The figure below illustrates the client mode of operation. In this example, the Cisco 831 router provides access to two PCs, which have IP addresses in the 10.0.0.0 private network space. These PCs connect to the Ethernet interface on the Cisco 831 router, which also has an IP address in the 10.0.0.0 private network space. The Cisco 831 router performs NAT or PAT translation over the VPN tunnel so that the PCs can access the destination network.

Figure 1

Cisco Easy VPN Remote Connection

Note	The figure above could also represent a split tunneling connection, in which the client PCs can access public resources in the global Internet without including the corporate network in the path for the public resources.

The figure below also illustrates the client mode of operation, in which a VPN concentrator provides destination endpoints to multiple xDSL clients. In this example, Cisco 800 series routers provide access to multiple small business clients, each of which uses IP addresses in the 10.0.0.0 private network space. The Cisco 800 series routers perform NAT or PAT translation over the VPN tunnel so that the PCs can access the destination network.

Figure 2

Cisco Easy VPN Remote Connection (Using a VPN Concentrator)

The figure below illustrates the network extension mode of operation. In this example, the Cisco 831 router and Cisco 1700 series router both act as Cisco Easy VPN remote devices, connecting to a Cisco VPN 3000 concentrator.

The client hosts are given IP addresses that are fully routable by the destination network over the tunnel. These IP addresses could be either in the same subnet space as the destination network or in separate subnets, assuming that the destination routers are configured to properly route those IP addresses over the tunnel.

In this example, the PCs and hosts attached to the two routers have IP addresses that are in the same address space as the destination enterprise network. The PCs connect to the Ethernet interface of the Cisco 831 router, which also has an IP address in the enterprise address space. This scenario provides a seamless extension of the remote network.

Figure 3

Cisco Easy VPN Network Extension Connection

Using preshared keys, each peer is aware of the key of the other peer. Preshared keys are displayed in running configurations, so they can be seen by anyone (referred to as clear format). When a more secure type of authentication is required, Cisco software also supports another type of preshared key: the encrypted preshared key.

Using an encrypted preshared key for authentication allows you to securely store plain-text passwords in type 6 (encrypted) format in NVRAM. A group preshared key can be preconfigured on both VPN-tunnel peers. The encrypted form of the keyword can be seen in the running configuration, but the actual keyword is not visible. (For more information about encrypted preshared keys, see Encrypted Preshared Key.)

Digital certificates provide for the support of Rivest, Shamir, and Adelman (RSA) signatures on Easy VPN remote devices. The support is provided through a RSA certificate that can be stored on or off the remote device.

Note	The recommended timeout for Easy VPN using digital certificates is 40 seconds.

For more information about digital certificates, see the Easy VPN Remote RSA Signature Support feature guide, Release 12.3(7)T1.

Xauth is an additional level of authentication that can be used. Xauth is applicable when either group preshared keys or digital certificates are used. Xauth credentials can be entered using a web interface manager, such as Security Device Manager (SDM), or using the CLI. (See the section "Cisco Easy VPN Remote Web Managers.")

The Save Password feature allows the Xauth username and password to be saved in the Easy VPN Remote configuration so that you are not required to enter the username and password manually. One-Time Passwords (OTPs) are not supported by the Save Password feature and must be entered manually when Xauth is requested. The Easy VPN server must be configured to "Allow Saved Passwords." (For more information about how to configure the Save Password feature, see the section "Dead Peer Detection Periodic Message Option.")

Xauth is controlled by the Easy VPN server. When the Cisco IOS Easy VPN server requests Xauth authentication, the following messages are displayed on the console of the router:

EZVPN: Pending XAuth Request, Please enter the following command:
crypto ipsec client ezvpn xauth

When you see this message, you can provide the necessary user ID, password, and other information by entering the crypto ipsec client ezvpn connect command and responding to the prompts that follow.

The recommended Xauth timeout is 50 seconds or fewer.

Note	The timeout for entering the username and password is determined by the configuration of the Cisco IOS Easy VPN server. For servers running Cisco IOS software, this timeout value is specified by the crypto isakmp xauth timeout command.

Web-Based Activation provides a user-friendly method for a remote teleworker to authenticate the VPN tunnel between his or her remote Easy VPN router and the central site router. This feature allows administrators to set up their remote LANs so that the initial HTTP request that is coming from any of the remote PCs is intercepted by the remote Easy VPN router. A login page is returned to the user, whereby the user may enter credentials to authenticate the VPN tunnel. After the VPN tunnel comes up, all users behind this remote site can access the corporate LAN without being reprompted for the username and password. Alternatively, the user may choose to bypass the VPN tunnel and connect only to the Internet, in which case a password is not required.

A typical application for web-based activation is a home teleworker who brings up the Easy VPN tunnel only when he or she needs to connect to the corporate LAN. If the remote teleworker is not present, other members of the household (such as a spouse or children) can use the Internet Only option to browse the Internet without activating the VPN tunnel. The figure below shows a typical scenario for web-based activation.

Figure 4

Typical Web-Based Activation Scenario

Note

Entering the Xauth credentials brings up the tunnel for all users who are behind this remote site. After the tunnel is up, any additional PCs that are behind the remote site do not get prompted for Xauth credentials. Web-Based Activation is an authentication to bring up the VPN tunnel for all remote PCs and cannot be considered individual user authentication. Individual user authentication for VPN tunnel access is available using the Cisco IOS Authentication Proxy or 802.1x features, which can be configured on the remote Easy VPN router. (See the "Web-Based Activation" sections "General information on IPsec and VPN" for a reference to configuring Authentication Proxy and "802.1x authentication" for a reference to configuring 802.1x authentication.)

To configure web-based activation, see the section "Configuring Web-Based Activation."

The following sections show the various screen shots that a remote teleworker sees when the Web-Based Activation feature is turned on:

• Web-Based Activation Portal Page
  
• VPN Authentication Bypass
  
• VPN Tunnel Authentication
  
• Successful Authentication
  
• Deactivation
  

The 802.1x Authentication feature allows you to combine Easy VPN client mode operation with 802.1x authentication on Cisco IOS routers. For more information about this feature, see "802.1 Authentication" in the section "Additional References."

The Cisco Easy VPN tunnel is automatically connected when the Cisco Easy VPN Remote feature is configured on an interface. If the tunnel times out or fails, the tunnel automatically reconnects and retries indefinitely.

To specify automatic tunnel control on a Cisco Easy VPN remote device, you need to configure the crypto ipsec client ezvpn command and then the connect auto command. However, you do not need to use these two commands when you are creating a new Easy VPN remote configuration because the default is "automatic."

