VPN Client and AAA services on a Cisco ISR Router

Hi, my name is Jim, and I was just promoted as a trainer for the company I work for.  Part of my new challenge is understanding how the configuration files in both my Terminal Services/VPN Router and Core Router work, so for many of you, these questions are going to seem very fundamental, but please help, I am an instructor in training.  I hold a CCNA, CCNA-Wireless, and a CCSI cert, but I have little working experience in building and maintaining a lab....hence the need for this inquiry.
So to my questions. In our lab environment, we have a router that acts as our terminal services router and VPN router.  Each laptop that connects to the lab has the Cisco VPN client loaded onto it, as well as my laptop that I teach from.  My questions are these:
1.  What parts of the AAA output of the running configuration tell me how to configure the VPN clients on my laptops?
2.  I am using crypto key generate RSA at 1024 bits on the VPN/TS router, so does that tell me how to configure some part of the client?
3.  In our lab, we are going to use a direct connection to an AP to get connected to the network, and how will the absence of an Internet connection affect the settings on the VPN client, or will they?
4.  Are there helpful articles I can read that will answer some or all of these questions? 
Thanks in advance,
Jim

Hi Jim,
congratulations
Assuming a basic setup, your router will have something like this:
crypto isakmp client configuration group MyGroup
  key cisco123
So on the client, you configure it to use MyGroup as the group name, and cisco123 as the (group) password.
I'm not sure I understand your question #3 and what you mean by "AP" (Access Point? So WiFi?). In any case you don't need Internet access per se, as long as you have network (IP) connectivity between the host running the vpnclient and the VPN router.
Does this help?
Herbert

Similar Messages

  • Cisco ASA 5505, Cisco VPN Client and Novell Netware

    Hi,
    Our ISP have installed Cisco ASA 5505 firewall. We are trying to connect to our Novell 5.1 server using VPN client.
    I installed VPN client on a laptop that is using wireless connection. I connect using wireless signal from near by hotel and I am able to connect to my firewall usinging vpn client and also able to login in using Novell client for XP.
    When I use same vpn client and Novell client at home that is not using wireless connection, but DSL connection amd not able to login or find the tree.
    The only difference in two machine is laptop using wireless connection and my home machine is using wired connection using DSL.

    If your remote end of the services in question support IPsec IKEv1 as the VPN type then, yes - the 5505 can be a client for that service. At that point it looks like a regular LAN-LAN VPN which is documented in many Cisco and 3rd party how-to documents.

  • Mavericks VPN dropouts with native VPN client and Cisco IPSec

    Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
    I am connecting via a WIFI router to a remote VPN server
    The conenction is good for a while but eventually it drops out.
    I had Zero issues in mountain lion and only have issues since the update to 10.9
    I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
    My thoughts are:
    1 -issue with mavericks  ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
    2- Issue with  cisco router compaitibility or timing with Cisco IPSEC
    3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
    Any thousuggestions?

    Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
    I am connecting via a WIFI router to a remote VPN server
    The conenction is good for a while but eventually it drops out.
    I had Zero issues in mountain lion and only have issues since the update to 10.9
    I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
    My thoughts are:
    1 -issue with mavericks  ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
    2- Issue with  cisco router compaitibility or timing with Cisco IPSEC
    3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
    Any thousuggestions?

  • Boot camp with Cisco VPN client and smart card

    Looking at a Macbook or Macbook Air and the only reason I need to run windows is to be able to access my work network through the Cisco VPN client and my Smartcard then use remote desktop. From my understanding if I run Bootcamp it should work am I correct? Im going to an Apple store tomorrow hopefully they can help too.
    Thanks

    mrbacklash wrote:
    Ok with that being said will the MBA 11.6 1.4ghz have the guts to make it run mostly internet based programs over the VPN connection?
    I think if you are running apps over the Internet the bottleneck will be the Internet and your VPN bandwidth. Your computer can certainly execute faster than Internet communications.
    Besides, Internet or remote applications run on the remote server. All your local computer does is local processing of the data if necessary.
    Message was edited by: BobTheFisherman

  • Problem with Cisco VPN client and HP elitebook 2530p windows 7 64-bit

    Hi there
    I have a HP Elitebook 2530p which i upgraded to windows 7 64-bit. I installed the Cisco VPN client application (ver. 5.0.07.0290 and also 64-bit) and the HP connection manager to connect to the internet through a modem Qualcomm gobi 1000 (that is inside the laptop). When I connect to the VPN, it connects (I write the username and password) but there is no traffic inside de virtual adapter for my servers. When I connect to the internet through wire or wireless internet, I connect de VPN client and there is no problem to establish communication to my servers.
    I tried everything, also change the driver and an earlier version of the HP connection manager application. I also talked to HP and they told me that there was a report with this kind of problem and it was delivered to Cisco. I don’t know where is the problem.
    Could anyone help me?
    Thanks to all.

