Cisco CVPN3002-K9 - Fast Ethernet VPN Gateway Bedienungsanleitung

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

VPN 3002 Hardware Client

Getting Started

Release 3.6

August 2002

Text Part Number: OL-2854-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

VPN 3002 Hardware Client Getting Started

CCIP, the Cisco Powered Network mark, the Cisco Systems Verified logo, Cisco Unity, Follow Me Browsing, FormShare, Internet Quotient, iQ Breakthrough, iQ Expertise, iQ

FastTrack, the iQ Logo, iQ Net Readiness Scorecard, NetworkingAcademy, ScriptShare, SMARTnet, TransPath, and Voice LAN are trademarks of Cisco Systems, Inc.; Changing

the Way We Work, Live, Play, and Learn, Discover All That’s Possible, The Fastest Way to IncreaseYour Internet Quotient, and iQuick Study are service marks of Cisco Systems,

Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press,

Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, IOS,

IP/TV, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, StrataView Plus, Stratm,

SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship

between Cisco and any other company. (0203R)

iii

VPN 3002 Hardware Client Getting Started

OL-2854-01

CONTENTS

Preface ix

Audience ix

Organization ix

Related Documentation x

VPN 3002 Hardware Client Documentation x

VPN 3000 Series Concentrator Documentation x

VPN Client Documentation xi

Documentation on VPN Software Distribution CDs xi

Other References xi

Conventions xii

Data Formats xiii

Obtaining Documentation xiv

World Wide Web xiv

Documentation CD-ROM xiv

Ordering Documentation xiv

Documentation Feedback xiv

Obtaining Technical Assistance xv

Cisco.com xv

Technical Assistance Center xv

Cisco TAC Web Site xvi

Cisco TAC Escalation Center xvi

CHAPTER

1Understanding the VPN 3002 Hardware Client 1-1

VPN 3002 Hardware Client or VPN Client Software? 1-1

Hardware Features 1-1

ClientMode and Network Extension Mode 1-2

Online Technical Snapshot Explains PAT and Network Extension Modes 1-2

ClientMode (PAT) 1-2

ClientMode with Split Tunneling 1-3

Network Extension Mode 1-3

Network Extension Mode per Group 1-3

Network Extension Mode with Split Tunneling 1-3

IPSec 1-4

IPSec over TCP 1-4

Contents

VPN 3002 Hardware Client Getting Started OL-2854-01

IPSec over NAT-T 1-4

IPSec over UDP 1-5

Additional Software Features 1-5

Interactive Hardware Client Authentication 1-5

Individual User Authentication 1-6

IPSec Backup Servers 1-7

H.323 in PAT Mode 1-9

Notes on H.323 GateKeepers 1-11

RADIUS with Password Expiry 1-11

Load Balancing 1-12

Simple Certificate Enrollment Protocol (SCEP) 1-12

Reset/Restore Monitoring Statistics 1-12

XML Management 1-12

Reverse Route Injection (RRI) 1-12

AES with Diffie-Hellman Group 5 1-13

ManagementInterfaces 1-13

VPN Software Features Summary 1-14

Physical Specifications 1-15

CHAPTER

2Installing and Powering Up the VPN 3002 2-1

Preparing to Install 2-1

Configuring and Managing the VPN 3002 2-1

Browser Requirements 2-1

JavaScript and Cookies 2-2

Navigation Toolbar 2-2

Recommended PC Monitor / Display Settings 2-2

Unpacking 2-2

Installing the VPN 3002 2-3

Connecting the PC/Console 2-3

Connecting Network Cables 2-3

Powering Up 2-3

Beginning Quick Configuration 2-4

Quick Configuration Using Default Values 2-5

PAT Mode 2-5

Network Extension Mode 2-5

Quick Configuration Using Nondefault Values 2-6

Contents

VPN 3002 Hardware Client Getting Started

OL-2854-01

CHAPTER

3Using the VPN 3002 Hardware Client Manager for Quick Configuration 3-1

Logging into the VPN 3002 Hardware Client Manager 3-1

Starting Quick Configuration 3-3

About Quick Configuration 3-3

Setting the Time and Date 3-4

Uploading an Existing Configuration File 3-5

Configuring the Private Interface 3-6

Configuration | Quick |Private Interface |Address 3-7

Configuration | Quick |Private Interface | DHCP Server 3-7

Configuring the Public Interface 3-9

DHCP 3-10

PPPoE 3-10

Specify an IP address 3-10

Configuring IPSec 3-11

Configuring PAT or NetworkExtension Mode 3-13

Online Technical Snapshot Explains PAT and Network Extension Modes 3-13

ClientMode (PAT) 3-13

ClientMode with Split Tunneling 3-14

VPN Concentrator Settings Required for PAT 3-14

Network Extension Mode 3-14

Network Extension Mode per Group 3-15

Network Extension Mode with Split Tunneling 3-15

