cc/td/doc/product/iaabu/csvpnc
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Configuring Manual Configuration

Configuring Manual Configuration

This chapter describes how to manually configure internal corporate IP addresses on a Cisco Secure VPN Client (VPN Client). With manual configuration, you can assign a static, internal IP address to a client, making it easier to administer IP Security Protocol (IPSec) policy from the Cisco router (gateway) to the VPN Client.This chapter includes the following sections:

Note Throughout this chapter, there are numerous configuration examples that include unusable IP addresses, passwords, and public key examples. Be sure to use your own IP addresses, passwords, and public keys when configuring your VPN Clients and gateway.

Figure 3-1: Manual Configuration Topology


Task 1---Configuring Manual Configuration on the VPN Client

To configure manual configuration between a VPN Client and a Cisco router, perform the following tasks:

Specifying an Internal Network Address on the VPN Client

To specify an internal network address on a VPN Client, perform the following tasks:

To open the Security Policy Editor

Click Start>Programs>Cisco Secure VPN Client>Security Policy Editor.

The SafeNet/Soft-PK Security Policy Editor window appears, as shown in Figure 3-2. Table 3-2 describes the field descriptions for the SafeNet/Soft-PK Security Policy Editor.


Figure 3-2: SafeNet/Soft-PK Security Policy Editor



Table 3-1: SafeNet/Soft-PK Security Policy Editor Window Field Descriptions
Field Description

Security Policy Editor

This window establishes connections and their associated proposals, and lists connections in a hierarchical order that defines an IP data communications security policy.

Other Connections

This object is a policy, or a default connection, and the first step in establishing security policies for individual connections.

Connection Security

Under Connection Security, you can define IP access for this connection using Secure, Non-secure, and Block options.

  • Secure

  • This option secures the IP communications for this connection.

  • Non-secure

  • This option allows for IP communications to occur without encryption, and allows you to change any settings under your Internet Interface. This is the default.

  • Block

  • This option denies all IP communications to the VPN Client.

To open and define Global Policy Settings

Step 1 On the Options menu, click Global Policy Settings.

The Global Policy Settings window appears, as shown in Figure 3-3. Table 3-2 describes the field descriptions for the Global Policy Settings window.

Step 2 Select the Allow to Specify Internal Network Address check box, and then click OK.


Figure 3-3: Global Policy Settings Window



Table 3-2: Global Policy Settings Window Field Descriptions
Field Description

Global Policy Settings

Using this window, set preferences for all transmissions.

Retransmit Interval (seconds)

In this box, specify the amount of time your computer waits before it retransmits a protocol packet to which a device has not responded. The default interval is 15 seconds.

Number of retries

In this box, specify the number of times your computer retransmits a protocol packet before abandoning the exchange. The default is 3 retries.

Send status notifications to peer hosts

If selected, this check box sends messages that inform communicating parties whether their security proposals have been accepted or rejected, and the timeout periods.

Enable Non-IP Connections

If selected, this option allows your computer to transmit non-IP data without security. As a default, the VPN Client secures IP data and discards all non-IP data.

Allow to Specify Internal Network Address

If selected, this option allows you to enter the exact IP address under My Identity. An internal network address is the actual IP address for the VPN Client behind a network firewall. Use this option to specify that you want to indicate an internal network address. This allows you to enter the IP address in the Network Security Policy window under My Identity in the Internal Network IP Address box.

Configuring New Gateway for Security Policy

To configure a new gateway for a security policy on a VPN Client, perform the following tasks:

To create a new connection

Step 1 In the left pane, click Other Connections.

Step 2 On the File menu, click New Connection.

Step 3 In the left pane, the default New Connection placeholder appears for the New Connection pane.

Step 4 Select New Connection, and in its place, define a unique name for the connection to your gateway.

For example, if your router name is hq_sanjose, you might rename the connection tohq_sanjose, as shown in Figure 3-4. Table 3-3 describes the field descriptions for the New Connection pane.


Figure 3-4: Renaming a New Connection Pane


To define the new connection

Step 1 In the left pane, click your new connection. In this example, tohq_sanjose is clicked.

The new connection pane appears.

Step 2 In the right pane, under Connection Security, click Secure.

Step 3 In the right pane, under Remote Party Identity and Addressing, enter the following:

Figure 3-5 shows how this is displayed on the New Connection pane. Table 3-3 describes the field descriptions for the New Connection pane.


Figure 3-5: New Connection Pane



Table 3-3: New Connection Pane Field Descriptions
Field Description

Network Security Policy

Under Network Security Policy, the proposals that will be used to negotiate the authentication and encryption methods are displayed.

  • New Connection

  • This object is a set of security parameters that pertain to an individual remote IP connection. New Connection is the default connection name.

  • Other Connections

  • This object is the default connection and the first step in establishing security policies for individual connections. For all IP communications that do not adhere to the security policies defined in the individual connections, Other Connections acts as a default. Other Connections is always the last rule among security policies.

Connection Security

Under Connection Security, you can define IP access for this connection.

  • Secure

  • This option secures the IP communications for this connection.

