specified in the csm.properties file. The section in the csm.properties file that specifies these properties is titled "SLA Auto-Config Properties."
The parameters for each SLA probe type are specified in the csm.properties file.
1.
### List of probe types to be created (space-delimited)# Types = echo tcpconnect udpecho jitter dns http dhcp; Default = udpechonetsys.vpn.autoProbeConfig.rttTypes = udpechoThe netsys.vpn.autoProbeConfig.rttTypes parameter specifies which probes are automatically configured. You can enable as many probe types as you want in a space-delimited list by adding any additional types to the line.
2.
For each SLA probe type, there are additional properties that specify the parameters for that particular probe type.
3.
4.
Once you a) specify the desired probes and their parameters in the csm.properties file and b) enable the Automate SLA Probe Provisioning option for a particular edge device, when that edge device is included in a service request, VPN Solutions Center configures the specified set of SLA probes to each of its peers. You must schedule the SLA probe in order for the probe to be provisioned.
Provisioning an SLA Probe Inside an IPsec Tunnel
With the Provision SLA Probe Inside IPsec Tunnel option, you can specify whether you want the SLA probe packets to be sent inside the IPsec tunnel (in encrypted form).If you want the probe traffic to be protected in the same way as other IPsec traffic, enable this option. When this option is not enabled, VPN Solutions Center sends the SLA probe packets outside the IPsec tunnel (in clear form).
Note
Step 1
Step 2
Step 3
The Edge Device menu appears.
Step 4
The Edit Edge Device dialog box appears (see Figure 4-34).
Step 5
The Management dialog box appears (see Figure 4-35).
Step 6
Step 7
With this option, you can specify whether you want the SLA probe packets to be sent inside the IPsec tunnel (in encrypted form).If you want the probe traffic to be protected in the same way as other IPsec traffic, enable this option. When this option is not enabled, VPN Solutions Center sends the SLA probe packets outside the IPsec tunnel (in clear form).
Step 8
Step 9
Creating Customer-Specific Policies
To create policies for a specific customer, follow these steps:
Step 1
Step 2
The Customer menu appears.
Step 3
The Edit Customer dialog box opens (see Figure 4-22).
Step 4
The Enter Policy Name dialog box appears (see Figure 4-36).
Figure 4-36 Entering the Customer-Specific Policy Name
Step 5
The first character in the policy name must be a letter. The policy name can contain letters, numbers, and these punctuation characters: period, underscore, and dash. The policy name cannot exceed 63 characters.
The Policies dialog box appears, displaying the Global Parameters tab (see Figure 4-37).
Figure 4-37 Global Parameters for a Customer-Specific Policy
In most cases, the global parameters for the customer-specific policy is sufficient. For details on these parameters, see the "Creating Default Policies" section.
Step 6
The Proposals dialog box appears (see Figure 4-38).
Figure 4-38 Proposal Parameters for a Customer-Specific Policy
The default values set in this dialog box are taken from the userprofile file.
Step 7
Step 8
Deleting a Customer from VPN Solutions Center
To delete a customer from VPN Solutions Center software, follow these steps:
Step 1
Step 2
The Customer menu appears (see Figure 4-39).
Figure 4-39 Customer Menu
Step 3
The following confirmation message appears:
Are you sure you want to delete this customer?
Step 4
The customer definition is removed from the VPN Solutions software.
To cancel the operation, click No.
Defining Terminal Servers in VPN Solutions Center Software
A terminal server is a communications processor that connects asynchronous devices such as terminals, printers, hosts, and modems to a LAN or WAN. In VPN Solutions Center 2.0, terminal servers provide a way to provision edge device routers from a workstation.
The VPN Solutions Center workstation is connected on a LAN to the terminal server device (typically a Cisco 2500 Series router). Each of the terminal server device's ports have a port number. Each serial line can be connected to an edge device router's console port. In this way, a VPN Solutions Center operator can communicate directly with an edge device router.
In the VPN Solutions Center software, you first define a target as a terminal server, and then associate that terminal server device with a particular edge device router.
Defining a Target as a Terminal Server
To define a target as a terminal server in VPN Solutions Center software, follow these steps:
Step 1
Step 2
Step 3
The Networks window appears.
Step 4
The New Target dialog box appears (see Figure 4-40).
Figure 4-40 New Target Dialog Box
Step 5
a.
b.
c.
If you do not specify the domain server name, VPN Solutions Center uses the target name; then, using, DNS, it performs a domain lookup.
d.
When you define the role of the device as a terminal server, the Transport field is disabled.
e.
Specifying the Device Passwords and SNMP and Telnet Parameters
Step 6
The New Target Passwords dialog box appears (see Figure 4-41).
Note
Figure 4-41 New Target Passwords Dialog Box
Step 7
a.
b.
c.
d.
e.
f.
g.
Step 8
Step 9
The Add IP Address dialog box appears (see Figure 4-42).
Figure 4-42 Add IP Address Dialog Box
Step 10
To add additional IP addresses for this device, repeat Step 6 and Step 7.
Specifying the SNMPv3 Parameters
Step 11
The SNMPv3 Parameters dialog box appears (see Figure 4-43).
Figure 4-43 SNMPv3 Parameters Dialog Box
Step 12
•
•
•
Step 13
•
•
•
•
•
Step 14
Associating Edge Device Routers with a Terminal Server
When a terminal server device is defined in VPN Solutions Center software, you can then associate one or more edge device routers in the network with that terminal server device. Then a workstation connected to the terminal server device can communicate with all of the routers associated with the terminal server.