To disconnect or reset a particular tunnel, you should use the clear crypto ipsec client ezvpn command, or you can use SDM.

The Cisco Easy VPN Remote software implements manual control of the Cisco Easy VPN tunnels so that you can establish and terminate the tunnel on demand.

To specify manual tunnel control on a Cisco Easy VPN remote device, you need to input the crypto ipsec client ezvpn command and then the connect manual command.

The manual setting means that the Cisco Easy VPN remote will wait for a command before attempting to establish the Cisco Easy VPN Remote connection. When the tunnel times out or fails, subsequent connections will also have to wait for the command.

If the configuration is manual, the tunnel is connected only after you issue the command crypto ipsec client ezvpn connect .

To disconnect or reset a particular tunnel, you should use the clear crypto ipsec client ezvpn command, or you can use SDM.

See the "Configuring Manual Tunnel Control" section for specific information on how to configure manual control of a tunnel.

Note	This feature is not available in Cisco IOS Release 12.3(11)T.

The Traffic-Triggered Activation feature is recommended for transactional-based VPN applications. It is also recommended for use with the Easy VPN dial backup feature for the backup Easy VPN configuration so that backup is activated only when there is traffic to send across the tunnel.

To use Access Control List (ACL) tunnel control, you must first describe the traffic that is considered "interesting." For more information about ACLs, refer to the " IP Access List Overview " chapter of the Cisco IOS Security Configuration Guide: Securing the Data Plane . To actually configure an ACL-triggered tunnel, use the crypto ipsec client ezvpn command with the connect acl command.

Backup Server List Local Configuration allows users to enter multiple peer statements. With this feature configured, if the client is connecting to a peer and the negotiation fails, Easy VPN fails over to the next peer. This failover continues through the list of peers. When the last peer is reached, Easy VPN rolls over to the first peer. The IKE and IPsec SAs to the previous peer are deleted. Multiple peer statements work for both IP addresses as well as for hostnames. Setting or unsetting the peer statements will not affect the order of the peer statements.

To use this feature, use the peer command after the crypto ipsec client ezvpn command.

Easy VPN remote that is based on Cisco IOS software can have up to 10 backup servers configured for redundancy. The Backup Server feature allows the Easy VPN server to "push" the backup server list to the Easy VPN remote.

The backup list allows the administrator to control the backup servers to which a specific Easy VPN remote will connect in case of failure, retransmissions, or dead peer detection (DPD) messages.

Note	Before the backup server feature can work, the backup server list has to be configured on the server.

How a Backup Server Works

If remote A goes to server A and the connection fails, remote A goes to server B. If server B has a backup list configured, that list will override the backup server list of server A. If the connection to server B fails, remote A will continue through the backup servers that have been configured.

Note	If you are in auto mode and you have a failure, you will transition automatically from server A to server B. However, if you are in manual mode, you have to configure the transition manually. To configure the transition manually, use the crypto ipsec client ezvpn command with the connect keyword.

No new configuration is required at the Easy VPN remote to enable this feature. If you want to display the current server, you can use the show crypto ipsec client ezvpn command. If you want to find out which peers were pushed by the Easy VPN server, you can use the same command.

To troubleshoot this feature, use the debug crypto ipsec client ezvpn command. If more information is needed for troubleshooting purposes, use the debug crypto isakmp command. The show crypto ipsec client ezvpn command may also be used for troubleshooting.

Easy VPN Remote supports the autoconfiguration of the default Easy VPN inside interface for Cisco 800 series routers. The interface Ethernet 0 is the default inside interface.

If you want to disable the default inside interface and configure another inside interface on the Cisco 800 series router, you must configure the other inside interface first and then disable the default inside interface. You can use the following command to disable the default inside interface:

no crypto ipsec client ezvpn
 name inside

If you did not configure the other inside interface first before disabling the default inside interface, you will receive a message such as the following (see lines three and four):

Router(config)# interface ethernet0
Router(config-if)# no crypto ipsec client ezvpn hw-client inside
Cannot remove the single inside interface unless
one other inside interface is configured

Inside interface support is enhanced in the Cisco Easy VPN Remote feature to support multiple inside interfaces for all platforms. Inside interfaces can be configured manually with the enhanced command.:

interface
 interface-namecrypto ipsec client ezvpn
 name [outside
 | inside

Note	Multiple inside interfaces are supported only when the Cisco Easy VPN server and the Cisco Easy VPN client have the same type of Easy VPN configuration. In other words, both must use a Legacy Easy VPN configuration, or both must use a DVTI configuration.

See the "Configuring Multiple Inside Interfaces" section for information on how to configure more than one inside interface.

Multiple inside interfaces offer the following capabilities:

• Up to eight inside interfaces are supported on the Cisco 800 and Cisco 1700 series routers.
• At least one inside interface must be configured for each outside interface; otherwise, the Cisco Easy VPN Remote feature does not establish a connection.
• Adding a new inside interface or removing an existing inside interface automatically resets the Cisco Easy VPN Remote connection (the currently established tunnel). You must reconnect a manually configured tunnel, and if Xauth is required by the Cisco Easy VPN server, the user is reprompted. If you have set the Cisco Easy VPN Remote configuration to connect automatically and no Xauth is required, no user input is required.
• Inside interfaces that are configured or the default setting can be shown by using the show crypto ipsec client ezvpn command.

The Easy VPN Remote feature supports one Easy VPN tunnel per outside interface. You can configure up to four Easy VPN tunnels per Cisco router. Each Easy VPN tunnel can have multiple inside interfaces configured, but they cannot overlap with another Easy VPN tunnel unless dial backup is configured. For more information about dial backup, see the section "Dial Backup." To configure multiple outside interfaces, use the crypto ipsec client ezvpn command and outside keyword.

To disconnect or clear a specific tunnel, the clear crypto ipsec client ezvpn command specifies the IPsec VPN tunnel name. If there is no tunnel name specified, all existing tunnels are cleared.

See the "Configuring Multiple Outside Interfaces" section for more information on configuring more than one outside interface.

VLAN support allows VLANs to be configured as valid Easy VPN inside interfaces, which was not possible before Cisco IOS Release 12.3(7)XR. With this feature, SAs can be established at connection using the VLAN subnet address or mask as a source proxy.

For the inside interface support on VLANs to work, you must define each VLAN as an Easy VPN inside interface. In addition, IPsec SAs should be established for each inside interface in the same manner as for other inside interfaces. For more information about inside and outside interfaces, see the sections "Multiple Inside Interfaces" and "Multiple Outside Interfaces."

