I use :
- Cisco 837 as Easy VPN Client devices on remote sites
- Cisco PIX 515E as Easy VPN Server on central site
- CiscoSecure ACS as TACACS+ Server on internal LAN of Central Site
The remotes sites connect to central site by ADSL with 3DES VPN Tunnels, pre-shared key. It is working OK right now.
How to add authentication so that :
- Cisco 837 Easy VPN Devices are authenticated before IPSEC tunnel is up (during negociation)?
and/or
- Users of remotes sites are authenticated individually, after the VPN tunnel is up before accessing to central sites resources (mainly telnet to a IBM AS400 server)
Please find below copy of the PIX Firewall and Cisco 837 IPSEC config.
Regards.
Fatou.
FIREWALL CONFIG
---------------
access-list 80 permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 80 permit ip 192.168.1.0 255.255.255.0 10.10.10.0 255.255.255.0
ip local pool vpn-client 192.168.1.200-192.168.1.240
nat (inside) 0 access-list 80
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ (inside) host 192.168.1.1 <**key**>
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
sysopt connection permit-ipsec
crypto ipsec transform-set strong-des esp-3des esp-sha-hmac
crypto dynamic-map MYMAP 4 set transform-set strong-des
crypto map agence-map 20 ipsec-isakmp dynamic MYMAP
crypto map agence-map interface outside
isakmp enable outside
isakmp key **pre-shared key** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp policy 8 authentication pre-share
isakmp policy 8 encryption 3des
isakmp policy 8 hash md5
isakmp policy 8 group 2
isakmp policy 8 lifetime 86400
vpngroup vpn-client address-pool vpn-client
vpngroup vpn-client dns-server ***********
vpngroup vpn-client default-domain *****
vpngroup vpn-client split-tunnel 80
vpngroup vpn-client idle-time 1800
vpngroup vpn-client password **pre-shared key**
CISCO 837 CONFIG
----------------
!
!
crypto ipsec client ezvpn hw-client
connect auto
group vpn-client key **pre-shared key**
mode client
peer <***** @ outside PIX ****>
!
!
!
!
!
!
interface Ethernet0
ip address 10.10.10.1 255.255.255.0
ip tcp adjust-mss 1452
crypto ipsec client ezvpn hw-client inside
hold-queue 100 out
!
interface ATM0
no ip address
atm vc-per-vp 64
no atm ilmi-keepalive
pvc 0/35
pppoe-client dial-pool-number 1
!
dsl operating-mode auto
dsl power-cutback 0
!
interface Dialer1
ip address negotiated
ip access-group 111 in
ip mtu 1492
ip inspect myfw out
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer remote-name redback
dialer-group 1
ppp authentication pap chap callin
ppp chap hostname ***************
ppp chap password 7 *************
ppp pap sent-username ********* password 7 **********
ppp ipcp dns request
ppp ipcp wins request
crypto ipsec client ezvpn hw-client
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
