1. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod9_L8 1 Network Security 2 Module 6 – Configure Remote Access VPN

2. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod9_L8 2 Lesson 6.3 Implementing the Cisco VPN Client Module 6 – Configure Remote Access VPN

3. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 3 Cisco VPN Client  The Cisco VPN Client is simple to deploy and operate  It allows organizations to establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers

4. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 4 Cisco VPN Client Configuration Tasks 1.Install Cisco VPN Client 2.Create a new client connection entry 3.Configure the client authentication properties 4.Configure transparent tunneling 5.Enable and add backup servers 6.Configure a connection to the Internet through dialup networking

5. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 5 Install Cisco VPN Client (Task 1)

6. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 6 Create a New Client Connection Entry—Main Window (Task 2) 2.2. 1.1. VPN Client Main Window

7. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 7 Creating a New Connection Entry (Task 2) 4.4. 6.6. 3.3. 5.5.

8. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 8 Group Authentication  The network administrator usually configures group authentication. However, if group authentication has not been configured complete this procedure shown : 1.Select the Group Authentication radio button 2.In the Name field, enter the name of the IPsec group belonged to. This entry is case sensitive. 3.In the Password field, enter the password (which is also case sensitive) for the IPsec group. The field displays only asterisks 4.Verify the password in the Confirm Password field

9. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 9 Configuring Client Authentication Properties (Task 3)  Authentication options: Group preshared secrets (group name and group secret) Mutual authentication (import CA certificate first; group name and secret) Digital certificates (enroll with the CA first; select the certificate) 1. 2. 3. 4.4.

10. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 10 Mutual Group Authentication (Task 3) 1. 2. Mutual authentication should be used instead of group preshared secrets. Group preshared secrets are vulnerable to man-in-the-middle attacks if the attacker knows the group preshared secret.

11. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 11 Configuring Transparent Tunneling (Task 4) 1. 2. Transparent tunneling is on by default. NAT-T enables IPsec and IKE over a standard UDP port 4500, allowing the VPN Client to be behind a NAT or PAT device.

12. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 12 Status > Statistics > Route Details The Statistics window provides information about tunnel details, the routing table, and personal firewall. 1. 2.

13. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 13 Enable Backup Servers  To enable backup servers from the VPN Client, click the Backup Servers tab in the VPN Client Properties form:  Check the Enable Backup Servers check box. This box is unchecked by default.  Click Add to enter the backup server address. A new window appears  Enter the host name or IP address of the backup server, using a maximum of 255 characters. Click OK when done

14. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 14 Enable and Add Backup Servers (Task 5) List backup VPN servers that are to be used in case the primary VPN server is not reachable. 1. 2. 3.

15. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 15 Configuring the Dialup Connection  The final task is configuring the dialup connection to the Internet.  To connect to a private network using a dialup connection, perform the following: 1.Use a dialup connection to your Internet service provider (ISP) to connect to the Internet. 2.Use the VPN Client to connect to the private network through the Internet.  To enable and configure this feature, check the Connect to Internet via dial-up check box in the Dial- Up tab of the VPN Client Properties form. This box is unchecked by default.

16. © 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L9 16