  • Non-secure

  • This option allows for IP communications to occur without encryption, and you to change any settings under your Internet Interface. This is the default.

  • Block

  • This option denies all IP communications to the VPN Client.

Remote Party Identity and Addressing

Under Remote Party Identity and Addressing, define the IPSec peer with which the VPN Client will establish a secure tunnel.

ID Type

This list displays options for defining the IPSec peer identity including IP address, domain name, email address, IP subnet, IP address range, and distinguished name.

Depending on the option you choose, different values will appear in the right pane.

  • IP Address

  • This option allows a static IP address to be configured on the VPN Client. This is the default option.

    • IP address value

    • In this box, specify the IP address value.

  • Domain Name

  • This option enables the domain name value box and the IP Address box.

    • Domain name value

    • In this box, specify the domain name value.

    • IP Address

    • In this box, specify the IP address of the domain, the organizational IP address.

  • Email Address

  • This option allows you to indicate the email address of the peer.

    • Email value

    • In this box, specify the e-mail value.

    • IP address value

    • In this box, specify the peer's IP address.

  • IP Subnet

  • This option allows you to specify the IP subnet the client will be allowed to access using this peer.

    • Subnet

    • In this box, specify the subnet IP address.

    • Mask

    • In this box, specify the mask IP address.

  • IP Address Range

  • This option allows you to indicate the range of IP addresses to which this client will have access.

    • From

    • In this box, specify the beginning IP address.

    • To

    • In this box, specify the ending IP address.

  • Distinguished Name

  • This option allows you to specify the name, department, state, and country of the peer identity.

    • Edit Name

    • Using this button, specify the distinguished name settings.

    • IP Address

    • In this box, specify the peer's IP address.

Port

This list shows the IPSec peer's protocol ports. A default of All secures all protocol ports.

Connect using Secure Gateway Tunnel

If selected, this check box specifies that the IPSec peer is protected by a secure IPSec-compliant gateway, such as a firewall.

ID_Type

This list shows the identification type of the gateway including IP address, domain name, and distinguished name.

Depending on the option you choose, different values will appear in the right pane.

  • IP Address

  • This option enables the IP address value box. This is the default.

    • IP address value

    • In this box, specify the IP address value.

  • Domain Name

  • This option enables the domain name value box and the IP Address box.

    • Domain name value

    • In this box, specify the domain name value.

    • IP Address

    • In this box, specify the IP address of the domain.

  • Distinguished Name

  • This option allows you to specify the name, department, state, and country of the gateway.

    • Edit Name

    • Using this button, specify the distinguished name settings.

    • IP Address

    • In this box, specify the gateway's IP address.

Specifying the VPN Client's Identity

To specify the remote party's identity on a VPN Client, perform the following tasks:

To choose an identity

Step 1 In the left pane, double-click the new connection. In this example, tohq_sanjose is double-clicked.

The new connection expands with My Identity and Security Policy.

Step 2 Click My Identity.

The My Identity pane appears in the right pane.

Step 3 In the right pane, under My Identity, enter the following:

Figure 3-6 shows how this is displayed on the My Identity pane. Table 3-4 describes the field descriptions for the My Identity pane.


Figure 3-6: My Identity Pane



Table 3-4: My Identity Pane Field Descriptions
Field Description

My Identity

This pane allows you to specify the identity of the VPN Client. Choose an identification that will allow the IPSec peer to identify you during the key exchange phase in the My Identity pane.

My Identity

Under My Identity, specify options for determining the identity of the VPN Client. These options include selecting certificate or pre-shared key, ID Type, and Port.

Select Certificate

If you are using digital certification, this list displays all the available digital certificates from which to choose. If you are not using digital certification, None is the default option.

ID_Type

This list indicates the IP address option for the VPN Client on the corporate subnet.

  • IP Address

    • Internal Network IP Address

  • This option enables the IP address value box.

    • In this box, specify the IP address of the VPN Client on the corporate subnet. This field only appears if you specify an internal IP address in the Global Policy Settings window.

Port

This list shows the VPN Client's protocol ports. A default of All secures all protocol ports.

Local Network Interface or Internet Interface

Under Local Network Interface or Internet Interface, the hardware interface on the PC or laptop through which the connection will be established.

Name

This list indicates the name of the hardware interface. A default of Any enables all hardware interfaces.

IP Addr

A default of Any enables all hardware interface IP addresses.

Pre-shared Key

The Pre-shared Key button enables the Pre-shared Key window.

To specify a pre-shared key or a wildcard pre-shared key, enter the key to be used during the Authentication Phase in the Pre-shared Key window.

To specify authentication

Task 2---Configuring Manual Configuration on the Gateway

To configure manual configuration on the gateway, perform the following tasks:

Configuring the Gateway

To configure the gateway, perform the following tasks, as described in Table 3-5:


Table 3-5: Configuring the Gateway
Command Purpose
router> enable

To enter privileged EXEC mode, enter the enable user EXEC command.

router# configure terminal Enter configuration commands, one per line. End with CNTL/Z.