Inside interface support on VLANs is supported only on Cisco routers that support VLANs.

For situations in which you have multiple subnets connected to an Easy VPN inside interface, you can optionally include these subnets in the Easy VPN tunnel. First, you must specify the subnets that should be included by defining them in an ACL. To configure an ACL, see "Access control lists, configuring" in the "Additional References" section. Next, you have to use the acl command after the crypto ipsec client ezvpn (global) command to link your ACL to the Easy VPN configuration. Easy VPN Remote will automatically create the IPsec SAs for each subnet that is defined in the ACL as well as for the subnets that are defined on the Easy VPN inside interface.

Note	Multiple subnets are not supported in client mode.

Note	This functionality is supported only when the Cisco Easy VPN server and the Cisco Easy VPN client have the same type of Easy VPN configuration. In other words, both must use a Legacy Easy VPN configuration, or both must use a DVTI configuration.

Cisco Easy VPN Remote supports interoperability with NAT. You can have a NAT configuration and a Cisco Easy VPN Remote configuration that coexist. When an IPsec VPN tunnel is down, the NAT configuration works.

In the Cisco Easy VPN Remote feature, the router automatically restores the previous NAT configuration when the IPsec VPN tunnel is torn down. The user-defined access lists are not disturbed. Users can continue to access nontunnel areas of the Internet when the tunnel times out or disconnects.

Note	NAT interoperability is not supported in client mode with split tunneling.

The Cisco Easy VPN Remote feature is enhanced to support an additional local-address attribute. This attribute specifies which interface is used to determine the IP address that is used to source the Easy VPN Remote tunnel traffic. After specifying the interface with the local-address command, you can manually assign a static IP address to the interface or use the cable-modem dhcp-proxy interface command to automatically configure the specified interface with a public IP address. See the "Configuring Proxy DNS Server Support" section for configuration information.

Local Address Support is available for all platforms, but it is more applicable to the Cisco uBR905 and Cisco uBR925 cable access routers in conjunction with the cable-modem dhcp-proxy interface command. Typically, the loopback interface is the interface used to source tunnel traffic for the Cisco uBR905 and Cisco uBR925 cable access routers.

In a typical DOCSIS network, the Cisco uBR905 and Cisco uBR925 cable access routers are normally configured with a private IP address on the cable modem interface. In the initial Cisco Easy VPN Remote feature, a public IP address was required on the cable modem interface to support the Easy VPN remote.

In the Cisco Easy VPN Remote feature, cable providers can use the Cable DHCP Proxy feature to obtain a public IP address and assign it to the cable modem interface, which is usually the loopback interface.

For more information on the cable-modem dhcp-proxy interface command, see the Master Commands List at http://www.cisco.com/en/US/docs/ios/mcl/allreleasemcl/all_book.html .

Note	The cable-modem dhcp-proxy interface command is supported only for the Cisco uBR905 and Cisco uBR925 cable access routers.

The peer in a Cisco Easy VPN Remote configuration can be defined as an IP address or a hostname. Typically, when a peer is defined as a hostname, a DNS lookup is done immediately to get an IP address. In the Cisco Easy VPN Remote feature, the peer hostname operation is enhanced to support DNS entry changes. The text string of the hostname is stored so that the DNS lookup is done at the time of the tunnel connection, not when the peer is defined as a hostname.

See the "Configuring and Assigning the Easy VPN Remote Configuration" section for information on enabling the peer hostname functionality.

When the Easy VPN tunnel is down, the DNS addresses of the ISP or cable provider should be used to resolve DNS requests. When the WAN connection is up, the DNS addresses of the enterprise should be used.

As a way of implementing use of the DNS addresses of the cable provider when the WAN connection is down, the router in a Cisco Easy VPN Remote configuration can be configured to act as a proxy DNS server. The router, acting as a proxy DNS server for LAN-connected users, receives DNS queries from local users on behalf of the real DNS server. The DHCP server then can send out the LAN address of the router as the IP address of the DNS server. After the WAN connection comes up, the router forwards the DNS queries to the real DNS server and caches the DNS query records.

See the "Configuring Proxy DNS Server Support" section for information on enabling the proxy DNS server functionality.

The Cisco Easy VPN Remote feature works in conjunction with Cisco IOS Firewall configurations on all platforms.

This feature allows the Easy VPN remote and Easy VPN server to be supported on the same interface, making it possible to both establish a tunnel to another Easy VPN server and terminate the Easy VPN software client on the same interface simultaneously. A typical application would be a geographically remote location for which Easy VPN Remote is being used to connect to a corporate Easy VPN server and also to terminate local software client users.

For more information about the Easy VPN Remote and Server on the Same Interface feature, see "Easy VPN Remote and Server on the Same Interface" in the section "Additional References."

This feature allows the Easy VPN remote and site to site (crypto map) to be supported on the same interface, making it possible to both establish a tunnel to another Easy VPN server and have another site to site on the same interface simultaneously. A typical application would be a third-party VPN service provider that is managing a remote router via the site-to-site tunnel and using Easy VPN Remote to connect the remote site to a corporate Easy VPN server.

For more information about the Easy VPN Remote and Site to Site on the Same Interface feature, see "Easy VPN Remote and Site to Site on the Same Interface" in the section "Additional References."

Web interface managers may be used to manage the Cisco Easy VPN Remote feature. One such web interface manager is SDM, which is supported on the Cisco 830 series, Cisco 1700 series, Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. SDM enables you to connect or disconnect the tunnel and provides a web interface for Xauth. For more information about SDM, see Cisco Security Device Manager .

A second web interface manager is the Cisco Router Web Setup (CRWS) tool, which is supported on the Cisco 806 router. The CRWS provides a similar web interface as SDM.

A third web interface manager, Cisco Easy VPN Remote Web Manager, is used to manage the Cisco Easy VPN Remote feature for Cisco uBR905 and Cisco uBR925 cable access routers. You do not need access to the CLI to manage the Cisco Easy VPN remote connection.

The web interface managers allow you to do the following:

• See the current status of the Cisco Easy VPN remote tunnel.
• Connect a tunnel that is configured for manual control.
• Disconnect a tunnel that is configured for manual control or reset a tunnel configured for automatic connection.
• Be prompted for Xauth information, if needed.

See the "Troubleshooting the VPN Connection" section for more information about Cisco Easy VPN Remote Web Manager.