    You can try to update Deterministic Network Enhancer to the below listed release which supports
    WWAN Drivers.
    http://www.citrix.com/lang/English/lp/lp_1680845.asp.
    DNE now supports WWAN devices in Win7.  Before downloading the latest version of DNEUpdate from the links below,  be sure you have the latest
    drivers for your network adapters by downloading them from the vendors’ websites.
    For 64-bit: ftp://files.citrix.com/dneupdate64.msi
    Hope that helps.

  • How to configure full tunnel with VPN client and router?

    I know the concept of split tunnel....Is it possibe to configure vpn client and router full tunnel or instead of router ASA? I know filter options in concentrators is teher options in ISR routers or ASA?

    I think it is possible. Following links may help you
    http://www.cisco.com/en/US/products/hw/routers/ps274/products_configuration_example09186a0080819289.shtml

  • RV220W, VPN client, and Full Tunnel vs Split Tunnel capabilities

    For an RV220W, which VPN client mode (of the three possibilities) supports which Tunnel mode? 
    This is mostly a question, and partly "in use" observations.
    Background: I have been able to get all three different VPN clients to work with an RV220W, but only one of the three works in "Full Tunnel"  mode (SSL VPN). And since I know one of the three -- the Cisco QuickVPN client -- will never with in that mode, do we know if an RV220W will with an IPSec client in Full Tunnel Mode? 
    If anyone answers yes, the next question will be vpn client and how did you configure it, client and RV220W, to make full tunnel work.
    Summary of VPN modes I've gotten to work with an RV220W:
    Client
    Split Tunnel Works?
    Full Tunnel Works?
    OS?
    Notes
    SSL VPN
    Yes
    Yes
    Win7/64
    IE10 or IE11
    QuickVPN
    Yes
    No
    Win7/64
    IPSec VPN
    Yes
    No
    Win7/64
    Shrew Soft VPN Client

    I have to mark this as not a correct answer.
    Reason: 0.0.0.0 will not go into either of the fields listed above, message is "Invalid IP address Please enter a value between 1 - 223 at xxx.0.0.0.".
    To Michal Bruncko who posted this:
    1.) 0.0.0.0 will not work in my router nor in the RV220W online emulator here, (general emulator page here), am I missing something obvious?
    2.) Have you used these actual settings on your router, or did you answer in a theoretical, "this should work" way?

  • DT require Oracle9i client and Oracle Services for MTS software

    "Distributed Transactions require Oracle9i client and Oracle Services for Microsoft Transaction Server software."
    I get the error above when attempt to run a COM+ transaction accessing Oracle9i. I'd been checked the installation of Oracle9i and Oracle Services in the client computer and it is ok.
    I am using Windows Server 2003 and the database server is on another Windows Server 2003. The database is Oracle9i Enterprise Edition.
    At Stanford's web site (http://www.stanford.edu/dept/itss/docs/oracle/9i/win.920/a95496/ch1.htm#1079911) I found Oracle's documentation that explains this, but it didn't worked for me.
    Oracle Services is installed in both machines.
    The Oracle MTS Recovery Service is running.
    The COM+ component is registered.
    When I use the same component with SQL Server 2005 beta 2 it works fine. What else do I need to do?
    Thanks in advance.
    Caio Pereira

    Hi.
    I have the same problem, one which works and another which don't (almost though).
    I got most of it to work by taking the mtsservices registry entry from the server that works and put it on to the other after i have made the service in Oracle management console for mts.
    Now i can search, delete, change but not make a new entry into the database.
    And thats where i'm stuck now.
    Hope it helps a bit..
    Michael
    Greenland

  • Inbuilt cisco IPSEC vpn client and KeyLife Timeout setting...