VPN Concentrator Settings Required for Network Extension Mode 3-15

Tunnel Initiation 3-16

Tunnel Initiation with Interactive Unit Authentication 3-16

Data Initiation 3-16

Configuring DNS 3-17

Configuring Static Routes 3-18

Adding a Static Route 3-19

Changing admin Password 3-20

Finishing Quick Configuration 3-21

What Next? 3-21

Using Other VPN 3002 Hardware Client Manager Functions 3-22

Understanding the VPN 3002 Hardware Client ManagerWindow 3-23

CHAPTER

4Using the Command-Line Interface for Quick Configuration 4-1

About Quick Configuration 4-1

Starting Quick Configuration 4-2

Contents

VPN 3002 Hardware Client Getting Started OL-2854-01

Setting the Time and Date 4-3

Uploading Configuration 4-4

Configuring the Private Interface 4-4

Configuring the Public Interface 4-7

Configuring a System Name 4-8

Configuring DHCP 4-8

Configuring PPPoE 4-9

Configuring a Static IP Address 4-10

Configuring IPSec 4-12

Configuring PAT or NetworkExtension mode 4-13

Client Mode (PAT) 4-13

VPN 3000 Concentrator Settings Required for PAT 4-13

Network Extension Mode 4-14

VPN 3000 Concentrator Settings Required for Network Extension Mode 4-14

Enabling or Disabling PAT 4-14

Configuring DNS 4-15

Configuring Static Routes 4-15

Adding a Static Route 4-15

Deleting a Static Route 4-17

Changing admin Password 4-17

Completing Quick Configuration 4-18

What Next? 4-18

APPENDIX

ATroubleshooting and System Errors A-1

Files for Troubleshooting A-1

Event Logs A-1

Crash Dump File A-2

Configuration Files A-2

LED Indicators A-2

VPN 3002 Front LEDs A-2

VPN 3002 Rear LEDs A-3

System Errors A-3

Settings on the VPN Concentrator A-4

VPN 3002 Hardware Client Manager Errors A-5

Invalid Login orSession Timeout A-5

Manager Logs Out A-6

Incorrect Display A-7

Error Message A-7

Contents

vii

VPN 3002 Hardware Client Getting Started

OL-2854-01

Not Allowed Message A-8

Not Found A-9

Microsoft Internet Explorer Script Error: No such interface supported A-10

Command-Line Interface Errors A-10

A-10

INDEX

Contents

viii

VPN 3002 Hardware Client Getting Started OL-2854-01

VPN 3002 Hardware Client Getting Started

OL-2854-01

Preface

VPN 3002 Hardware Client Getting Started provides information to take you from unpacking and

installing the VPN 3002, through configuring the minimal parameters to make it operational (called

Quick Configuration). You can do Quick Configuration from a console with the menu-based

Command-Line Interface, or you can use the HTML-based VPN 3002 Hardware Client Manager with a

browser. This manual describes both methods, and we recommend the latter for ease of use.

Audience

We assume you are an experienced system administrator or network administrator with appropriate

education and training, who knows how to install, configure, and manage internetworking systems.

However, virtual private networks and VPN devices might be new to you. You should be familiar with

Windows system configuration and management, and you should be familiar with Microsoft Internet

Explorer or Netscape Navigator or Communicator browsers.

Organization

This guide is organized as follows:

Chapter Title Description

Chapter 1 Understandingthe VPN 3002

Hardware Client Summarizes the hardware and software features

and operation.

Chapter 2 Installing and Powering Up

the VPN 3002 Explains how to prepare for, unpack, install, and

power up the VPN 3002 Hardware Client, and how

to begin quick configuration. Once you have

completed the steps in this chapter, you can use

either Chapter 3 or Chapter 4 to complete quick

configuration.

Chapter 3 Using the VPN 3002

Hardware Client Manager for

Quick Configuration

Explains how to complete quick configuration of

the system using the VPN 3002 Hardware Client

Manager with a browser. We recommend this

method.

VPN 3002 Hardware Client Getting Started OL-2854-01

Preface

Related Documentation

Refer to the following documents for further information about Cisco VPN 3000 Series applications and

products.

VPN 3002 Hardware Client Documentation

The VPN 3002 Hardware Client Reference provides details on all the functions available in the VPN

3002 Hardware Client Manager. This manual is online only.

The VPN 3002 Hardware Client Quick Start card summarizes the information for quick configuration.

