Cisco Systems OL-6426-02 specs

Chapter 6 Configuring a VPN Using Easy VPN and an IPSec Tunnel

Configuration Example

BETA DRAFT - CISCO CONFIDENTIAL

!

crypto isakmp policy 1 encryption 3des authentication pre-share group 2

lifetime 480

!

crypto isakmp client configuration group rtr-remote key secret-password

dns 10.50.10.1 10.60.10.1 domain company.com

pool dynpool

!

crypto ipsec transform-set vpn1 esp-3des esp-sha-hmac

!

crypto ipsec security-association lifetime seconds 86400

!

crypto dynamic-map dynmap 1 set transform-set vpn1 reverse-route

!

crypto map static-map 1 ipsec-isakmp dynamic dynmap crypto map dynmap isakmp authorization list rtr-remote crypto map dynmap client configuration address respond

crypto ipsec client ezvpn ezvpnclient connect auto

group 2 key secret-password mode client

peer 192.168.100.1

!

interface fastethernet 0

crypto ipsec client ezvpn ezvpnclient outside crypto map static-map

!

interface vlan 1

crypto ipsec client ezvpn ezvpnclient inside

!

Cisco 1800 Series Integrated Services Routers (Fixed) Software Configuration Guide

	OL-6426-02	6-11

Image 83

Cisco Systems OL-6426-02 manual Crypto ipsec client ezvpn ezvpnclient connect auto