The dead peer detection periodic message option allows you to configure your router to query the liveliness of its IKE peer at regular intervals. The benefit of this approach over the default approach (on-demand dead peer detection) is earlier detection of dead peers. For more information about the dead peer detection periodic message option, see "Dead peer detection" in the section "Additional References."

When the Cisco VPN 3000 concentrator is configured for load balancing, the VPN 3000 will accept an incoming IKE request from the VPN remote on its virtual IP address. If the device is loaded and unable to accept more traffic, the VPN 3000 will send a notify message that contains an IP address that represents the new IKE server to which the remote should connect. The old connection will be torn down and a new connection established to the redirected VPN gateway.

There is no configuration required for load balancing to occur. If the VPN gateway is configured for load balancing, and it notifies the VPN remote that it is performing load balancing, the VPN remote has access to the load balancing feature.

To verify whether load balancing is occurring, use the debug crypto isakmp, debug crypto ipsec client ezvpn, and show crypto ipsec commands. To troubleshoot the load balancing process, use the show crypto ipsec command.

Management enhancements for Easy VPN remotes allow for the remote management of the VPN remote. The feature provides for the IPv4 address to be pushed by configuration mode to the VPN remote. The IPv4 address is assigned to the first available loopback interface on the VPN remote, and any existing statically defined loopbacks are not overridden. On disconnect, the address and loopback interface are removed from the list of active interfaces.

After the VPN remote is connected, the loopback interface should be accessible from the remote end of the tunnel. All PAT activities will be translated through this interface IP address.

If a loopback exists, and an IP address is associated with it and its state is unassigned, the interface is a good candidate for mode configuration address management.

Note

After you assign an address to the loopback interface, if you save the configuration to NVRAM and reboot the VPN remote, the configuration address is permanently contained in the configuration. If you saved the configuration to NVRAM and rebooted the VPN remote, you must enter configuration mode and remove the IP address from the loopback interface manually.

You can use the show ip interface command with the brief keyword to verify that a loopback has been removed. The output of this show command also displays the interface.

The PFS configuration mode attribute is sent by the server if requested by the VPN remote device. If any subsequent connection by the remote device shows that PFS is not received by the remote, PFS will not be sent in IPsec proposal suites.

Note	The PFS group that will be proposed in the IPsec proposal suites is the same as the group used for IKE.

You can use the show crypto ipsec client ezvpn command to display the PFS group and to verify that you are using PFS.

Note	The Dial Backup feature is not available in Cisco IOS Release 12.3(11)T.

Dial backup for Easy VPN remotes allows you to configure a dial backup tunnel connection on your remote device. The backup feature is "brought up" only when real data has to be sent, eliminating the need for expensive dialup or ISDN links that must be created and maintained even when there is no traffic.

The figure below illustrates a typical Easy VPN remote-with-dial-backup scenario. In this scenario, Cisco 1751 remote device is attempting to connect to another Cisco 1751 (acting as a server). There is a failure in the primary Easy VPN tunnel, and the connection is rerouted through the Easy VPN backup tunnel to the Cisco 1751 server.

Figure 10

Dial Backup for Easy VPN Scenario

• Dial Backup Using a Dial-on-Demand Solution
  
• Dial Backup Using Object Tracking
  
• Easy VPN Remote Dial Backup Support Configuration
  
• Dynamically Addressed Environments
  
• Dial Backup Examples
  

The Virtual IPsec Interface Support feature provides a routable interface to selectively send traffic to different Easy VPN concentrators as well as to the Internet.

Before Cisco IOS Release 12.4(4)T, at the tunnel-up/tunnel-down transition, attributes that were pushed during the mode configuration had to be parsed and applied. When such attributes resulted in the configurations being applied on the interface, the existing configuration had to be overridden. With the Virtual IPsec Interface Support feature, the tunnel-up configuration can be applied to separate interfaces, making it easier to support separate features at tunnel-up time. Features that are applied to the traffic going into the tunnel can be separate from the features that are applied to traffic that is not going through the tunnel (for example, split-tunnel traffic and traffic leaving the device when the tunnel is not up). When the Easy VPN negotiation is successful, the line protocol state of the virtual-access interface gets changed to up. When the Easy VPN tunnel goes down because the security association (SA) expires or is deleted, the line protocol state of the virtual-access interfaces changes to down.

Routes act as traffic selectors in an Easy VPN virtual interface, that is, the routes replace the access list on the crypto map. In a virtual-interface configuration, Easy VPN negotiates a single IPsec SA if the Easy VPN server has been configured with a dynamic virtual IPsec interface. This single SA is created irrespective of the Easy VPN mode that is configured.

After the SA is established, routes that point to the virtual-access interface are added to direct traffic to the corporate network. Easy VPN also adds a route to the VPN concentrator so that IPsec-encapsulated packets get routed to the corporate network. A default route that points to the virtual-access interface is added in the case of a nonsplit mode. When the Easy VPN server "pushes" the split tunnel, the split tunnel subnet becomes the destination to which the routes that point to the virtual access are added. In either case, if the peer (VPN concentrator) is not directly connected, Easy VPN adds a route to the peer.

Note

Most routers that run the Cisco Easy VPN Client software have a default route configured. The default route that is configured should have a metric value greater than 1. The metric value must be greater than 1 because Easy VPN adds a default route that has a metric value of 1. The route points to the virtual-access interface so that all traffic is directed to the corporate network when the concentrator does not "push" the split tunnel attribute.

For more information about the IPsec Virtual Tunnel Interface feature, see the document IPSec Virtual Tunnel Interface (URL link provided in the "Virtual IPsec Interface Support" section of this document ["General Information on IPsec and VPN"]).

The table below presents the different methods of configuring a remote device and the corresponding headend IPsec aggregator configurations. Each row represents a way to configure a remote device. The third column shows the different headend configurations that can be used with IPsec interfaces. See the second table below for a description of terms that are used in the first table below and Virtual IPsec Interface Support.

The table below provides a description of the terms used in the table above and Virtual IPsec Interface Support.

Easy VPN now supports the ability to configure two easy VPN tunnels that have the same inside and outside interfaces. The feature is called the Easy VPN Dual Tunnel. Configuring multiple tunnels on a single remote device can be accomplished in a number of ways, which are listed in the table below along with their configuration and usage considerations. Further discussion in this section refers to only one such method of configuring dual tunnels using Easy VPN tunnels that have virtual interfaces. This method will be referred to as Dual Tunnel Support.

In a dual-tunnel Easy VPN setup, each Easy VPN tunnel is configured using virtual IPsec interface support, as shown in the section "Virtual IPsec Interface Support." Each Easy VPN tunnel has its unique virtual interface, which is created when the Easy VPN configuration is complete.

