VPN solution

Similar Questions

• VPN solution - 3002 to IOS

  Hi all

  I'm looking for comments and options for a VPN solution.  The attached diagram shows the configuration of the network and what I am trying to accomplish.

  I have a client to Site A need establish a VPN tunnel with an outside party 3^rd , located at Site B.  Traffic must be passed between hosts on Site a subnet 192.168.8.x and host subnet B Site 192.168.9.x

  Site B has a VPN 3002 hardware client to establish a tunnel with Site A

  Site A has an Internet facing router with advanced IP services IOS and a worm ASA 8.x protecting internal resources.

  The Site A customer will only allow VPN tunnels with the router, as opposed to the ASA.

  Based on this topology, how to better create a static tunnel VPN 3002 to the router and allow traffic on the route to/from the 192.168.8.x subnet to Site A and to the 192.168.9.x subnet and Site B?

  All your comments and suggestions would be greatly appreciated.

  You can configure the EasyVPN in NEM (Mode Extension network) between VPN 3002 and router IOS. This will be the only option

  supported on VPN3002 to reach the VPN tunnel between VPN3002 and router IOS.

  Here is the sample configuration for your reference:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080095106.shtml

  Pls also note that VPN3002 is EOL, and here is the notification of end of LIFE for your reference:

  http://www.Cisco.com/en/us/partner/prod/collateral/vpndevc/ps5743/ps5699/ps2286/prod_end-of-life_notice0900aecd805cd557.html

• IPSec Site to Site VPN Solution needed?

  Hi all

  I need a solution to provide full connectivity to one of my clients. I created two IPSEC Site to Site VPN, one between the INFO and RITA and second between NIDA and RITA. I can access RITA machine that is 172.16.36.101 at the INFO and 10.0.0.5 to NIDA.

  Now, I need to give access to my customer INFORMATION to direct NIDA 10.0.0.5 without established VPN machine to NIDA 10.0.0.5 of 172.16.36.101 access.

  Could you please give me the solution how is that possible?

  Concerning

  Uzair Hussain

  Hi uzair.infotech,

  Looks like you need to set up a grouping between the 3 sites, at the end of that your topology will look like this:

  INFO - RITA - NIDA

  You can check this guide that explains step by step how to configure grouping:

  https://supportforums.Cisco.com/document/12752536/how-configure-site-sit...

  Hope this info helps!

  Note If you help!

  -JP-

• What is a VPN solution that is more stable than IPSEC VPN? What is the latest version of VPN client recommended for Windows 7 & 8 users?

  Hello

  I would like to ask a few details & concerns on our existing VPN configuration.

  1. What is the Cisco VPN client recommended for users of Windows 7 and 8? Is there an official documentation for this Cisco? We currently use customer VPN Ciso 5.0.7.

  2. we are running IPSEC VPN with only 1 gateway & only local authentication (No ACS) for our client. Recently, we have some concerns that they are the VPN connection is down. Whereas if I'm the one connected to the VPN, my connection is stable. Is there any point that we must consider up in the network. Is there a better configuration or solution that we could recommend to the customer as SSL VPN?

  3. If you want to use SSL VPN anyconnect secure mobility & we want to implement redundancy on the FW, how will the license work?

  Thank you!

  An AnyConnect-based VPN is the replacement recommended for remote IPsec VPN access. (source)

  AnyConnect can use SSL or IPsec (IKEv2) for transport.

  For an ASA redundant firewalls (running 8.3 (1) or later) any permit required AnyConnect are shared between them. that is, you just buy licenses for a member of the HA pair. (source)

• Routers for VPN solution

  Hi all

  We built a VPN Flex in our society and I offer them as devices below for the various offices.

  Cisco 4451
  Cisco 4351
  Cisco 4331
  Cisco 4321

  Cisco 892FSP

  in the begin block I connect only 3 offices and then connect the rest of them slowly.
  I would like to know if we have to pay more to implement that, I mean if we need additional licenses or something I couldnot think.

  Best regards
  Thom

  Cisco 892 comes with Advanced characteristic IP game which is very good for your deployment. But SRI 4 k, you must purchase the license safety or Security Bundle for all your needs of VPN.

• Best VPN Solution

  Hello

  I had two 1841 and a router cisco 881. I keep one of this router to HO and remaining at the branch.  I have a static internet IP to HO but dynamic IP at the branch.

  I want to configure a VPN to connect to HO branch through router. The branch connects via an IP private use of the internet. What VPN is the safer and better for it.

  Kind regards

  Mero

  This is a typical scenario for dynamic virtual Tunnel Interfaces (DVTI):

  http://www.Cisco.com/en/us/partner/docs/iOS/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1027258

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Best VPN server

  I use the VPN server through Server 5.1. However, I recently bought an EdgeRouter POE, and I plan to change to its VPN. Can someone offer advantages/disadvantages for one against the other?

  Thank you

  Jeff

  I have no experience using the EdgeRouter and it took quite some dig able to determine that this was the case to all VPN. It seems mainly focused on being a router Ethernet to Ethernet. However as mentioned, I finally found a reference, which suggests he can do the following VPN protocols.

