
at the central site. Resources at the client site are unavailable to the central site. Network extension mode
allows users at the central site to access network resources on the client site.
After the IPSec server has been configured, a VPN connection can be created with minimal configuration on
an IPSec client, such as a supported Cisco 819, Cisco 860, and Cisco 880 series ISRs. When the IPSec client
initiates the VPN tunnel connection, the IPSec server pushes the IPSec policies to the IPSec client and creates
the corresponding VPN tunnel connection.
The Cisco Easy VPN client feature supports configuration of only one destination peer. If your application
requires creation of multiple VPN tunnels, you must manually configure the IPSec VPN and Network
Address Translation/Peer Address Translation (NAT/PAT) parameters on both the client and the server.
Note
Configuration Tasks
Perform the following tasks to configure your router for this network scenario:
•
Configuring the IKE Policy, on page 339
•
Configuring Group Policy Information, on page 341
•
Applying Mode Configuration to the Crypto Map, on page 342
•
Enabling Policy Lookup, on page 343
•
Configuring IPSec Transforms and Protocols, on page 344
•
Configuring the IPSec Crypto Method and Parameters, on page 345
•
Applying the Crypto Map to the Physical Interface, on page 346
•
Creating an Easy VPN Remote Configuration , on page 347
An example showing the results of these configuration tasks is provided in the Configuration Examples for
VPN and IPSec, on page 349.
The procedures in this chapter assume that you have already configured basic router features as well as
PPPoE or PPPoA with NAT, DCHP and VLANs. If you have not performed these configurations tasks,
see Basic Router Configuration, Configuring PPP over Ethernet with NAT,Configuring PPP over ATM
with NAT, and Configuring a LAN with DHCP and VLANs, on page 329 as appropriate for your router.
Note
The examples shown in this chapter refer only to the endpoint configuration on the Cisco 819, 860 and
880 series routers. Any VPN connection requires both endpoints to be configured properly to function.
See the software configuration documentation as needed to configure the VPN for other router models.
Note
Configuring the IKE Policy
To configure the Internet Key Exchange (IKE) policy, perform these steps, beginning in global configuration
mode:
Cisco 800 Series Integrated Services Routers Software Configuration Guide
OL-31704-02 339
Configuring a VPN Using Easy VPN and an IPSec Tunnel
Configuring the IKE Policy
Comments to this Manuals