There are two possible combinations in which the dual tunnels can be used.

• Dual Easy VPN tunnels that have one tunnel using a nonsplit tunnel policy and the other tunnel using a split tunnel policy that has been pushed from the respective headend.
• Dual Easy VPN tunnel in which both tunnels are using an independent split tunnel policy that has been pushed from the respective headend.

Note	It is not permitted to have dual Easy VPN tunnels in which both tunnels are using a nonsplit tunnel policy.

The Easy VPN dual tunnel makes use of route injections to direct the appropriate traffic through the correct Easy VPN virtual tunnel interface. When the Easy VPN tunnel on the remote device "comes up," it "learns" the split or nonsplit policy from the headend. The Easy VPN remote device injects routes in its routing table that correspond to the nonsplit networks that have been learned. If the headend pushes a nonsplit tunnel policy to the Easy VPN remote device, the Easy VPN remote device installs a default route in its routing table that directs all traffic out of the Easy VPN virtual interface that corresponds to this Easy VPN tunnel. If the headend pushes split-tunnel networks to the remote device, the remote device installs specific routes to the split networks in its routing table, directing the traffic to these networks out of the virtual tunnel interface.

Note	Dual Tunnel Easy VPN uses destination-based routing to send traffic to the respective tunnels.

Output features can be applied to this virtual interface. Examples of such output features are Cisco IOS quality of service and Cisco IOS Firewall. These features must be configured on the virtual template that is configured in the Easy VPN client configuration.

The table below explains how this feature should be used. See Dual Tunnel Support for a description of terms that are used in Dual Tunnel Support and the table below.

The Easy VPN server pushes a banner to the Easy VPN remote device. The Easy VPN remote device can use the banner during Xauth and web-based activation. The Easy VPN remote device displays the banner the first time that the Easy VPN tunnel is brought up.

The banner is configured under group configuration on the Easy VPN server.

After this feature has been configured on the server using the commands configuration url and configuration version (after use of the crypto isakmp client configuration group command), the server can "push" the configuration URL and configuration version number to the Easy VPN remote device. With this information, the Easy VPN remote device can download the configuration content and apply it to its running configuration. For more information about this feature, see the section "Configuration Management Enhancements" in the Easy VPN Server feature module.

The Reactivate Primary Peer feature allows a default primary peer to be defined. The default primary peer (a server) is one that is considered better than other peers for reasons such as lower cost, shorter distance, or more bandwidth. With this feature configured, if Easy VPN fails over during Phase 1 SA negotiations from the primary peer to the next peer in its backup list, and if the primary peer is again available, the connections with the backup peer are torn down and the connection is again made with the primary peer.

Dead Peer Detection is one of the mechanisms that acts as a trigger for primary peer reactivation. Idle timers that are configured under Easy VPN is another triggering mechanism. When configured, the idle timer detects inactivity on the tunnel and tears it down. A subsequent connect (which is immediate in auto mode) is attempted with the primary preferred peer rather than with the peer last used.

Note	Only one primary peer can be defined.

The Identical Addressing Support feature supports identically addressed LANs on Easy VPN remotes. Network resources, such as printers and web servers on the LAN side of the EasyVPN remotes, that have overlapping addressing with other Easy VPN remotes are now reachable. The Easy VPN Remote feature was enhanced to work with NAT to provide this functionality.

• The Easy VPN server requires no changes to support the Identical Addressing Support feature.
• The Identical Addressing Support feature is supported only in network extension modes (network-extension and network-plus).
• Virtual tunnel interfaces must be configured on the Easy VPN remote before using the Identical Addressing Support feature.

The daigram below shows an example of the Identical Addressing Support feature configuration.

Figure 11

Identical Addressing Support

The Identical Addressing Support feature can be configured with the following command and enhanced commands:

crypto
 ipsec client ezvpn
 <
name
>

The Cisco Tunneling Control Protocol (cTCP) feature can be used for situations in which an Easy VPN client (remote device) is operating in an environment in which standard IPsec does not function or in which it does not function transparently without modification to existing firewall rules. These situations include the following:

• Small office or home office router performing Network Address Translation (NAT) or Port Address Translation (PAT)
• PAT-provided IP address behind a larger router (for example, in a corporation)
• Non-NAT firewall (packet filtering or stateful)
• Proxy server

The diagram below illustrates how IPsec traffic that is tunneled inside the cTCP traverses Network Address Translation (NAT) and the firewall (see the dashed line).

Figure 12

cTCP on an Easy VPN Remote Device

For detailed steps on how to configure cTCP on Easy VPN remote devices, see the section "Configuring cTCP on an Easy VPN Client."

For more information about cTCP support on Easy VPN remote devices, including configuration and troubleshooting examples, see "cTCP on Cisco Easy VPN remote devices" in the section "cTCP Support on Easy VPN Clients."

After you have configured the Cisco Easy VPN server on the VPN 3000 concentrator to use hostname as its identity, you must configure the peer on the Cisco Easy VPN remote using the hostname. You can either configure DNS on the client to resolve the peer hostname or configure the peer hostname locally on the client using the ip host command. As an example, you can configure the peer hostname locally on an Easy VPN remote as follows:

ip host crypto-gw.cisco.com 10.0.0.1

Or you can configure the Easy VPN remote to use the hostname with the peer command and hostname argument, as follows:

peer crypto-gw.cisco.com.

The Cisco Easy VPN Remote feature does not support the Interactive Hardware Client Authentication Version 3.5 feature. This feature must be disabled. You can disable the feature on the VPN 3000 series concentrator by clicking the HW Client tab on the Configuration | User Management | Base Group screen.

IPsec Tunnel Protocol enables the IPsec tunnel protocol so that it is available for users. The IPsec Tunnel Protocol is configured on the Cisco VPN 3000 series concentrator by clicking the General tab on the Configuration | User Management | Base Group screen.

IPsec group configures the Cisco VPN 3000 series concentrator with a group name and password that match the values configured for the Cisco Easy VPN remote configuration on the router. These values are configured on the router with the group group-name key group-key command and arguments. The values are configured on the Cisco VPN 3000 series concentrator using the Configuration | User Management | Groups screen.

If you are defining multiple users in multiple groups on the VPN 3000 series concentrator, you must check the Group Lock box in the IPsec tab to prevent users in one group from logging in with the parameters of another group. For example, if you have configured one group for split tunneling access and another group without split tunneling access, clicking the Group Lock box prevents users in the second group from gaining access to the split tunneling features. The Group Lock checkbox appears in the IPsec tab in the Configuration | User Management | Base Group screen and in the IPsec tab in the Configuration | User Management | Groups | Add/Modify screens.