To associate a terminal server with edge device routers, follow these steps:
Step 1
The Terminal Server dialog box appears (see Figure 4-44).
Figure 4-44 Terminal Server Dialog Box
This dialog box provides a procedure for adding access from the terminal server to a single edge router device or adding access to multiple edge router devices.
Adding Terminal Server Access to a Single Device
Step 2
A new row appears in the window. If there are multiple targets in the Repository, the Target field displays a drop-down list.
Step 3
Step 4
The cursor appears in the Port Number field.
Step 5
Step 6
Adding Terminal Server Access to Multiple Devices
Step 1
The Target Choose dialog box appears (see Figure 4-45).
Figure 4-45 Selecting Multiple Devices for Terminal Server Access
Step 2
To select multiple items in a list, press Ctrl+Click.
Note that when you select multiple routers from the list, the Port Number field is grayed out.
Step 3
You return to the Terminal Server dialog box, where the routers that you selected are added to the list of targets for the terminal server.
Step 4
You have now completed defining a device as a terminal server and configured terminal server access to the routers.
Running IOS Commands from the VPN Console
You can run Cisco IOS commands on a router's command line by using VPN Solutions Center's Exec Command feature. This feature makes it easy to run commands on multiple routers at once. The Exec Command Console puts you in Enable mode, thus you can run any IOS commands that are executable in Enable mode.
Executing commands in this way does not change the router's configuration file. VPN Solutions Center simply runs the commands you enter and returns the command's response, just as it does when communicating with a router through a console.
To execute an IOS command on a router, follow these steps:
Step 1
The Cisco VPN Solutions Center browser appears. If the browser is not already running, you must log in.
Step 2
The VPN Solutions Center Exec Command Console page appears (see Figure 4-46).
Figure 4-46 The Exec Command Console
You can run commands in the Exec Command Console in either of two ways:
•
The command input file must be a text file. There is no practical limit to the number of commands that be included in a command input file.
•
Step 3
The routers in the selected network are displayed in the window below the Network field.
Step 4
Step 5
a.
You can also specify the name and path for the command input file by clicking Browse and selecting the file in its directory.
b.
c.
Step 6
If you need to erase the contents of the Commands pane, click Clear. Then reenter the commands as needed.
The lower pane displays the output from the command you entered for each device you selected.
Modifying a Router's Configuration From the VPN Console
VPN Solutions Center provides a mechanism called the Download Console that allows you to download configuration files—or any set of IOS commands—to one or more routers. The Download Console adds the IOS commands to the router's existing configuration file. By default, VPN Solutions Center sets the modified configuration file as the running configuration.
The following procedure describes a typical scenario in which you need to download a previous version of a router's configuration file to one or more routers. To do that, you must first use the Version Console to retrieve a previous version of the configuration file, and then use the Download Console to download the configuration file to the selected routers.
Retrieving a Previous Version of a Configuration File
To retrieve a previous version of a configuration file stored on the VPN Solutions Center workstation, follow these steps:
Step 1
The Version Console appears (see Figure 4-47).
Figure 4-47 The Version Console
The Version Console organizes the configuration files by networks and their associated routers.
Step 2
Step 3
Step 4
As shown in Figure 4-48, the Version Console displays the version list for the selected router. The versions are displayed according to the dates and times the configuration files were collected, and organized with the most recent version listed first, the next most recent second, and so on.
Figure 4-48 List of Configuration File Versions
Step 5
Step 6
The Version window appears, displaying the selected version of the configuration file (see Figure 4-49). The version number and hostname of the router are displayed in the title bar.
Figure 4-49 Previous Configuration File Displayed
Step 7
The Save As dialog box appears (see Figure 4-50).
Figure 4-50 Saving a Configuration File
Step 8
You return to the Version window.
Step 9
Using the Download Console to Modify a Configuration
The Download Console downloads the IOS commands to the selected routers.You can download an actual IOS configuration file, or a file that contains a desired set of IOS commands. By default, VPN Solutions Center sets the modified configuration file as the running configuration.
To download a set of IOS commands to one or more routers, follow these steps:
Step 1
The Download Console dialog box appears.
Step 2
Figure 4-51 Opening the IOS Commands File
Step 3
The contents of the selected file are displayed in the Edit Commands pane, as shown in Figure 4-52.The upper right pane displays the list of target routers in the Target Routers pane. The lower right pane is the Download Status pane.
Figure 4-52 The IOS Commands File Displayed in the Download Console
Step 4
Step 5
a.
The list of network devices in the selected network are displayed.
b.
The list of Cisco routers in the selected network are displayed.
c.
Step 6
You receive the following message:
Are you sure you wish to download the configlet to the selected routers?
Step 7
To cancel the IOS commands download operation, click No.
VPN Solutions Center downloads the commands displayed in the Edit Commands pane to the selected routers. These commands are added to the existing configuration on the selected routers.
Figure 4-53 shows the Download Console as it appears when the IOS command download operation is complete. The status of the download operation is displayed in the Download Status pane.
Figure 4-53 IOS Command File Download Operation Complete
Use the scroll bar in the Download Status pane to view the status information that the routers return in response to the downloaded IOS commands.
Step 8
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)