Client Connection Process
Client Connection
Process
In general terms, an Easy VPN Remote device or a VPN
Software Client version 3.x/4.x initiates a connection with a Cisco router
configured as a Easy VPN Server. During the connection establishment the
exchange includes device authentication via IKE, user authentication via IKE
Extended Authentication (Xauth), VPN policies that are pushed down to the
client, and then the IPSec SA is established.
The following is a more detailed look at the client/server session
establishment.
-
The client initiates IKE Phase One exchange. If a preshared
key is to be used for authentication, the exchange is initiated via IKE
Aggressive mode. In this case, the group name entered while configuring the
client with the web application is used to identify the group profile. If
digital certificates are used, the exchange will be via IKE Main mode and the
organizational unit field of a distinguished name will be used to identify the
appropriate group profile.
-
The client attempts to negotiate an IKE SA with the Easy VPN
Server. To reduce client configuration policies weren’t defined, so all
supported combinations of encryption and hash algorithms for authentication,
plus supported Diffie-Hellman (DH) group sizes, are proposed.The Easy VPN Server
Device accepts the first proposal received that matches its configured policies.
Assuming a policy match is achieved, device authentication is completed and user
authentication can begin.
-
If the Easy VPN Server is configured for Xauth, the server
issues a user name/ password challenge to the client. The resulting entries are
verified against using AAA supported protocols, such as TACACS+, RADIUS, or
one-time password token cards using AAA proxy. This step is particularly
important if the peer is a remote client or a remote device is configured as a
remote client.
-
The system parameters are pushed from the server to the
client. These parameters can be configured to include an IP address (required)
and the following optional information: DNS address(es), domain name, WINS
address(es), local NAT pool name, access list, split tunnel attributes, and so
forth. The access list defines the traffic to be protected through the VPN
tunnel.
-
The Easy VPN Server can use reverse route injection (RRI) to
create static routes and inject them into any dynamic routing protocols for
distribution to surrounding devices. With dynamic crypto maps, a static route is
created for each subnet or host protected by the remote peer when the peer
establishes its IPSec security association. With static crypto
maps, a static route is created for each destination using an extended
access-list rule.
-
Once all parameters are transferred to the client, IKE Phase
Two Quick mode is used to negotiate IPSec SAs to complete the
connection. cp12Cisco Easy
623 times read
|
|
|
Did you enjoy this article?
(total 0 votes)
|
Sections
Comments (0 posted)
Syndication