  • IPSec Site to Site and remote access
  • OpenVPN Site‐to‐Site and remote access
  • RAS PPTP
  • Remote access L2TP
  • PPTP client

  Download and read the whole manual I don't remember not its VPN features.

  I can say that I gave up on VPN server own Apple as it supports only L2TP and PPTP that these two days are considered to be weak from a security point of view and which can be used for VPN on demand configurations. I now use StrongSwan5 which allows to make a Linux server

  • IKEv2 Site to Site and remote access
  • IPSec Site to Site and remote access

  Both being able to VPN on demand.

  IKEv2 is currently considered the most secure VPN solution. IKEv2 is supported the use of VPN client built into El Capitan and iOS 9.

  StrongSwan5 works with the built-in VPN Apple customer and StrongSwan5 supports the use of SSL certificates, it also supports force all traffic through the VPN - a common requirement of companies configuration VPN connection.

• ACS 3.0 Windows, VPN, remote access and external databases

  I'm trying to implement a VPN solution, and most are very good.

  We have a VPN concentrator, which authenticates with CSACS and who, in turn, back off the coast of authentication with a Windows domain. Unknown user policy allows new users themselves create dynamically.

  The VPN uses the Cisco VPN client. The hub is visible on the internet, and the bit works fine.

  Bit difficult, but we are also trying to set up the access line by using a phone company for users who do not have their own internet access.

  I have problems which to authenticate to the Windows domain.

  If I manually create a user and add a chap password, this user can authenticate OK. If I manually add a password of chap user can authenticate.

  If the user does not exist I get "user CS unknown', if I did not add a password manually, but the user is I get"Invalid password CS CHAP", so it seems that the problem is is interrupting this authentication against the field, but I don't see why.

  The telephone company radius server in my network as a aaa client configuration and is almost the same configured as VPN concentrators (the difference is the Conc VPN is configured as 'RADIUS (Cisco VPN 3000)' and as 'RADIUS (IETF)' radius server)

  Any thoughts?

  You cannot use CHAP to authenticate a domain Windows, the way THAT CHAP requires the password must be stored is incompatible with the Windows passwords. You need to configure each connection Dial-Up Networking to dial-up users to use MSCHAP or PAP.

• 64-bit machine access 887VA VPN

  Hi guys,.

  I have a VPN solution for remote access in place of a Cisco 887VA router running.

  Until recently, all remote users were both OSX and WinXP users and as such as the native client VPN and VPN Cisco Client 5.x worked perfectly. Now, I have a user who is trying to connect using a Windows machine 7 64-bit which he apprers is not supported by this type of client and documentation, I can find says that there is no alternative other than the AnyConnect platform.

  I ran up to a Windows 7 machine to set up an AnyConnnect client that is a failure on the connection.

  After reading further the AnyConnect administration guide I see that it says this will allow only access to a device of type ASA with no mention of an IOS device.

  Is this the case? If Yes, how someone connect a 64-bit computer for a remote access vpn based IOS?

  I'm confused and I'm not going to be able to allow users of 64-bit on the VPN network.

  Any guidance is appreciated.

  Thank you

  Bruno

  Yes, you can still use IPSec VPN Client (version 5.0.7 (440)) to connect, however, Yes, IPSec VPN Client is going EOL.

  Here are the name of the file that you can download which take supported Windows 7 64-bit: vpnclient-winx64-msi - 5.0.07.0440 - k9.exe.

  Notification of end of LIFE for the VPN Client are:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5743/ps5699/ps2308/end_of_life_c51-680819.html

  You can also use the AnyConnect for remote access to the router IOS, however, you must purchase the SSL VPN license to connect using the AnyConnect client.

  Hope that helps.

• Data capture ASA VPN

  Hello

  We have an asa 5585 on the network and it is configured for remote access VPN with RSA.

  When a VPN user connects to their VPN, he is invited for a PIN followed their secure ID token code.

  We want to simplify our VPN configuration if we starting from a perspective of support and management, users use a hard chips. Currently, many lose their chips or have a connection problem, so I would like to know what simple VPN solution, we have in place.

  Then is it possible on the ASA when I check my VPN traffic to determine what users are using the VPN for, since the purpose is if they only use it for email, so we can advise them to use webmail rather and can disable VPN access.

  With respect to the VPN, I see only two options; you either empty tokens to make life easier or you keep them and put up with it.

• Access VPN ASA and cisco ISE Admin

  Hello

  Currently I'm deployment anyconnect VPN Solution for my client on ASA 9.2 (3). We use the ISE 1.3 to authenticate remote users.

  In the policy stipulates the conditions, I put the condition as below.

  Policy name: Anyconnect

  Condition: DEVICE: Device Type Device Type #All Device Types #Dial - in access EQUALS AND
  RADIUS: NAS-Port-Type is equal to virtual

  I'm authenticating users against the AD.

  I am also restrict users based on group membership in authorization policies by using the OU attributes.

  This works as expected for remote users.