    Hi Guys
    I am having issues with the in built cisco vpn client on the mac, I am currrently using Mac OSx 10.7.4
    I have a Fortigate 200B device and have setup the IPSec VPN settings to have a keylife of 86400 seconds.
    However the expereince I am having with the mac clients is that after about 50 minutes the users are being asked to re-authencate to the VPN...
    When checkin the debug logs I can see that the peer (mac client) is setting the phase 2 tunnel key lifetime to 3600 seconds which is 1 Hour...
    Usually in IPSec a re-negeotiation process takes place about 10 minutes or so before the key expires..
    My question is where are the VPN settings kept in the Mac... I know it uses Racoon for the IPSec exchange of key and so I would like to tweak the VPN profiles so that the mac sets the lifetime of the key to 86400 instead of 3600 by default...
    Also want to be able to set logging to debug mode for the Racoon application on mac clients.
    Your help is much appreciated
    Kind Regards
    Mohamed

    Hi Tony,
    to the best of my knowledge this is currently not possible, but will be once this enhancement is implemented:
    CSCsw31922    Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions
    You may want to try and ask in the AAA forum if there is anything you can do on ACS...
    hth
    Herbert

  • Cisco IPSec VPN Client and sending a specific Radius A-V value to ACS 5.2

    This setup is to try routing Cisco VPN to either RSA or Entrust from Cisco ACS 5.2, depending on some parameter in incoming AUTH request from Cisco IPSec VPN Client 5.x. Tried playing with pcf files and user names/identity stores, none seems working

    Hi Tony,
    to the best of my knowledge this is currently not possible, but will be once this enhancement is implemented:
    CSCsw31922    Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions
    You may want to try and ask in the AAA forum if there is anything you can do on ACS...
    hth
    Herbert

  • I cannot route to remote subnets from cisco vpn client and pptp client

    Hi guys,
    I've a big problem, I configured a 877 cisco router as a cisco vpn server (the customer use it to connect to his network from pc) and a pptp vpn server (he use it to connet to the network from a smartphone).
    In this router I created 2 vlan, one for wired network (192.168.10.0/24) and the second one (10.0.0.0/24) for wireless clients and I use fastethernet 3 port to connect these to the router.
    this is the issue, when the customer try to connect to a wireless network from both of vpn clients he cannot do this, but if he try to connect to a wired network client all working fine.
    following the addresses taken from the router.
    - encrypted vpn client -
    ip address. 192.168.10.20
    netmask 255.255.255.0
    Default Gateway. none (blank)
    - pptp vpn client -
    ip address. 192.168.10.21
    netmask. 255.255.255.255
    Default Gateway. 192.168.10.21
    Is possible that I cannot reach the remote subnet because the clients doesn't receive a gateway (in the first case) or receive the wrong subnet/gateway (in the second one)..?
    There is anyone can help me..?
    Thank you very much.
    Many Kisses and Kindly Regards..
    Ilaria

    The default gateway on your PC is not the problem, it will always show as the same IP address (this is no different when you dial up to an ISP, your DG will again be set to your negotiated IP address).
    The issue will be routing within the campus network and more importantly on the PIX itself. The campus network needs a route to the VPN pool of addresses that eventually points back to the PIX.
    The issue here is that the PIX will have a default gateway pointing back out towards your laptop. When you establish a VPN and try and go to an Internet address, the PIX is going to route this packet according to its routing table and send it back out the interface it came in on. The PIX won't do this, and the packet will be dropped. Unless you can set the PIX's routing table to forward Internet packets to the campus network, there's no way around this. Of course if you do that then you'll break connectivity thru the PIX for all the internal users.
    The only way to do this is to configure split tunnelling on the PIX, so that packets destined for the Internet are sent directly from your laptop in the clear just like normal, and any packet destined for the campus network is encrypted and sent over the tunnel.
    Here's the format of the command:
    http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/tz.htm#1048524

  • Cisco ASA 8.3(1) with VPN Client and IP Communicator - one way communication

    Hi Community.
    I have a strange problem with my setup and I'm pretty sure it's either some type of routing (or NAT) or just a missing rule allowing the traffic. But I'm now at a point where I'd like to request your help.
    I have some remote access users who have the Cisco IP Communicator (CIPC) installed on their notebooks. So:
    VPN user with CIPC <> ASA Firewall <> Voice Router <> CCM <> IP Phone
    The VPN works fine for any other traffic. Also the basic connection for the IP Communicator works fine. It get's connected to the CallManager, is shown as registered and you even can call an internal phone and also external phones. BUT: while you can hear the called party (so the internal phone) it doesn't work for the other way. There is no sound coming from the remote/caller.
    I already figured out that it's also not possible to ping from the VPN phone to the internal IP Phone subnet. While the VPN user can ping any other device in the internal network, he can't do it to the Cisco IP Phones. But if the VPN phone calls a none-internal phone (mobiles...) - it works!
    My thought is that the call can't be build up correctly between the VPN phone and the internal phone.
    I found similiar situations with google but they are all for the other way around: call to internal works, but not to VPN.
    What do you think?