This quick reference card is provided with the VPN 3002 and is also available online.

The VPN 3002 Hardware Client Basic Information sticky label summarizes information for quick

configuration. It is provided with the VPN 3002 and you can also print it from the online version; you

can affix the label to the VPN 3002.

The HTML interface, called the VPN 3002 Hardware Client Manager, includes online help that you can

access by clicking the Help icon on the toolbar in the Manager window.

VPN 3000 Series Concentrator Documentation

The VPN 3000 Series Concentrator Reference Volume I: Configuration explains how to start and use the

VPN Concentrator Manager. It details the Configuration screens and explains how to configure your

device beyond the minimal parameters you set during quick configuration.

The VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring provides

guidelines for administering and monitoring the VPN Concentrator. It defines and explains all functions

available in the Administration and Monitoring screens of the VPN Concentrator Manager. Appendixes

to this manual provide troubleshooting guidance and explain how to access and use the alternate

command-line interface.

The HTML interface, called the VPN Concentrator Manager, includes online help that you can access

by clicking the Help icon on the toolbar in the Manager window.

Chapter 4 Using the Command-Line

Interface for Quick

Configuration

Explains how to complete quick configuration of

the system using the command-line interface from

the console or a Telnet or SSH session.

Appendix A Troubleshooting and System

Errors Describes common errors that might occur while

configuring or using the system, and how to

correct them. It also describes all LED indicators

on the VPN 3002.

Chapter Title Description

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Cisco Netzwerk-Hardware Handbücher

Cisco

Cisco Secure Firewall Management Center 1700 Bedienungsanleitung

Cisco

Cisco ASR 5000 Bedienungsanleitung

Cisco

Cisco LightStream 1010 Bedienungsanleitung

Cisco

Cisco 15530-LCMB-0200 - ESCON Multiplexing Line Card... Handbuch

Cisco

Cisco Remote PHY Shelf 7200 Installationshandbuch

Cisco

Cisco WS-CE500 - Catalyst Express 500-24PC Bedienungsanleitung

Cisco

Cisco CiscoWorks Wireless LAN Solution Engine Bedienerhandbuch

Cisco

Cisco 3660 Series Bedienungsanleitung

Cisco

Cisco CGR 1000 Series Bedienungsanleitung

Cisco

Cisco PIX Series Handbuch

Cisco

Cisco SPA901-UK - Small Business Pro Bedienungsanleitung

Cisco

Cisco NM-1FE-TX - Interface Module Ethernet Bedienungsanleitung

Cisco

Cisco 5500 Series Bedienungsanleitung

Cisco

Cisco Rack-Mount and Cable Mgmt. 7505/7010 Bedienungsanleitung

Cisco

Cisco Gigabit Switch Router Cisco 12012 Bedienungsanleitung

Cisco

Cisco Aironet 1400 Series Bedienungsanleitung

Cisco

Cisco Aironet 340 Series Anleitung zur Verwendung

Cisco

Cisco Network Adapter VIP-FE-TX/4E Bedienerhandbuch

Cisco

Cisco 7606 Bedienungsanleitung

Cisco

Cisco VIP-4R/4T Bedienungs- und Wartungsanleitung

Cisco

Cisco EXPLORER 3100 Bedienungsanleitung

Cisco

Cisco UCS 6248 UP Bedienungsanleitung

Cisco

Cisco Catalyst 8300 Series Handbuch

Cisco

Cisco NM-1A-T3 - 1port Ds3 Atm Network Module Bedienungsanleitung

Beliebte Netzwerk-Hardware Handbücher anderer Marken

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Bedienungsanleitung

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Bedienungsanleitung

Yudor

Yudor YDS-16 Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-320L Bedienungsanleitung

Samsung

Samsung ES1642dc Gebrauchsanweisung

Honeywell Home

Honeywell Home LTEM-PV Montageanleitung

evertz

evertz 7700 Series Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-343 Bedienungsanleitung

Asante

Asante AsanteBridge 1012 Bedienungsanleitung

FireBrick

FireBrick FB2700 Bedienungsanleitung

Audiovox Electronics

Audiovox Electronics ARWH2T Bedienungsanleitung

ADC

ADC DSX-1 Handbuch

NetComm

NetComm NF2 Bedienungsanleitung

Alcatel-Lucent

Alcatel-Lucent 5620 Bedienungsanleitung

Dell EMC

Dell EMC XC6420 Series Bedienungsanleitung

Lanner

Lanner NCA-1020A Bedienungsanleitung

Allied Telesis

Allied Telesis AT-TN121-A Bedienungsanleitung

Arista

Arista CCA-ETM-Q12 Bedienungsanleitung