Cisco Easy VPN is a convenient method to allow remote users to connect to your network using IPsec VPN tunnels. The advantage of Easy VPN is that you don’t have to worry about all the IPSEC security details on the client side. Just configure the remote router, group name, username /password and you are ready to go. In this lesson I’ll show you how to configure Easy VPN on a Cisco IOS router and we’ll use the Cisco VPN client to setup the connection.
This is the topology that we’ll be using:
A single router configured for Easy VPN and a computer running Cisco’s VPN client software. Let’s start with the router configuration!
Router Configuration
First we need to enable AAA for authentication, authorization and accounting. We can use this for local authentication (usernames and passwords on the router) or use an external RADIUS server for this.
For simplicity, we’ll use local authentication.
VPN(config)#aaa authentication login default local
VPN(config)#aaa authentication login VPNUSER local
VPN(config)#aaa authorization exec default local
VPN(config)#aaa authorization network VPNGROUP local
The username will be “VPNUSER” and we will use a group called “VPNGROUP”. Let’s configure a password for this user:
VPN(config)#username VPNUSER password CISCO
Our next move is to configure the IKE policy. This is where you set parameters that are used at the IKE negotiation.
VPN(config)#crypto isakmp policy 1
VPN(config-isakmp)#authentication pre-share
VPN(config-isakmp)#encryption aes
VPN(config-isakmp)#group 2
We’ll use AES encryption and diffie hellman group 2. To keep it simple we’ll use a pre-shared key.
For the VPN group we’ll have to configure a number of items. First of all there’s a password but you can also specify some client specific parameters like a DNS server, WINS server, how many users are able to connect etc. Here’s how to do it:
VPN(config)#crypto isakmp client configuration group VPNGROUP
VPN(config-isakmp-group)#key 0 CISCO
VPN(config-isakmp-group)#dns 192.168.1.253
VPN(config-isakmp-group)#wins 192.168.1.253
VPN(config-isakmp-group)#pool VPNPOOL
VPN(config-isakmp-group)#max-users 10
VPN(config-isakmp-group)#netmask 255.255.255.0
VPN(config-isakmp-group)#domain NETWORKLESSONS.LOCAL
The VPN group will use “CISCO” as the password and IP address 192.168.1.253 for the DNS and WINS server. The pool name is called VPNPOOL and this is where we’ll specify the IP addresses for our VPN users:
VPN(config)#ip local pool VPNPOOL 192.168.2.100 192.168.2.200
I’m using subnet 192.168.2.100 for the VPN users. This is a different subnet as our LAN (192.168.1.0 /24).
The next step is to configure a transform-set. This is where we configure our phase 2 authentication and encryption settings:
VPN(config)#crypto ipsec transform-set TRANSFORMSET esp-aes esp-sha-hmac
The transform-set is called “TRANSFORMSET” and we will use AES encryption and SHA for data origin authentication and integrity protection. Now we’ll configure an ISAKMP profile for our VPN group:
VPN(config)#crypto isakmp profile ISAKMPPROFILE
VPN(conf-isa-prof)#match identity group VPNGROUP
VPN(conf-isa-prof)#client authentication list VPNUSER
VPN(conf-isa-prof)#isakmp authorization list VPNGROUP
VPN(conf-isa-prof)#client configuration address respond
VPN(conf-isa-prof)#virtual-template 1
And create a VPN profile that refers to the transform-set and ISAKMP profile that we just created:
VPN(config)#crypto ipsec profile VPNPROFILE
VPN(ipsec-profile)#set transform-set TRANSFORMSET
VPN(ipsec-profile)#set isakmp-profile ISAKMPPROFILE
Last but not least we’ll attach the configuration that we did to a virtual interface which receives the connections from the VPN clients. Instead of configuring an IP address on this interface we’ll tell it to use the IP address of the FastEthernet 0/1 (LAN) interface:
Hello Hany.
I have set up a site to site VPN using Easy VPN in a production environment.
Easy VPN for a site to site VPN is created using Cisco Configuration Professional GUI for Cisco routers. You connect to both the VPN server and the VPN client routers individually and enter commands using the wizards provided. You can find out more about creating a site to site VPN with Easy VPN on CCP here.
The configuration I implemented required a group of 7 PCs at a remote site to connect to internal network resources (finance server and internal email) at company hea
... Continue reading in our forumHi Laz,
Can you post the configuration as it shows up in the CLI of the central and remote sites?
Thanks
Hany
Hello Hany
Here’s an excerpt from the client side VPN router, that is, the ADSL router at the remote site. Of course it has been sanitised…
... Continue reading in our forumThanks Laz. very helpful
Hi,
thank for the lesson. please can you check why this image is not displaying in the article ?
https://networklessons.com/wp-content/uploads/2014/02/cisco-vpn-client-profile-properties.png
B.R