Cisco VPN 3000 Series Concentrators

Document ID: 22306

Contents

Introduction
Prerequisites
      Requirements
      Components Used
      Network Diagram
      Conventions
Configurations
      Central Concentrator
      Remote Concentrator
      VPN 3002 Hardware Client
Verify
Troubleshoot
NetPro Discussion Forums - Featured Conversations
Related Information

Introduction

This document illustrates how to create a LAN-to-LAN VPN tunnel between central and remote VPN 3000 Concentrators. Concurrent to the LAN-to-LAN VPN, the central concentrator also accepts remote access VPN connections. Communication is then enabled between the remote access VPN Client and the local LAN, behind the remote concentrator, through the central concentrator. The communication between spokes is enabled through the use of Reverse Route Injection (RRI), a feature introduced in version 3.5 of the VPN 3000 Concentrator code.

This sample configuration only covers a single subnet behind the VPN Concentrator; however, if you have multiple subnets behind the concentrator, you should use RRI with routing protocols. For more information, see How to Populate Dynamic Routes Using Reverse Route Injection, or use static routes accordingly. Although the illustration in this document uses a hardware client, the same example could be applied to a software client, LAN-to-LAN tunnels, or other devices supporting RRI.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

• Cisco VPN 3000 Concentrator running software version 3.5.2 (This configuration has been tested successfully with version 4.0.)

• Cisco VPN 3002 Hardware Client version 3.5.2

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Network Diagram

This document uses this network setup:

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

Configurations

Due to space limitations this configuration covers only the LAN-to-LAN configurations on the VPN Concentrators.

Central Concentrator

Follow these steps to configure the central concentrator.

1. Go to Configuration > Policy Management > Traffic Management > Network Lists > Modify and define a local network list. In the example below, the network is included behind the VPN 3002 Hardware Client.

   

2. Create a network list for the remote site.

   

3. Go to Configuration > System > Tunneling Protocols > IPSec LAN-to-LAN > Modify and create a LAN-to-LAN configuration to the remote site.

   

   

4. Once the remote network is defined on the LAN-to-LAN configuration, it will be advertised on the central concentrator's internal routing table.

   

5. Define a network list for remote access clients.

   

6. Go to Configuration > System > Address Management > Assignment and define the method of address assignment for remote VPN access users.

   

7. Go to Configuration > User Management > Groups > Modify vpnclient and define the group settings for remote access clients.

   

8. Define IPSec parameters for the group.

   

9. Define Mode Config parameters for the group.

   

   

10. Select Groups > Address Pools > Modify and define the address pool for the group.

    

11. Go to Configuration > System > IP Routing > Reverse Route Injection and enable RRI for client connections. The example below only has Network Extension RRI enabled.

    

Remote Concentrator

Follow this procedure to configure the remote concentrator.

1. Go to Configuration > Policy Management > Traffic Management > Network Lists > Modify and define a remote network list. The example below includes the network behind the VPN 3002 Hardware Client.

   

2. Define a local network list.

   

3. Go to Configuration > System > Tunneling Protocols > IPSec LAN-to-LAN > Modify and create a LAN-to-LAN configuration to the central concentrator.

   

   

4. Once RRI is defined on the LAN-to-LAN configuration, the remote LAN is advertised on the routing table.

   

VPN 3002 Hardware Client

The VPN 3002 Hardware Client is operating in network extension mode. The screen below shows the IPSec configuration of the client. For more information, see Configuring a Connection Between the VPN 3002 Hardware Client and a VPN 3000 Concentrator in Network Extension Mode.

Verify

This section provides information you can use to confirm your configuration is working properly.

1. Below are the central concentrator sessions once connections have been made.

   

2. Check the sessions on the remote concentrator.

   

3. Since the VPN 3002 Hardware Client is operating in network extension mode, the tunnel should be brought up immediately. Check the system status to verify the tunnel.

   

4. Conduct further tests by initiating a ping from a host behind the VPN 3002 Hardware Client to a host behind the remote concentrator, and vice versa. Both tests should return successful results. Check the routing table to see the network behind the hardware client.

   

Troubleshoot

There is currently no specific troubleshooting information available for this configuration.

NetPro Discussion Forums - Featured Conversations

Related Information

• Cisco VPN 3000 Series Concentrator Support Page
• Cisco VPN 3000 Series Client Support Page
• IPSec Support Page
• Technical Support - Cisco Systems