Contents

Cisco Systems, Inc Page N T E N T S Configuring Your Router for Ethernet and DSL Access 802.1x Authentication Configure the IPSec Crypto Method and Parameters Configuring Backup Interfaces Chap Configuration Register C-6 OL-6426-02 Audience Preface VPN OrganizationChapter Title Description Boldface Command ConventionsConventions Convention Description Cisco.com Related DocumentsObtaining Documentation Ordering Documentation Documentation FeedbackCisco Product Security Overview Documentation DVD An emergency, you can also reach Psirt by telephone 877 408 Reporting Security Problems in Cisco ProductsObtaining Technical Assistance Cisco Technical Support Website Definitions of Service Request Severity Submitting a Service Request Obtaining Additional Publications and Information Getting Started Page Router Interface Port Label Basic Router ConfigurationInterface Port Labels USB Modem Viewing the Default ConfigurationADSLoISDN ATM WAN Shdsl Example 1-1 Cisco 1812 Default Configuration on Startup Information Needed for Configuration To configure the router, perform one or more of these tasks Configuring Basic Parameters Example Configure Global ParametersConfigure Fast Ethernet LAN Interfaces Command Purpose Configure the Fast Ethernet WAN Interface Configure WAN Interfaces No shutdown Configure the ATM WAN InterfaceMode atm Exit Controller dsl Configuration Example Configure the Wireless InterfaceConfiguring a Loopback Interface Line aux console tty vty line-number Configuring Command-Line Access to the RouterVerifying Your Configuration Password password End LoginExec-timeout minutes seconds Parameters that can be set, see the Cisco IOS IP Configuring Static RoutesExits router configuration mode, and enters Privileged Exec mode Verifying Your Configuration Configuring Dynamic RoutesConfiguration Example Version 1 Configuring RIPCommand Task Router rip Number identifies the route to other Eigrp routers Configuring Enhanced IgrpEnters router configuration mode, and enables Eigrp on the router. The autonomous-system Specifies a list of networks on which Eigrp is to Be applied, using the IP address of the networkRouterconfig# network Configuring Your Router for Ethernet and DSL Access Page For DSL-Based Network Deployments Sample Network DeploymentsFor Ethernet-Based Network Deployments OL-6426-02 Configuring PPP over Ethernet with NAT PPPoE Configuration TasksCommand or Action Purpose Vpdn enable Protocol l2f l2tp pppoe any Configure the Fast Ethernet WAN InterfacesRequest-dialin Initiate to ip ip-address Enables the Fast Ethernet interface Cisco 1800 integrated services routers haveThese steps to configure one or both of them Configures the PPPoE client and specifies Configure the Dialer Interface Your router Using a dialer group controls access toExits the dialer 0 interface configuration Assigns the dialer interface to a dialer group Configure Network Address Translation Source source-wildcard Access-list access-list-number deny permitIp nat inside outside Configuration Example Router# show ip nat statistics PPP over ATM with NAT Configuring PPP over ATM with NAT PPPoA Interface is obtained through PPP/IPCP IP Sets the PPP authentication methodAuthentication Protocol Chap Specifies that the IP address for the dialer Command Reference, Volume 1 of 4 Routing Configure the ATM WAN Interface Attribute Description Default Value Configure DSL Signaling ProtocolConfiguring Adsl Dsl lom integer Dsl enable-training-log Configuring ShdslVerify the Configuration Ignore-error-duration number Line-mode 4-wire enhanced 4-wire standardWire Configure Network Address Translation For NAT Enables the configuration changes just made toAbout enabling static translation, see the Cisco FE2-FE9 reside to be the inside interface Identifies the specified WAN interface as the NAT Static translation, see the Cisco IOS IP CommandExits configuration mode for the ATM interface Defines a standard access list permitting addresses ATM0 VLANs Configuring a LAN with Dhcp and VLANsVlan Configure Dhcp Domain-name domain Default-router address address2 ...address8Import all Dns-server address address2 ...address8 Ip dhcp pool Verify Your Dhcp ConfigurationRouter# show ip dhcp import Example Configure VLANsVerify Your Vlan Configuration Vlan ? Vlan Router# show vlan-switch Switch Port Configurations Vlan Trunking Protocol VTP 802.1x Authentication Layer 2 Interfaces Maximum Switched Virtual Interfaces SVIsSwitched Port Analyzer Span IP Multicast Switching Igmp Snooping Per-Port Storm ControlFallback Bridging Separate Voice and Data Subnets Internet Configuring a VPN Using Easy VPN and an IPSec Tunnel Cisco Easy VPN Configure the IKE Policy Key name Configure Group Policy InformationCrypto isakmp client configuration group Group-name default Ip local pool default poolname Apply Mode Configuration to the Crypto Map Configure IPSec Transforms and Protocols Enable Policy Lookup Configure the IPSec Crypto Method and Parameters Dynamic dynamic-map-name discover Apply the Crypto Map to the Physical InterfaceReverse-route Crypto map map-name seq-num ipsec-isakmp Crypto map map-name Create an Easy VPN Remote Configuration Crypto ipsec client ezvpn name outside inside Verifying Your Easy VPN Configuration Crypto ipsec client ezvpn ezvpnclient connect auto Beta Draft Cisco Confidential Site-to-Site VPN Using an IPSec Tunnel and GRE VPNs GRE Tunnels Example uses 168-bit Data Encryption Configure a VPNConfigure the IKE Policy Also enters Internet Security Association Key Lifetime seconds Configure Group Policy InformationGroup 1 2 Specifies group domain membership Enable Policy LookupExits IKE group policy configuration mode, Enters global configuration mode Negotiating IPSec security associations Configure IPSec Transforms and ProtocolsMethod used to do so Specifies global lifetime values used when Map entry Configure the IPSec Crypto Method and ParametersCreates a dynamic crypto map entry, and enters Creates source proxy information for the crypto Applies the crypto