891F VPN for remote employees

[Vifilio]

We recently purchased a 891F router for our new fiber connection. This was a recommendation from our fiber provider. Never having dealt with Cisco IOS before, we eventually were able to mange the setup via CLI and are very happy about the performance. Now we would like to leverage its VPN capabilities but ran into several issues. 

It's unclear whether we

1. ... need any license for providing access to remote employees working on Mac and Windows desktops?

2. ... which client to use, AnyConnect or native OS? SSL or IPSEC?

3. ... do we need to activate any license on 891F server? (Our version is 15.3)

4. ... how many remote users are supported? There appears to be different info on the web ranging from 10, to 50 all up to 100.

5. ... what is the right configuration? I read easyvpn for site-to-site but then some folks appear to use this with EOL EasyVPN client for remote access.

It would be great if someone could help me understand what is needed and where to obtain any potential licenses needed.

Thanks in advance,

Vifilio

[Rob Ingram · Accepted solution]

Hi,

FlexVPN is probably the best solution that meets your needs, this can be used for both Site-to-Site and Remote Access VPN. The Remote Access VPN is an IPSec based VPN not a SSL-VPN. This link has examples for various different FlexVPN configurations.

In regard to licensing, if you are using AnyConnect you would need AnyConnect licenses, contact your reseller for more information.

The 800 series datasheet recommended upto 50 users, but I guess it depends what features you are running in addition to VPNs, this may impact performance.

HTH

[Vifilio]

Thanks a bunch for the pointer to FlexVPN and IPSEC IKEv2 option. From everything I have read now it appears the only way to connect properly from Mac is to use AnyConnect client. I also came across the following helpful presentation that seems to confirm

https://technodocbox.com/Internet_Technology/70236896-Vpn-remote-access-with-ios-introduction-to-flexvpn.html

In addition, I just obtained a demo license for our router and will go ahead trying to setup a remote VPN. I will come back to this thread in case I succeed or have more questions. In the meantime, any help in router configuration is much appreciated.