To use Xauth, set the Authentication parameter to None. The Authentication parameter appears in the IPsec tab in the Configuration | User Management | Base Group screen and in the IPsec tab in the Configuration | User Management | Groups | Add/Modify screens.

The Configuration | User Management | Base Group, Mode Configuration Parameters Tab screen includes a Split Tunnel option with a checkbox that says "Allow the networks in the list to bypass the tunnel."

The Cisco VPN 3000 series concentrator is preconfigured with a default IKE proposal, CiscoVPNClient-3DES-MD5, that can be used with Cisco Easy VPN remotes. This IKE proposal supports preshared keys with Xauth using the MD5/HMAC-128 algorithm and Diffie-Hellman Group 2.

This IKE proposal is active by default, but you should verify that it is still an active proposal using the Configuration | System | Tunneling Protocols | IPsec | IKE Proposals screen.

In addition, as part of configuring the Cisco VPN 3000 series concentrator--for the Cisco Easy VPN Remote image, you do not need to create a new IPsec SA. Use the default IKE and Easy VPN remote lifetime configured on the Cisco VPN 3000 series concentrator.

Note	You can also use the default IKE proposals IKE-DES-MD5 and IKE-3DES-MD5, but they do not enable Xauth support by default.

You can create a new IPsec SA. Cisco Easy VPN clients use a SA having the following parameters:

• Authentication Algorithm=ESP/MD5/HMAC-128
• Encryption Algorithm=DES-56 or 3DES-168 (recommended)
• Encapsulation Mode=Tunnel
• IKE Proposal=CiscoVPNClient-3DES-MD5 (preferred)

The Cisco VPN 3000 series concentrator is preconfigured with several default security associations (SAs), but they do not meet the IKE proposal requirements. To use an IKE proposal of CiscoVPNClient-3DES-MD5, copy the ESP/IKE-3DES-MD5 SA and modify it to use CiscoVPNClient-3DES-MD5 as its IKE proposal. An IKE proposal is configured on the VPN 3000 series concentrator using the Configuration | Policy Management | Traffic Management | Security Associations screen.

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    group group-name key group-key

5.    peer [ip-address | hostname]

6.    mode {client | network-extension}

7.    exit

8.    interface interface

9.    crypto ipsec client ezvpn name [outside]

10.    exit

11.    exit

1.    Display the current state of the Cisco Easy VPN Remote connection using the show crypto ipsec client ezvpn command. The following is typical output for a Cisco 1700 series router using client mode:

2.    Display the NAT or PAT configuration that was automatically created for the VPN connection using the show ip nat statistics command. The "Dynamic mappings" field of this display gives the details for the NAT or PAT translation that is occurring on the VPN tunnel.

Router# show crypto ipsec client ezvpn
 
Tunnel name : hw1 
Inside interface list: FastEthernet0/0, Serial0/0, 
Outside interface: Serial1/0 
Current State: IPSEC_ACTIVE 
Last Event: SOCKET_UP 
Address: 10.0.0.5 
Mask: 255.255.255.255 
Default Domain: cisco.com
Tunnel name : hw2 
Inside interface list: Serial0/1, 
Outside interface: Serial1/1 
Current State: IPSEC_ACTIVE 
Last Event: SOCKET_UP 
Default Domain: cisco.com

Router# show ip nat statistics
 
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
  cable-modem0
Inside interfaces:
  Ethernet0
Hits: 1489  Misses: 1
Expired translations: 1
Dynamic mappings:
-- Inside Source
access-list 198 pool enterprise refcount 0
 pool enterprise: netmask 255.255.255.0
        start 192.168.1.90 end 192.168.1.90
        type generic, total addresses 1, allocated 0 (0%), misses 0\

1.    enable

2.    configure terminal

3.    password encryption aes

4.    crypto ipsec client ezvpn name

5.    username name password {0 | 6} {password}

6.    exit

7.    show running-config

To configure control of IPsec VPN tunnels manually so that you can establish and terminate the IPsec VPN tunnels on demand, perform the following steps.

Note	CLI is one option for connecting the tunnel. The preferred method is via the web interface (using SDM).

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    connect [auto | manual ]

5.    exit

6.    exit

7.    crypto ipsec client ezvpn connect name

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    connect [auto | manual]

5.    exit

6.    exit

7.    crypto ipsec client ezvpn connect name

You can configure up to three inside interfaces for all platforms.

Note	Multiple inside interfaces are supported only when the Cisco Easy VPN server and the Cisco Easy VPN client have the same type of Easy VPN configuration. In other words, both must use a Legacy Easy VPN configuration, or both must use a DVTI configuration.

You need to manually configure each inside interface using the following procedure.

1.    enable

2.    configure terminal

3.    interface interface-name

4.    exit

5.    crypto ipsec client ezvpn name [outside | inside]

6.    interface interface-name

7.    exit

8.    crypto ipsec client ezvpn name [outside | inside]

1.    enable

2.    configure terminal

3.    interface interface-name

4.    exit

5.    crypto ipsec client ezvpn name [outside | inside]

6.    interface interface-name

7.    exit

8.    crypto ipsec client ezvpn name [outside | inside]

When configuring multiple subnet support, you must first configure an access list to define the actual subnets to be protected. Each source subnet or mask pair indicates that all traffic that is sourced from this network to any destination is protected by IPsec.

Note	Multiple subnets are not supported in client mode. This functionality is supported only when the Cisco Easy VPN server and the Cisco Easy VPN client have the same type of Easy VPN configuration. In other words, both must use a Legacy Easy VPN configuration, or both must use a dVTI configuration.

After you have defined the subnets, you must configure the crypto IPsec client EZVPN profile to use the ACLs.

1.    enable

2.    configure terminal

3.    interface interface-name

4.    exit

5.    crypto ipsec client ezvpn name

6.    acl {acl-name | acl-number}

1.    enable

2.    configure terminal

3.    ip dns server

• What to Do Next
  

To configure dial backup, perform the following steps.

Note	The Dial Backup feature is not available in Cisco IOS Release 12.3(11)T.

1.    Create the Easy VPN dial backup configuration.

2.    Add the backup command details to the primary configuration.

3.    Apply the backup Easy VPN configuration to the dial backup outside interface (for example, serial, async, or dialer).