map to the interface Configure a GRE TunnelApply the Crypto Map to the Physical Interface Map Access-list-name ACL that is used by the crypto map Tunnel interface must be configured toExits interface configuration mode, and returns to Enters ACL configuration mode for the named Configuration Example Ip nat outside no cdp enable Beta Draft Cisco Confidential Router with Firewall Configured Configuring a Simple Firewall Unprotected network Series integrated services router, respectivelyFast Ethernet LAN interface the inside interface for NAT Protected network Details about this command Configure Access ListsConfigure Inspection Rules Creates an access list which prevents Internet Inside interface on the router Apply Access Lists and Inspection Rules to InterfacesAssigns the set of firewall inspection rules to Configuring a Simple Firewall Configuration Example Beta Draft Cisco Confidential 1shows a wireless network deployment Configuring a Wireless LAN Connection Configuring a Wireless LAN Connection Configure the Root Radio Station Interface configuration mode for the wireless Sets the permitted authentication methods for aUser attempting access to the wireless LAN Exits Ssid configuration mode, and enters Bridge-group number Configure Bridging on VLANsStation-role repeater root Bridge number crb irb mac-address-table Specified subinterface Configure Radio Station SubinterfacesEnables Ieee 802.1q encapsulation on Assigns a bridge group to the subinterface Exits subinterface configuration mode, No bridge-group 3 unicast-flooding Interface Vlan1 10-1 Sample ConfigurationRouter# show running-config Ip dhcp pool vlan3 10-2 10-3 10-4 10-5 10-6 11-1 Additional Configuration Options 11-2 Configuring Additional Features and Troubleshooting Page 12-1 Configuring Security FeaturesAuthentication, Authorization, and Accounting ACL Type Configuring AutoSecureConfiguring Access Lists Configuration Commands Ip access-group number name in out Configuring a Cbac FirewallAccess Groups Guidelines for Creating Access Groups 12-4 Configuring Cisco IOS Firewall IDSConfiguring VPNs 13-1 Configuring Dial Backup and Remote ManagementDial Backup Feature Activation Methods Backup Interfaces 13-2 Configuring Backup InterfacesFloating Static Routes 13-3 Configuring Floating Static RoutesEnables RIP routing 13-4 Configuring Dialer WatchDialer Watch Specifies the group number for the watch list 13-5 Dial Backup Feature LimitationsDial Backup Type Possible? Dial Backup Method Limitations 13-6 13-7 13-8 Example 13-3 Configuring Dial Backup Using Dialer Watch 13-9 Configure Isdn Settings 13-10 Dialer-group group-number Access-groupIp address negotiated Dialer pool number 13-12 Configure the Aggregator and Isdn Peer RouterFor your Cisco router during the ATM network downtime 13-13 Asynchronous Interface Configuration 13-14 13-15 Line Configuration 13-16 14-1 TroubleshootingGetting Started Before Contacting Cisco or Your Reseller 14-2 Adsl TroubleshootingShdsl Troubleshooting PortFast Troubleshooting 14-3 ATM Troubleshooting CommandsPing atm interface Command Show interface Command 14-4 Shutdown commandOutput Cause Router# show atm interface atm Show atm interface Command14-5 Field Description Debug atm CommandsGuidelines for Using Debug Commands Debug atm errors Command Router# debug atm events Router# Debug atm events CommandRouter# debug atm errors ATM errors debugging is on Router# 14-7 Example 14-7shows a sample output Debug atm packet CommandWhere the keywords are defined as follows Optional ATM interface or subinterface number 14-9 Software Upgrade MethodsRecovering a Lost Password ATM0 Router# show version Change the Configuration Register14-10 Prompt changes to the privileged Exec prompt Reset the RouterRouter# show startup-config Press Return. The following prompt appears 14-12 Reset the Password and Save Your ChangesReset the Configuration Register Value 14-13 Managing Your Router with SDM 14-14 Reference Information Page PC Operating System Software Configuring the Router from a PCOne of the configuration topic chapters in this guide Cisco IOS Software Basic Skills Understanding Command Modes Ctrl-Z ExecAs interface atm Router rip, from Configuration mode Routing protocol AppropriateGetting Help Router Enter one of the router You can now make changes to your router configuration Enable Secret Passwords and Enable PasswordsEntering Global Configuration Mode Command-Line Error Messages Using CommandsAbbreviating Commands Undoing Commands Summary Saving Configuration ChangesWhere to Go Next OL-6426-02 Adsl Concepts Routing Protocol Options Network Protocols RIP PPP Authentication ProtocolsProtocol Ideal Topology Metric Routing Updates Enhanced Igrp PAP Ethernet Network Interfaces Dialer Interface Dial BackupBackup Interface NAT Easy IP Phase PPP Fragmentation and Interleaving QoSIP Precedence Low Latency Queuing Cbwfq Access Lists OL-6426-02 ROM Monitor EnableConfig-reg Resets the configuration register Descriptions section in this appendix ROM Monitor CommandsExits global configuration mode Reload Command Description Command DescriptionsDisaster Recovery with Tftp Download Tftp Download Command Variables Optional Variables Variable CommandRequired Variables Retrytimes Using the Tftp Download CommandTFTPTIMEOUT= time TFTPCHECKSUM= setting Rommon 1 confreg Configuration RegisterChanging the Configuration Register Manually Changing the Configuration Register Using Prompts Console Download Command Description Frame-Displays an individual stack frame Debug CommandsError Reporting Context-Displays processor context for example Exiting the ROM Monitor OL-6426-02 Port Keyword Description Common Port Assignments Finger NETBIOS-NSNETBIOS-DGM NETBIOS-SSN IN-1 See ARPSee AAL See ATM IN-2 See ChapSee CAR IN-3 Dhcp GRE Experience, user Extended access list Overview B-11See also examples Ethernet B-5 Events, ATM, displaying IN-5 See LCPSee NCP See Ipcp See PAPSee PVC See PPP IN-7 See RIPSee NAT IN-8 Upgrading software, methods for 14-9User Datagram ProtocolSee UDP