Clark,
I have to create username and password on the HQ router for authenticating all the branch routers????
Yes - if you want to keep your requirement stated in an earlier post that the EzVPN shall also authenticate by username/password (the Xauth) and not just by the group name and shared password.
on HQ this username and password should be created in global mode???
Yes - you will use the username user_name privilege 0 secret user_password global level configuration command to create these accounts.
in Branch routers where i have to apply the username and password
If you want these Branch routers to authenticate automatically then this password should be stored in the crypto ipsec client ezvpn configuration section using the username user_name password user_password command. However, the HQ in this case must be configured with the save-password command in its corresponding crypto isakmp client configuration group section. Otherwise, the username and password will need to be input in the Branch router's CLI again and again after restart or connectivity loss using the crypto ipsec client ezvpn xauth privileged EXEC command.
Please note - the primary purpose of the Xauth authentication is to authenticate users, not routers. That is the reason that the username/password needs to be input repeatedly, as it is expected the user comes and goes. Routers are authenticated sufficiently using the EzVPN group shared key, or - if higher security is needed - using X.509 certificates.
Best regards,
Peter
