Easy ip

4 subnets, 2 masks! The next line is the Easy VPN router (ezvpn2).S 10.75.2.2/32 [1/0] via 10.76.1.1! The next line is the Easy VPN router (ezvpn1).S 10.75.1.2/32 [1/0] via 10.76.1.1C 10.76.2.0/24 is directly connected, Serial2/0C 10.76.1.0/24 is directly connected, Ethernet1/0C 192.168.1.0/24 is directly connected, Ethernet0/0! The next line is the Easy VPN route (ezvpn1).S 192.168.3.0/24 [1/0] via 0.0.0.0, Virtual-Access2! The next line is the Easy VPN (ezvpn2).S* 10.0.0.0/0 [1/0] via 10.0.0.0, Virtual-Access3 The route to split tunnel "192.168.3.0/24" that points to Virtual-Access2 is added for the Easy VPN "ezvpn"" tunnel as shown in the above show output. Reactivate Primary Peer Example The following show output illustrates that the default primary peer feature has been activated. The primary default peer is 10.3.3.2. Router# show crypto ipsec client ezvpn Easy VPN Remote Phase: 6Tunnel name : ezcInside interface list: Loopback0Outside interface: Ethernet0/0 Current State: IPSEC_ACTIVEPrimary EzVPN Peer: 10.3.3.2, Last Tried: Dec 30 07:21:23.071Last Event: CONN_UPAddress: 10.7.7.1Mask: 255.255.255.255DNS Primary: 10.1.1.1NBMS/WINS Primary: 10.5.254.22Save Password: DisallowedCurrent EzVPN Peer: 10.4.4.223:52:44: %CRYPTO-6-EZVPN_CONNECTION_UP(Primary peer): User: lab, Group: hw-client-g Client_public_addr=10.4.22.103, Server_public_addr=10.4.23.112 Assigned_client_addr=10.7.7.1 Identical Addressing Support Configuration Example In the following example, a Cisco router is configured for the Identical Addressing Support feature: interface Virtual-Template1 type tunnel no ip address ip nat outside!crypto ipsec client ezvpn easy connect manual group easy key work4cisco mode network-extension peer 10.2.2.2 virtual-interface 1 nat allow nat acl 100!interface Ethernet1/0 ip address 10.0.0.1 255.255.255.0 ip nat outside crypto ipsec client ezvpn easy !interface Ethernet0/0 ip address 10.0.1.1 255.255.255.0 ip nat inside !interface Loopback0 ip address 10.1.1.1 255.255.255.252 ip nat enablecrypto ipsec client ezvpn easy inside!ip access-list 100 permit ip 10.0.0.0 0.0.0.255 any!ip nat inside source list 100 interface Loopback0 overload cTCP on an Easy VPN Client (Remote Device) Examples For configuration and troubleshooting examples, see the topic "cTCP on Cisco Easy VPN remote devices" in the cTCP on an Easy VPN Client (Remote Device) Examples. Easy VPN Server Configuration Examples This section describes basic Cisco Easy VPN server configurations that support the Cisco Easy VPN remote configurations given in the previous sections. For complete information on configuring these servers, see Easy VPN Server for Cisco

Ipsec client ezvpn easy_vpn_remote peer 192.168.0.5 group easy_vpn_remote_groupname key easy_vpn_remote_password mode client!!interface Ethernet0 ip address 10.10.10.1 255.255.255.255 no cdp enable hold-queue 32 in!interface Ethernet1 ip address dhcp no cdp enable crypto ipsec client ezvpn easy_vpn_remote!ip classlessip http server!!ip route 10.0.0.0 10.0.0.0 Ethernet1!line con 0 exec-timeout 120 0 stopbits 1line vty 0 4 exec-timeout 0 0 login local Cisco Easy VPN Client in Client Mode (Cisco 837) Example In the following example, a Cisco 837 router is configured as an Easy VPN remote using the Cisco Easy VPN Remote feature in the client mode of operation. This example shows the following components of the Cisco Easy VPN remote configuration: PPPoE configuration--The ATM 0 interface is configured to support PPPoE connections over the Dialer 1 virtual interface. Because the interfaces use PPPoE, a DHCP IP address pool is not required to provide IP addresses to the connected PCs. Cisco Easy VPN Remote configuration--The first crypto ipsec client ezvpn command (global configuration mode) creates a Cisco Easy VPN remote configuration named "easy vpn remote." This configuration specifies the group name "easy vpn remote-groupname" and the shared key value of "easy vpn remote-password," and it sets the peer destination to the IP address 10.0.0.5 (which is the address assigned to the interface connected to the Internet on the destination peer router). The Cisco Easy VPN remote configuration is configured for the default client mode. Note If DNS is also configured on the router, the peer keyword option also supports a hostname instead of an IP address. The second crypto ipsec client ezvpn command (interface configuration mode) assigns the Cisco Easy VPN remote configuration to the Dialer 1 interface so that all traffic received and transmitted on that interface is sent through the VPN tunnel. version 12.2no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname c827!!mmi polling-interval 60no mmi auto-configureno mmi pvcmmi snmp-timeout 180ip subnet-zero!ip ssh time-out 120ip ssh authentication-retries 3vpdn enable!vpdn-group pppoe request-dialin protocol pppoe ip mtu adjust!!!crypto ipsec client ezvpn easy_vpn_remote group easy_vpn_remote_groupname key easy_vpn_remote_password mode client peer 10.0.0.5!!!interface Ethernet0 ip address 10.0.0.117 255.0.0.0 hold-queue 100 out!interface ATM0 no ip address