  We also use the ISE to authenticate administrators to connect to the firewall. Now what happens is, Cisco ASA valid also against policy, administrators and their default name Anyconnect.

  Now the question is, how to set up different political requirement for access network admin and users the same Firewall VPN.

  Any suggestions on this would be a great help.

  See you soon,.

  Sri

  You can get some ideas from this article of mine:

  http://ltlnetworker.WordPress.com/2014/08/31/using-Cisco-ISE-as-a-generic-RADIUS-server/

• VPN access query remote ASA - several group policies for the unique connection profile

  Hi all

  Two quick questions here that I need to help.

  1. in an ASA 5525, is it possible to have several group policies for a single connection profile?

  Scenario: A customer is running F5 Firepass to their VPN solution and this device is used by them to have multiple strategies group by the connection profile. We plan to migrate them to ASA (5525) and I don't know if the ASA can support that.

  2. in an ASA-5525 for Clientless Remote access VPN, can pass us the page to connect to an external server? For example, if I have a connection with a URL profile setup: "'https://wyz.vpn.com/ ';" for the LDAP/Radius Authentication, but for https://wyz.vpn.com/data and https://wyz.vpn.com/test I want to HTTP based authentication form and this page needs to be sent to an external server that is to say ASA step will manage this page, but rather the first page for this is served by the external server.

  Scenario: One of our clients is running F5 Firepass to their VPN solution. On the F5 they have pages of configuration such as the https://wyz.vpn.com/ that the F5 shows to the user when they connect via VPN without client; However if the user types https://wyz.vpn.com/data in the browser, the traffic comes to the F5, but F5 redirects this traffic to an external server (with an external url as well). Then it's this external server that transfers the first page of the user requesting authentication for HTTP form based authentication information.

  Thanks in advance to all!

  Hello

  You can have fallback to LOCAL only primary method.

  http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa90/configuration/gu...

  HTH

  Averroès.

• VPN through firewall

  I need assistance on setting up a site vpn solution site between possible cisco asa firewall and isa server.

  guidance, help or links is very appreciated!

  Thanks in advance.

  I'm not an expert in the hope of VPN microsoft that this link will be helpful

  http://TechNet.Microsoft.com/en-us/library/cc302442.aspx

  What firewall is

  by using asdm- http://www.cisco.com/en/US/docs/security/asa/asa72/getting_started/asa5500/quick/guide/sitvpn_b.html

  for cli- http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/site2sit.html

• Question - VPN on PIX

  Our PIX firewall allows any set up inside. In the past, we have tried to establish a VPN connection from inside our network to a hub on the Internet VPN and it did not work. We were told that do VPN behind a firewall is not possible (I don't remember who said that). However, last week we had a customer VPN to their network through our firewall. I don't have the details on the equipment or Protocol. Technically, I would like to know what can and cannot be done from the inside using VPN and to understand the reasons. We went through a few updates on the PIX from v5.0 to v6.2, and I suppose this may have something to do with it. If someone could help or point me to documentation that explains this in detail, it would be highly appreciated.

  Thank you!

  Lori White

  The big problem with IPSec through a firewall is not so much the filtering (specific protocols can easily be let go), but generally the NAT'ing or more precisely, the PAT'ing (Port Address Translation). VPNS use IPSec or PPTP usually, that use a protocol that is not TCP or UDP based (ESP and GRE respectively). Whe ndoing PAT however, it relies on a TCP or UDP port number to differentiate the different sessions and so when a protocol arrives who doesn't have it, it is usually deposited by the PAT device ' ing.

  Many VPN solutions are now a feature called IPSec via UDP, or via TCP or transparency IPSec IPSec, or whatever you want to call. Basically, the VPN client and the hub encapsulate IPSec ESP packets in a packet UDP or TCP depending on the implementation, this p [rescue can be PAT would have correctly and everything works fine. Your client was probably using something like that.

  PIX 6.3 code will support IPSec and PAT, but only for an internal IPSec session. You are the best solution is to see if any VPN software you are using supports a kind of UDP or TCP encapsulation, then you'll be off and running.

• VPN capability

  May 16, 2003, 7:31 am PST

  I need to provide the VPN solution for nearly 2,000 remote users. Two main factors are remote desktop (so from home, users can use their desktop PC) and access to the protected servers. All this must be by VPN. My question is about the ability and compatibility.

  1)

  PIX 515 is sufficient for users of this number? What of 525? Or I have to go with the VPN concentrator? Advantages and disadvantages?

  2)

  Can I integrate VPN with Novell E-Directory for user management device? What about SUN1 directory? Or the RADIUS? PREFFERED solution would integrate with EDirectory.

  Please send your comments or suggestions. Any help is highly appreciated.

  Thank you

  S.P.

  The 515 both the 525 can support 2000 simultaneous tunnels. Therefore, you could do with the 515. However, I think that a VPN concentrator suitable for the task at hand. The hub is designed for exactly this kind of installation. The advantage of using the VPN concentrator, it is that he would facilitate the management of this large number of usersmuch. The downside is that you trust all users and that there is the high degree of security that provides a firewall.