This white paper provides detailed design and implementation information relating to the deployment of Converged VPN with the Cisco® Virtual Office.
Please refer to the Cisco Virtual Office overview (http://www.cisco.com/go/cvo) for more information about the solution, its architecture, and all of its components.
This document shows how to configure the Cisco Virtual Office VPN headend routers. Three types of VPN technologies are configured in the same headend to handle multiple methods of connecting to the corporate network: Dynamic Multipoint VPN (DMVPN) for teleworkers and small-office sites, Easy VPN for mobile VPN client users, and Secure Sockets Layer (SSL) VPN for SSL-based mobile users.
With the Cisco Converged VPN solution, you can consolidate all possible VPN deployment types in one headend design. This consolidation can lower your total cost of ownership (TCO) because it helps advance standardization of network infrastructure for achieving efficient networks.
The document provides three configuration samples for the most common VPN headend scenarios:
• Single hub: Cisco 3800 Integrated Services Routers or Cisco 7200 Series Routers
• High-concentration hub with integrated encryption plus a server farm: Cisco Catalyst® 6500 Series Switches with high-performance encryption cards plus a server farm consisting of Cisco 7200 Series Routers
• High-concentration hub with distributed encryption plus a server farm: Cisco Catalyst 6500 Series Switches plus a server farm consisting of Cisco 7200 Series Routers
Platforms and Images
Images based on Cisco IOS® Software Release 12.4(15)T are recommended for headend routers.
The VPN headend router can be one of the following:
• Cisco 3800 Integrated Services Router with a VPN encryption card (AIM-VPN/SSL-3)
• Cisco 7206VXR Router with a Cisco VPN Services Adapter (VSA) encryption card and Cisco 7200 Series NPE-G2 Network Processing Engine
• Cisco Catalyst 6500 with a server-load-balancing (SLB) design and a server farm consisting of Cisco 7206 Routers: The Cisco Catalyst 6500 uses the Cisco Catalyst 6500 Series Supervisor Engine 720 and the Cisco IP Security (IPsec) VPN Shared Port Adapter (SPA) (in the scenario with integrated encryption) and runs Cisco IOS Software Release 12.2(18)SXH2 or later
For SSL VPN full-tunnel mode, you need to install a client package on the hub. AnyConnect Version 2.2.0128 or later is recommended. Please refer to the SSL VPN guide available at http://www.cisco.com/go/cvo for more information about where to get the extra SSL files and how to install them.
Converged VPN Solution
This section shows how to deploy the three main VPN solutions in one hub.
Following is a summary of each of the technologies:
• Dynamic Multipoint VPN: DMVPN provides a full end-to-end VPN solution that allows for dynamic direct, secure connections between remote sites (that is, dynamic spoke-to-spoke tunnel) and full access to corporate services, including multicast forwarding support. For this technology, a Cisco IOS Software router is required at the remote site.
• Enhanced Easy VPN: Enhanced Easy VPN provides a point-to-point secure connection between a remote device and a corporate headend. This technology simplifies the configuration for hardware-based clients, and supports software version clients. For this technology, the remote site can have either a Cisco IOS Software router or a PC running Windows, Mac OS, or Linux.
• SSL VPN: SSLVPN provides secure access to corporate servers from any PC, even if it is connecting from a public location. This technology uses an SSL-enabled web browser to establish an SSL tunnel back to the corporate securely. For this technology, the remote site can be any mobile devices that have Cisco AnyConnect clients available.
In addition to the VPN configuration, you need to provision other services before you can use the VPN:
• Public key infrastructure (PKI) using Cisco IOS Certificate Server or other Certificate Authority
• Authentication, authorization and accounting (AAA) using Cisco Secure Access Control Server (ACS) or other AAA servers
This document then shows the full configuration that you can use to combine DMVPN with Enhanced Easy VPN and SSL VPN, all in the same hub. For Enhanced Easy VPN, two profiles are configured: one for PKI and one for preshared keys.
Each VPN configuration is shown with different formatting. The rest of the configuration is shared by all.
Following are some notes about the configuration:
• DMVPN and Enhanced Easy VPN can use the same PKI certificate server, or they can each use a different one. For Enhanced Easy VPN, the spokes need to have the subject name OU field set to match the Easy VPN group name.
• When the same WAN-facing interface is shared by Enhanced Easy VPN and DMVPN, you must use the same cryptography profile for protecting both VPNs. The "shared" keyword is used to achieve this objective under the tunnel command. For example:
tunnel protection ipsec profile my-profile shared
The following Converged VPN headend configuration sample is valid for a Cisco 3845 Integrated Services Router and a Cisco 7206 Router. Only interface names are different from one platform to the other.
Converged VPN Configuration for Cisco 3800 and Cisco 7206
DMVPN
ENHANCED EASY VPN
SSL VPN
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