837 router is configured as an Easy VPN remote using the Cisco Easy VPN Remote feature in client mode. This example shows the following components of the Cisco Easy VPN remote configuration: PPPoE configuration--The ATM 0 interface is configured to support PPPoE connections over the Dialer 1 virtual interface. Because the interfaces use PPPoE, a DHCP IP address pool is not required to provide IP addresses to the connected PCs. The Ethernet 0 interface is assigned an address in the network address space of the Cisco IOS Easy VPN server. The ip route command directs all traffic for this network space from the Dialer 1 interface to the destination server. Cisco Easy VPN Remote configuration--The first crypto ipsec client ezvpn command (global configuration mode) creates a Cisco Easy VPN remote configuration named "easy vpn remote." This configuration specifies the group name "easy vpn remote-groupname" and the shared key value "easy vpn remote-password," and it sets the peer destination to the IP address 10.0.0.5 (which is the address assigned to the interface connected to the Internet on the destination peer router). The Cisco Easy VPN remote configuration is configured for the default network extension mode. Note If DNS is also configured on the router, the peer keyword option also supports a hostname instead of an IP address. The second crypto ipsec client ezvpn command (interface configuration mode) assigns the Cisco Easy VPN remote configuration to the Dialer1 interface so that all traffic that is received and transmitted on that interface is sent through the VPN tunnel. version 12.2no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname c827!!mmi polling-interval 60no mmi auto-configureno mmi pvcmmi snmp-timeout 180ip subnet-zero!ip ssh time-out 120ip ssh authentication-retries 3vpdn enable!vpdn-group pppoe request-dialin protocol pppoe ip mtu adjust!!crypto ipsec client ezvpn easy_vpn_remote group easy_vpn_remote_groupname key easy_vpn_remote_password mode network-extension peer 10.0.0.5!!interface Ethernet0 ip address 172.16.0.30 255.255.255.192 hold-queue 100 out!interface ATM0 no ip address no atm ilmi-keepalive pvc 1/40 pppoe-client dial-pool-number 1 ! dsl operating-mode auto!interface Dialer1 ip address 10.0.0.3 255.0.0.0 ip mtu 1492 encapsulation ppp dialer pool 1 crypto ipsec client ezvpn easy_vpn_remote!ip classlessip route 172.16.0.0 255.255.255.128 Dialer1ip

Commands for network-extension mode ip route 172.16.1.0 255.255.255.248 cable-modem0 no ip http serverno ip http cable-monitor!snmp-server manager!line con 0 exec-timeout 0 0line vty 0 4!scheduler max-task-time 5000 Cisco Easy VPN Server Configuration with Split Tunneling Example The following example shows a Cisco Easy VPN server that is configured for a split tunneling configuration with a Cisco Easy VPN remote. This example is identical to that shown in the "Cisco Easy VPN Server Without Split Tunneling Example" except for access list 150, which is assigned as part of the crypto isakmp client configuration groupcommand. This access list allows the Cisco Easy VPN remote to use the server to access one additional subnet that is not part of the VPN tunnel without compromising the security of the IPsec connection. To support network extension mode, the ip route command instructs that incoming packets for the 172.168.0.0 network be directed from the cable modem interface to the Cisco Easy VPN remote. Other ip route commands might be necessary, depending on the topology of your network. Note This example shows a Cisco uBR925 cable access router, but typically the destination Easy VPN remote will be a router, such as a VPN 3000 concentrator or a Cisco IOS router, that supports the Easy VPN Server feature. version 12.2no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice internal!hostname uBR925Server!aaa new-model!!aaa authorization network easy vpn remote-groupname local aaa session-id common!!clock timezone - 0 6ip subnet-zero!ip ssh time-out 120ip ssh authentication-retries 3!crypto isakmp policy 1 authentication pre-share group 2crypto isakmp client configuration address-pool local dynpool!crypto isakmp client configuration group easy vpn remote-groupname key easy vpn remote-password dns 172.16.0.250 172.16.0.251 wins 172.16.0.252 172.16.0.253 domain cisco.com pool dynpool acl 150 !!crypto ipsec transform-set transform-1 esp-des esp-sha-hmac !crypto dynamic-map dynmap 1 set transform-set transform-1 reverse-route!!crypto map dynmap isakmp authorization list easy vpn remote-groupnamecrypto map dynmap client configuration address respondcrypto map dynmap 1 ipsec-isakmp dynamic dynmap !!interface Ethernet0 ip address 172.16.0.129 255.255.255.255!interface cable-modem0 no cable-modem compliant bridge crypto map dynmap!interface usb0 no ip address arp timeout 0!ip local pool dynpool 172.16.0.65 172.16.0.127 ip classless! Add the appropriate ip route commands for