    Hi,
    Typically ASA lists specific networks to the VPN Client when Split Tunnel is used.
    This would mean that there is a Split Tunnel ACL used in the ASA configurations for this VPN connection which needs to have the missing network added for the traffic to be tunneled to the VPN connection.
    - Jouni

  • Cisco VPN client and mac mail

    Hi all,
    I wonder if someone can be more helpful than my uni IT department who take a minimum of a week to get you an IP address...
    My new uni uses Cisco VPN client for connection to the Wi-Fi network. It all works great apart from one (very annoying problem):-my e-mail accounts in mac mail don't seem to be able to connect via the VPN. I have had both an IMAP and a POP server e-mail account work automatically wherever I connect in the world for over a year now-so its not the way I've set up the accounts.
    Is there any way to get mac mail to "see" the VPN connection. If I have to physically plug-in my mac this seems a tad ridiculous when it works in every coffee shop with free wi-fi.
    My uni are not helpful as they want people to use either outlook or better still log-on to their e-mail using the web. I don't even want to use their e-mail-what is the point when I move jobs again in a year. What I do currently is use an IMAP account from my last job which I've set to forward to my "e-mail for life" from my undergrad uni. I basically only give out my life e-mail address and this also goes on all my papers.
    If I can't access this easily and sort all my mail in all the folders I've created to filter out things like facebook etc. I'm wondering what the point of mac mail is.

    Yeah, that stuff normally works for me. Unfortunately this is a situation where you have to use an external Cisco VPN client software, whether you like it or not. Its this horrible clunky thing (which at least half works I guess). So its only like normal wi-fi in terms of selecting the network, then you have to open up this application and put in your log-in etc. Most of the settings on this client seem locked, so there isn't much I can do to configure it.
    I've just got to my (temporary) accommodation which doesn't have wi-fi or VPN (just ethernet) and my mail is working again-so it must be the VPN. Goodness knows how it works with an iPod touch (interested in getting one but kind of pointless if I spend most of my time at work and it doesn't work...)
    Thanks for your suggestions though!

  • Cisco VPN client and Novell and Panda AV

    I have found an issue with one of my clients PC's that prevents him from using network resources over the VPN tunnel.
    PC
    Win XP SP2
    VPN client - 5.0 (Newest download)
    Novell - Client 4.91 SP4 for win 4.91.4
    Panda AC 4.02.40
    Ok here's what happens
    I made a PCF file for a handful of users to connect in and be able to access 2 servers.
    On the machine with the above information installed. It will connect to the VPN. Everything seems fine but if I RDP or ping access to the server it will not go. I then installed it on my machine and it works.
    So I fully investigated the one PC that doesn't work. I noticed in the TCPIP stack of both the Ethernet card and the Cisco adaptor. There is a Novell client and a panda client.
    Now if I uncheck one or the other it works. (I know there's posts about panda not working and the posts are 2 years old) It will work with just panda or Novell. When I check both it fails.
    Now has anyone seen this issue with these two products installed on a machine with Cisco VPN.
    Also, who should this go to, Novell, Panda or both?

    I stated i did that and it works. Each one works when its the only thing checked.
    Thanks
    Though

  • Cisco VPN Client and Mac OS 10.5.1 update

    After upgrading to Leopard (10.5) my Cisco VNP client stopped working. I was able to fix that by downloading the newer VPN Client 4.9.01 (0080) from the Macupdate.com website. Now that I've updated to Mac OS 10.5.1, the VPN Client won't work again!! I went back to the Macupdate website and downloaded what looks like an even newer version - 4.9.01 (0090) - but this is labeled as a BETA and it doesn't work either. Anyone out there seen a newer version, or something that works with 10.5.1?

    b166er wrote:
    Aside from the fact that it's marked beta, I'm wary about the source of MacUpdate's download. They link to http://www.arrange.co.at/download/vpnclient-darwin-4.9.01.0090-universal-k9-BETA .dmg
    Cisco don't ever make the client freely available. The official download is via form on the Cisco web site and you need appropriate credentials. I wouldn't risk installing from any other source.
    The home page at http://www.arrange.co.at/ doesn't exactly inspire confidence.
    Dude has a point... it's risky to mess with something like this from an untrusted source IMHO. Cisco is picky about who they give it out to. I have to get mine through my host provider since they are the ones that are authorized.
    For what it's worth, I'm using 4.9.01 with 10.5.1 and it works well.

Maybe you are looking for