4.    Apply the Easy VPN profile to the inside interfaces (there can be more than one).

1.    enable

2.    clear crypto ipsec client ezvpn

3.    clear crypto sa

4.    clear crypto isakmp

1.    enable

2.    debug crypto ipsec client ezvpn

3.    debug crypto ipsec

4.    debug crypto isakmp

1.    enable

2.    configure terminal

3.    interface virtual-template number type type-of-virtual-template

4.    tunnel mode ipsec ipv4

5.    exit

6.    crypto ipsec client ezvpn name

7.    virtual-interface virtual-template-number

1.    enable

2.    debug crypto ipsec client ezvpn

3.    debug ip policy

4.    show crypto ipsec client ezvpn

5.    show ip interface

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    peer {ip-address | hostname} [default]

5.    idle-time idle-time

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    mode network-extension

5.    nat allow

6.    exit

7.    interface interface

8.    crypto ipsec client ezvpn name outside

9.    exit

10.    interface interface

11.    ip address ip mask

12.    crypto ipsec client ezvpn name inside

13.    exit

14.    ip nat inside source static local-ip global-ip

15.    ip nat inside source list {acl-name | acl-number} interface interface overload

16.    crypto ipsec client ezvpn name

17.    nat acl {acl-name | acl-number}

18.    exit

19.    exit

1.    enable

2.    configure terminal

3.    crypto ctcp [keepalive number-of-seconds| port port-number]

4.    crypto ipsec client ezvpn name

5.    ctcp port port-number

Note	To restrict the client from sending traffic in clear text when a tunnel is down, perform the following steps. >

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    flow allow acl [name| number]

1.    enable

2.    configure terminal

3.    crypto ipsec client ezvpn name

4.    xauth userid mode {http-intercept | interactive | local}

1.    enable

2.    debug crypto ipsec client ezvpn

3.    debug ip auth-proxy ezvpn

4.    show crypto ipsec client ezvpn

5.    show ip auth-proxy config

Router# debug ip auth-proxy ezvpn
Dec 10 12:41:13.335: AUTH-PROXY: New request received by EzVPN WebIntercept
! The following line shows the ip address of the user.
from 10.4.205.205
Dec 10 12:41:13.335: AUTH-PROXY:GET request received 
Dec 10 12:41:13.335: AUTH-PROXY:Normal auth scheme in operation
Dec 10 12:41:13.335: AUTH-PROXY:Ezvpn is NOT active. Sending connect-bypass page to user

Dec 10 12:42:43.427: AUTH-PROXY: New request received by EzVPN WebIntercept
from 10.4.205.205
Dec 10 12:42:43.427: AUTH-PROXY:POST request received
Dec 10 12:42:43.639: AUTH-PROXY:Found attribute <connect> in form
Dec 10 12:42:43.639: AUTH-PROXY:Sending POST data to EzVPN
Dec 10 12:42:43.639: EZVPN(tunnel22): Communication from Interceptor 
  application.
Request/Response from 10.4.205.205, via Ethernet0
Dec 10 12:42:43.639:         connect: Connect Now
Dec 10 12:42:43.639: EZVPN(tunnel22): Received CONNECT from 10.4.205.205!
Dec 10 12:42:43.643: EZVPN(tunnel22): Current State: CONNECT_REQUIRED
Dec 10 12:42:43.643: EZVPN(tunnel22): Event: CONNECT
Dec 10 12:42:43.643: EZVPN(tunnel22): ezvpn_connect_request

Dec 10 12:42:43.643: EZVPN(tunnel22): Found valid peer 192.168.0.1
Dec 10 12:42:43.643: EZVPN(tunnel22): Added PSK for address 192.168.0.1
Dec 10 12:42:43.643: EZVPN(tunnel22): New State: READY
Dec 10 12:42:44.815: EZVPN(tunnel22): Current State: READY
Dec 10 12:42:44.815: EZVPN(tunnel22): Event: IKE_PFS
Dec 10 12:42:44.815: EZVPN(tunnel22): No state change
Dec 10 12:42:44.819: EZVPN(tunnel22): Current State: READY
Dec 10 12:42:44.819: EZVPN(tunnel22): Event: CONN_UP
Dec 10 12:42:44.819: EZVPN(tunnel22): ezvpn_conn_up B8E86EC7 E88A8A18 D0D51422 
  8AFF32B7

Dec 10 12:42:44.823: EZVPN(tunnel22): No state change
Dec 10 12:42:44.827: EZVPN(tunnel22): Current State: READY
Dec 10 12:42:44.831: EZVPN(tunnel22): Event: XAUTH_REQUEST
Dec 10 12:42:44.831: EZVPN(tunnel22): ezvpn_xauth_request
Dec 10 12:42:44.831: EZVPN(tunnel22): ezvpn_parse_xauth_msg
Dec 10 12:42:44.831: EZVPN: Attributes sent in xauth request message:
Dec 10 12:42:44.831:         XAUTH_TYPE_V2(tunnel22): 0
Dec 10 12:42:44.831:         XAUTH_USER_NAME_V2(tunnel22):
Dec 10 12:42:44.831:         XAUTH_USER_PASSWORD_V2(tunnel22):
Dec 10 12:42:44.831:         XAUTH_MESSAGE_V2(tunnel22) <Enter Username and 
Password.>
Dec 10 12:42:44.831: EZVPN(tunnel22): Requesting following info for xauth
Dec 10 12:42:44.831:         username:(Null)
Dec 10 12:42:44.835:         password:(Null)
Dec 10 12:42:44.835:         message:Enter Username and Password.
Dec 10 12:42:44.835: EZVPN(tunnel22): New State: XAUTH_REQ

Dec 10 12:42:44.835: AUTH-PROXY: Response to POST  is CONTINUE
Dec 10 12:42:44.839: AUTH-PROXY: Displayed POST response successfully
Dec 10 12:42:44.843: AUTH-PROXY:Served POST response to the user