To enter global configuration mode, enter the configure privileged EXEC command. To configure the terminal attached at console port, enter the terminal keyword.

router(config)# ip domain-name example.com

To define a default domain name that the Cisco IOS software uses to complete unqualified host names, use the ip domain-name global configuration command. An unqualified host name is a host name without a dotted-decimal domain name.

In this example, example.com is defined as the default domain name.

router(config)# hostname hq_sanjose

To specify or modify the host name for the network server, enter the hostname global configuration command. The host name is used in prompts and default configuration filenames.

In this example, hq_sanjose is defined as the host name. The hq_sanjose host name replaces the default router host name.

hq_sanjose(config)# ip name-server 192.168.1.1

To specify the address of a name server to use for name and address resolution, enter the ip name-server global configuration command.

In this example, the gateway is defined as the IP name server. The gateway's IP address is 192.168.1.1.

Defining an IPSec Transform Set

To define an IPSec transform set on the gateway, perform the following tasks, as described in Table 3-6:


Table 3-6: Defining an IPSec Transform Set
Command Purpose

hq-sanjose(config)# crypto ipsec transform-set vpn-transform esp-des ah-md5-hmac

To define a combination of security associations to occur during IPSec negotiations, enter the crypto ipsec transform-set global configuration command. This command invokes the crypto transform (cfg-crypto-trans) configuration mode.

In this example, the transform set named vpn-transform is defined with two security algorithm keywords: esp-des and ah-md5-hmac.

Note There are complex rules defining which entries you can use for the transform arguments. These rules are explained in the command description for the crypto ipsec transform-set command. You can also use the crypto ipsec transform-set global configuration command to view the available transform arguments.

hq-sanjose(cfg-crypto-trans)# mode tunnel

To specify IPSec encapsulation between the gateway and the VPN Client, enter the mode crypto transform configuration command. The mode command is only applicable to traffic whose source and destination addresses are the IPSec peer addresses; it is ignored for all other traffic. (All other traffic is in tunnel mode only.)

In this example, the tunnel mode is configured for vpn-transform for an IPSec encrypted tunnel.

hq-sanjose(cfg-crypto-trans)# exit

To exit crypto transform (cfg-crypto-trans) configuration mode, enter the exit crypto transform configuration command.

Defining a Dynamic Crypto Map

To define a dynamic crypto map, perform the following tasks, as described in Table 3-7:


Table 3-7: Defining a Dynamic Crypto Map
Command Purpose
hq_sanjose(config)# crypto dynamic-map vpn-dynamic 1

To define a dynamic crypto map entry, enter the crypto dynamic-map command. This command invokes the crypto map (config-crypto-map) configuration mode.

In this example, the dynamic map name is vpn-dynamic, and the sequence number (or priority) is 1.

hq_sanjose(config-crypto-map)# set transform-set vpn-transform

To specify which transform sets are allowed for the crypto map entry, enter the set transform-set crypto map configuration command.

In this example, the transform set previously defined in "Defining an IPSec Transform Set," vpn-transform is applied to the vpn-dynamic dynamic crypto map.

Note You can list multiple transform sets in order of priority (highest priority first).
hq_sanjose(config-crypto-map)# match address 101

To specify an extended access list for a crypto map entry, enter the match address crypto map configuration command. This access list determines which traffic should or should not be protected by IPSec. If this is configured, the data flow identity proposed by the IPSec peer must fall within a permit statement for this crypto access list. If this is not configured, the router will accept any data flow identity proposed by the IPSec peer. However, if this is configured but the specified access list does not exist or is empty, the router will drop all packets.

hq_sanjose(config-crypto-map)# exit

To exit crypto map (config-crypto-map) configuration mode, enter the exit crypto map configuration command.

Defining a Static Crypto Map

To define a static crypto map, perform the following tasks, as described in Table 3-8:


Table 3-8: Defining a Static Crypto Map
Command Purpose
hq_sanjose(config)# crypto map vpnclient 1 ipsec-isakmp vpn-dynamic

To define a static crypto map and add a dynamic crypto map set to a static crypto map set, enter the crypto map global configuration command.

In this example, the vpn-dynamic dynamic map (child) is applied to the vpnclient static crypto (parent) map.

hq_sanjose(config)# access-list 101 permit ip 192.168.1.1 255.255.255.0 host 10.1.2.1

To permit all IP traffic between the host and the gateway, use the extended version of the access-list global configuration command.

Note An access-list must be configured for each VPN Client configured with static IP addresses on a corporate subnet.

All IP traffic is permitted between the two IPSec peers.

hq_sanjose(config)# crypto map vpn-dynamic local-address loopback0

To specify and name an identifying interface to be used by the dynamic crypto map for IPSec traffic, use the crypto map local-address global configuration command.

In this example, the address that the IPSec will use on the gateway interfaces is loopback0.

The loopback0 interface is specified as the local IP address for encryption on the gateway.

Related Documentation

For more information on manual configuration, refer to the "Manual Configuration (Static IP Addressing)" section in "Case Study for Layer 3 Authentication and Encryption."

For more information on configuring Cisco IOS software commands, refer to the "Cisco IOS Software Documentation Set" section in the "Preface."


hometocprevnextglossaryfeedbacksearchhelp
Posted: Thu Jul 27 18:11:53 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.