vpn roadshow module 2 3000

© 2003, Cisco Systems, Inc. All rights reserved. VPN Roadshow
Cisco VPN
Partner Technical Development
Module 2 : VPN 3000 Configuration
APAC Channels Technical Operations
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Course Agenda
• 3000 Concentrator Overview
• Overview of Remote Access Configuration
• Remote Access Configuration
• CA Support Overview
© 2003, Cisco Systems, Inc. All rights reserved. VPN Roadshow
Cisco VPN 3000 Concentrator
Series
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
VPN Concentrator Series
VPN 3030
regional office
VPN 3030
regional office
VPN 3005 or 3015
branch office
Internet
VPN 3060 or 3080
central site
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
VPN 3005 Concentrator
Private Public
100–240V power supply
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
VPN 3015 Concentrator

SEP module
Slots
Private
Private
100-240V power supplies
load sharing
100–240V power
supplies load sharing
Public
External
Public
External
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
VPN 3030 Concentrator
SEP module
Slots
Private
Private
100-240V power supplies
load sharing
100–240V power
supplies load sharing
External
External
Public
Public
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
VPN 3060 Concentrator
Private
Private

100-240V power supplies
load sharing
100–240V power
supplies load sharing
SEP module
Slots
External
External
Public
Public
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
VPN 3080 Concentrator
Private
Private
SEP module
Slots
100-240V power supplies
load sharing
100–240V power supplies
load sharing
External
External
Public
Public
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Concentrator Product Comparison
10001000500100100Site-to-Site Tunnels
N
4
2

256M
HW
10000
100M
2U
3080
Y
2
2
256M
HW
5000
100M
2U
3060
YYNUpgradeable
0
Up to 2
64M
SW
100
4M
2U
3015
128M32MMemory
HWSWEncryption
10SEP Modules
Up to 21Power Supplies
1500100Remote Access Sessions
50M4MPerformance

2U1UHeight
30303005Feature
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Scalable Encryption Processor—SEP2
POWER
STATUS
SEP-200U
• DSP-based hardware encryption—1,500 to
5,000 simultaneous sessions
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
SEP Redundancy
SEP
redundancy
SEP
redundancy
Failover
• Top-to-bottom redundancy
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Concentrator
Redundancy VRRP
Internet
Server
Private
network
Public
network
Master
Slave
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Internet

Server
Private
network
Public
network
Master
Non-master
Load Balancing
© 2003, Cisco Systems, Inc. All rights reserved. VPN Roadshow
Overview of Remote Access
Using Pre-Shared Keys
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Client to LAN
Internet service
provider
Internet
Telecommuter
Telecommuter
File server
Corporate office
Telecommuter
Telecommuter
Web server
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
IPSec Client to LAN Components
VPN
Concentrator
Internet
ISP
ISP

Internet
Application
server
PPP connectivity
Dial access
Telecommuter
with the Cisco
VPN 3000
Concentrator
Series Client
IPSec tunnel or session
• Client software
• PPP protocol
• IPSec protocol
• VPN Concentrator
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
IPSec Client-to-LAN—Tunneling
Application
server
10.0.1.10
VPN private IP
10.0.1.5
Adapter (NIC) IP address
172.26.26.1
Client IP address
10.0.1.20
192.168.1.5
172.26.26.1
ESP
10.0.1.10

10.0.1.20
Data
Telecommuter
with the Cisco
VPN 3000
Concentrator
Series Client
Internet
ISP
VPN public IP
192.168.1.5
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
IPSec “Windows” Client
Cisco VPN “Windows”
Client software
Installed on Windows system
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Summary (cont.)
• Mode configuration enables the Cisco VPN
3000 Concentrator Series to push the network
information to the Cisco VPN 3000
Concentrator Series Client.
• The Cisco VPN 3000 Concentrator Series can
use several different types of authentication
servers.
• The Cisco VPN 3000 Concentrator Series
provides extensive monitoring capabilities.
© 2003, Cisco Systems, Inc. All rights reserved. VPN Roadshow
Remote Access Configuration
of the Cisco VPN 3000

Concentrator Series
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
IP Interfaces
Ethernet 1 (private IP)
10.0.1.5
Ethernet 2 (public IP)
192.168.1.5
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Public IP Interface
Ethernet 1 (private IP)
10.0.1.5
Ethernet 2 (public IP)
192.168.1.5
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
System Information
© 2003, Cisco Systems, Inc. All rights reserved. VPV Roadshow
Protocols
Internet
Internet
IPSec