Suggested prerequisite reading:
»Cisco Forum FAQ »Site-to-Site IPSec VPN: Cisco to Cisco and Cisco to Non-Cisco
Sample Configuration of IPSec VPN Concentrator
When you plan to have a PIX or ASA firewall to act as both firewall and VPN concentrator, following is the sample configuration.
Assumptions:
* The 1st LAN subnet is 192.168.0.0/24 with 192.168.0.1 (the PIX inside interface) as the default gateway
* There is also 10.0.0.0/8 as 2nd LAN subnet, where from PIX or ASA firewall is reachable via 192.168.0.2
* There will be remote users VPN into the PIX using Cisco VPN Client software, creating ESP-based IPSec VPN tunnel
* No default gateway to access the LAN subnet will be received by VPN users once the IPSec VPN tunnel is established; which will set the VPN users' PC to proxy arp to reach the LAN subnet
1. Single VPN User Group without external AAA Server
* The remote users will VPN in using specific Group Authentication credential, which in this sample configuration is Admin as the Group Name and is ******** as the Group Password as indicated on the vpngroup Admin password ******** command
* The VPN users log in as Admin receive IP address within the admin range from 192.168.1.1 to 192.168.1.254.
* No external AAA (Authentication, Authorization, and Accounting) server as the TACACS+/RADIUS server
* Telnet attempt to the PIX/ASA itself is not authenticated
PIX Firewall configuration
2. Multiple VPN User Groups with external AAA Server
* The remote users will VPN in using specific Group Authentication credential, which in this sample configuration is either Admin or Sales
* The VPN users log in as Admin receive IP address within the admin range from 192.168.1.1 to 192.168.1.254. Similarly, the VPN users log in as Sales receive IP address within the sales range from 192.168.2.1 to 192.168.2.254.
* There is a TACACS+/RADIUS server at 192.168.0.204 to serve the AAA (Authentication, Authorization, and Accounting) functionality for all remote users
* The TACACS+ service is used to provide PIX/ASA configuration management access, such as telnet and ssh to the PIX/ASA itself
* The RADIUS service is used to provide production access (the LAN) to remote VPN users
* The aaa authentication match command will authenticate remote user login attempts according to the RADIUS credential that are being used to log in
* The aaa authorization match command will authorize remote user access to only specific subnets according to the authenticated RADIUS credential that are acknowledged
* The aaa accounting match command will record all activities done by all remote users according to their RADIUS credential
PIX Firewall configuration
Notes:
* Since the PIX or ASA firewall acts as both firewall and VPN concentrator, the isakmp nat-traversal is necessary to simultaneously serve VPN users accessing the LAN subnet and to keep LAN subnet machines able to access the Internet
* When the PIX or ASA firewall is dedicated to only serve as VPN Concentrator, then the isakmp nat-traversal, the global 1-nat 1 pair commands might not be necessary
* Remote users can opt to either enable transparent tunneling or not when using the Cisco VPN Client software. When transparent tunneling is enabled, the ESP protocol is encapsulated within UDP (UDP port 4500) by default, which then makes the VPN traffic able to pass through any NAT/PAT device in between. This encapsulation feature is useful when either there is any NAT/PAT device in between or ESP protocol is not permitted to pass through.
* As you may notice, the 2nd sample configuration is more secure and accountable since there is an AAA (TACACS+/RADIUS) server into play
* When your network currently does not have AAA server, you can setup one for free. Check out this FAQ for details.
»Cisco Forum FAQ »Are there Free authentication packages for TACACS or RADIUS to secure my router?
* If specific remote users must authenticate with specific AAA server, then you can simply modify the AAA command to do so. Following is illustration
Sample Configuration of PPTP Windows VPN Concentrator and Others
»Cisco Forum FAQ »Remote User VPN Connection To Office Network
 show feedback form
 close
by Covenant  edited by aryoba
last modified: 2008-06-26 09:50:52 |