(Cisco 1700 Series) Example Cisco Easy VPN Client in Network Extension Mode (Cisco 831) Example In the following example, a Cisco 831 router is configured as an Easy VPN remote using the Cisco Easy VPN Remote feature. This example shows the following components of the Cisco Easy VPN remote configuration: The Ethernet 0 interface is assigned an address in the network address space of the Cisco IOS Easy VPN server. The ip route command directs all traffic for this network space from the Ethernet 1 interface to the destination server. Cisco Easy VPN Remote configuration--The first crypto ipsec client ezvpn command (global configuration mode) creates a Cisco Easy VPN remote configuration named "easy vpn remote." This configuration specifies the group name "easy vpn remote-groupname" and the shared key value "easy vpn remote-password," and it sets the peer destination to the IP address 192.185.0.5 (which is the address assigned to the interface connected to the Internet on the destination peer router). The Cisco Easy VPN remote configuration is configured for network extension mode. Note If DNS is also configured on the router, the peer keyword option also supports a hostname instead of an IP address. The second crypto ipsec client ezvpn command (interface configuration mode) assigns the Cisco Easy VPN Remote configuration to the Ethernet 1 interface so that all traffic that is received and transmitted on that interface is sent through the VPN tunnel. ! Cisco Router Web Setup Template!no service padno service tcp-small-serversno service udp-small-serversservice timestamps debug uptimeservice timestamps log uptimeservice password-encryption!hostname Router!!ip subnet-zeroip domain-lookup!!ip dhcp excluded-address 172.31.1.1 !ip dhcp pool localpool import all network 172.31.1.0 255.255.255.255 default-router 172.31.1.1 lease 1 0 0 !!crypto ipsec client ezvpn easy_vpn_remote peer 192.168.0.5 group easy_vpn_remote_groupname key easy_vpn_remote_password mode network-extension !!interface Ethernet0 ip address 172.31.1.1 255.255.255.255 no cdp enable hold-queue 32 in!interface Ethernet1 ip address dhcp no cdp enable crypto ipsec client ezvpn easy_vpn_remote!ip classlessip route 172.31.0.0 255.255.255.255 Ethernet1ip http server!!line con 0 exec-timeout 120 0 stopbits 1line vty 0 4 exec-timeout 0 0 login local Cisco Easy VPN Client in Network Extension Mode (Cisco 837) Example In the following example, a Cisco

No atm ilmi-keepalive pvc 1/40 pppoe-client dial-pool-number 1 ! dsl operating-mode auto!interface Dialer1 ip address 10.0.0.3 255.0.0.0 ip mtu 1492 encapsulation ppp dialer pool 1 crypto ipsec client ezvpn easy_vpn_remote!ip classlessip route 0.0.0.0 0.0.0.0 ATM0ip route 0.0.0.0 0.0.0.0 Dialer1 permanentip route 10.0.0.0 255.0.0.0 10.0.0.13ip http serverip pim bidir-enable!line con 0 stopbits 1line vty 0 4 login!scheduler max-task-time 5000end Cisco Easy VPN Client in Client Mode (Cisco 1700 Series) Example In the following example, a Cisco 1753 router is configured as an Easy VPN remote using the Cisco Easy VPN Remote feature in the client mode of operation. This example shows a running configuration of a Cisco 1753 that has two inside interfaces and one outside interface on one tunnel. The connect auto command manually establishes the IPsec VPN tunnel. Router# show running-configBuilding configuration...Current configuration : 881 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname mma-1753 ! ! memory-size iomem 15 ip subnet-zero !! ! ip ssh time-out 120 ip ssh authentication-retries 3 ! ! ! crypto ipsec client ezvpn easy_vpn_remote connect auto group ezvpn key ezvpn mode client peer 10.6.6.1 ! ! ! interface FastEthernet0/0 ip address 10.4.4.2 255.255.255.0 speed auto crypto ipsec client ezvpn easy_vpn_remote inside ! interface Serial0/0 ip address 10.6.6.2 255.255.255.0 no fair-queue crypto ipsec client ezvpn easy_vpn_remote! interface Serial1/0 ip address 10.5.5.2 255.255.255.0 clock rate 4000000 crypto ipsec client ezvpn easy_vpn_remote inside ! ip classless no ip http server ip pim bidir-enable ! ! ! line con 0 line aux 0 line vty 0 4 login ! end The following example shows a running configuration of a Cisco 1760 router that has two active, automatically connected tunnels, easy vpn remote1 and easy vpn remote2. Tunnel easy vpn remote1 has two configured inside interfaces and one configured outside interface. Tunnel easy vpn remote2 has one configured inside interface and one configured outside interface. The example also shows the output for the show crypto ipsec client ezvpn command that lists the tunnel names and the outside and inside interfaces. Router# show running-configBuilding configuration...Current configuration : 1246 bytes ! version