Dec 10 12:42:55.343: AUTH-PROXY: New request received by EzVPN WebIntercept 
  from 10.4.205.205
Dec 10 12:42:55.347: AUTH-PROXY:POST request received
Dec 10 12:42:55.559: AUTH-PROXY:No of POST parameters is 3
Dec 10 12:42:55.559: AUTH-PROXY:Found attribute <username> in form
Dec 10 12:42:55.559: AUTH-PROXY:Found attribute <password> in form
Dec 10 12:42:55.559: AUTH-PROXY:Found attribute <ok> in form
Dec 10 12:42:55.563: AUTH-PROXY:Sending POST data to EzVPN
Dec 10 12:42:55.563: EZVPN(tunnel22): Communication from Interceptor application. Request/Response from 10.4.205.205, via Ethernet0
Dec 10 12:42:55.563:         username:http
Dec 10 12:42:55.563:         password:<omitted>
Dec 10 12:42:55.563:         ok:Continue
Dec 10 12:42:55.563: EZVPN(tunnel22): Received usename|password from 10.4.205.205!
Dec 10 12:42:55.567: EZVPN(tunnel22): Current State: XAUTH_PROMPT
Dec 10 12:42:55.567: EZVPN(tunnel22): Event: XAUTH_REQ_INFO_READY
Dec 10 12:42:55.567: EZVPN(tunnel22): ezvpn_xauth_reply
Dec 10 12:42:55.567:         XAUTH_TYPE_V2(tunnel22): 0
Dec 10 12:42:55.567:         XAUTH_USER_NAME_V2(tunnel22): http
Dec 10 12:42:55.567:         XAUTH_USER_PASSWORD_V2(tunnel22): <omitted>
Dec 10 12:42:55.567: EZVPN(tunnel22): New State: XAUTH_REPLIED
Dec 10 12:42:55.891: EZVPN(tunnel22): Current State: XAUTH_REPLIED
Dec 10 12:42:55.891: EZVPN(tunnel22): Event: XAUTH_STATUS
Dec 10 12:42:55.891: EZVPN(tunnel22): xauth status received: Success

Dec 10 12:48:17.267: EZVPN(tunnel22): Received authentic disconnect credential
Dec 10 12:48:17.275: EZVPN(): Received an HTTP request: disconnect
Dec 10 12:48:17.275: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client)  User= 
  Group=tunnel22  Client_public_addr=192.168.0.13  Server_public_addr=192.168.0.1 
  Assigned_client_addr=10.3.4.5

Router# show crypto ipsec client ezvpn tunnel22
Tunnel name : tunnel22
Inside interface list: Ethernet0
Outside interface: Ethernet1
Current State: CONNECT_REQUIRED
Last Event: RESET
Save Password: Disallowed
! Note the next line.
        XAuth credentials: HTTP intercepted 
        HTTP return code : 200
        IP addr being prompted: 0.0.0.0
Current EzVPN Peer: 192.168.0.1
Router# show ip auth-proxy config
Authentication global cache time is 60 minutes
Authentication global absolute time is 0 minutes
Authentication Proxy Watch-list is disabled
Authentication Proxy Rule Configuration
! Note that the next line is the Easy VPN-defined internal rule.
    Auth-proxy name ezvpn401***
      Applied on Ethernet0 
      http list not specified inactivity-timer 60 minutes

Router# show crypto ipsec client ezvpn tunnel22
Tunnel name : tunnel22
Inside interface list: Ethernet0
Outside interface: Ethernet1
Current State: IPSEC_ACTIVE
Last Event: SOCKET_UP
Address: 10.3.4.5
Mask: 255.255.255.255
Save Password: Disallowed
        XAuth credentials: HTTP intercepted
        HTTP return code : 200
        IP addr being prompted: 192.168.0.0
Current EzVPN Peer: 192.168.0.1
Router# show ip auth-proxy config
Authentication global cache time is 60 minutes
Authentication global absolute time is 0 minutes
Authentication Proxy Watch-list is disabled
Auth-proxy name ezvpnWeb*** (EzVPN-defined internal rule)
http list not specified inactivity-timer 60 minutes

To troubleshoot a VPN connection created using the Cisco Easy VPN Remote feature, use the following suggested techniques.

• Be aware that any changes to an active Cisco Easy VPN remote configuration or IP address changes to the involved interfaces, such as adding or removing an inside interface, result in a reset of the Cisco Easy VPN Remote connection.
• Enable debugging of the Cisco Easy VPN Remote feature using the debug crypto ipsec client ezvpncommand.
• Enable debugging of IKE events using the debug crypto ipsecand debug crypto isakmpcommands.
• Display the active IPsec VPN connections using the show crypto engine connections active command.
• To reset the VPN connection, use the clear crypto ipsec client ezvpn command. If you have debugging enabled, you might prefer to use the clear crypto sa and clear crypto isakmp commands.

The following information may be used to troubleshoot the Easy VPN Remote configuration for the client mode of operation.

In client mode, the Cisco Easy VPN Remote feature automatically configures the NAT or PAT translation and access lists that are needed to implement the VPN tunnel. These configurations are automatically created when the IPsec VPN connection is initiated. When the tunnel is torn down, the NAT or PAT and access list configurations are automatically deleted.

The NAT or PAT configuration is created with the following assumptions:

• The ip nat inside command is applied to all inside interfaces, including default inside interfaces. The default inside interface is the Ethernet 0 interface (for the Cisco 806, Cisco 826, Cisco 827, Cisco 828, Cisco 831, Cisco 836, and Cisco 837 routers).
• The ip nat outside command is applied to the interface that is configured with the Cisco Easy VPN Remote configuration. On the Cisco 800 series and Cisco 1700 series routers, the outside interface is configured with the Cisco Easy VPN Remote configuration. On the Cisco 1700 series routers, Cisco 2600 series routers, Cisco 3600 series routers, and Cisco 3700 series routers, multiple outside interfaces can be configured.

Note	Configuring the ip nat inside and ip nat outsidecommands on the EasyVPN outside and inside interfaces respectively leads to undefined behavior. This configuration is considered invalid.

Tip

The NAT or PAT translation and access list configurations that are created by the Cisco Easy VPN Remote feature are not written to either the startup configuration or running configuration files. These configurations, however, can be displayed using the show ip nat statistics and show access-list commands.

To troubleshoot remote management of the VPN remote, use the show ip interface command. Using the brief keyword, you can verify that the loopback has been removed and that the interface is shown correctly.

• Examples
  

To troubleshoot dead peer detection, use the show crypto ipsec client ezvpn command.

• Examples
  

• Cisco Easy VPN Client in Client Mode (Cisco 831) Example
  
• Cisco Easy VPN Client in Client Mode (Cisco 837) Example
  
• Cisco Easy VPN Client in Client Mode (Cisco 1700 Series) Example
  

• Cisco Easy VPN Client in Network Extension Mode (Cisco 831) Example
  
• Cisco Easy VPN Client in Network Extension Mode (Cisco 837) Example
  
• Cisco Easy VPN Client in Network Extension Mode (Cisco 1700 Series) Example
  

• Virtual IPsec Interface Generic Virtual Access
  
• Virtual IPsec Interface Virtual Access Derived from Virtual Template
  
• When the Tunnel Is Down
  
• When the Tunnel Is Up