SSL VPNs use a methodology to transport private data across the public Internet. Instead of relying upon the end user to have a configured client on an agency-managed computer, SSL VPNs use SSL /HTTPS which is the secure transport mechanism built-in to all standard Web browsers. Using an SSL VPN, the connection between the user and the internal resource occurs via an HTTPS connection at the application-layer.

I have completed all the Cisco SSL labs on Dynamips 7200 simulator, the topology is as follow:

The Dynagen configuration is as follow:

autostart = false [localhost] port = 7200 udp = 10000 workingdir = ..\Temp\ [[router R1]] image = ..\IOS\c7200-advsecurityk9-mz.124-9.T1.bin model = 7200 console = 3001 npe = npe-400 ram = 128 confreg = 0×2142 exec_area = 64 slot0 = PA-C7200-IO-FE slot1 = PA-FE-TX f0/0 = SW1 1 f1/0 = SW1 2 [[ethsw SW1]] 1 = dot1q 1 2 = dot1q 1 3 = access 1 NIO_gen_eth:\Device\NPF_{E4377B71-C2A8-40A9-9FB6-639EE19D2F75}

1. Preparing for Cisco Web VPN.
c7206(config)# int fa0/0

c7206(config-if)# ip add 198.1.1.1 255.255.255.0

c7206(config-if)# no shutdown

c7206(config-if)# exit

!

c7206(config)# int fa1/0

c7206(config-if)# ip add 10.10.1.1 255.255.255.0

c7206(config-if)# no shutdown

c7206(config-if)# exit

!

c7206(config)# aaa new-model

c7206(config)# aaa authentication login default local

!define the default aaa authentication list, allow the administrator to login this router, this configuration is foreign to the Web VPN.
!

c7206(config)# aaa authentication login aaa-webvpn local

c7206(config)# username steve6307 password cisco

!define the WebVPN authentication list.
!

c7206(config)# webvpn gateway mygateway

c7206(config-webvpn-gateway)# ip address 198.1.1.1 port 443

c7206(config-webvpn-gateway)# inservice

!define the WebVPN gateway address and port, usually the port is 443.
!

c7206(config)# webvpn context mywebvpn-context1

c7206(config-webvpn-context)# gateway mygateway domain group1

c7206(config-webvpn-co
ntext)# aaa authentication list aaa-webvpn

c7206(config-webvpn-context)# inservice

!define a WebVPN context. You must select a gateway and a aaa authentication list for each context. The domain name is very important to the configuration, because the end user will select the context by this domain name in the future.
2. Basic feature test(Web browsing).
I used Firefox to test the WebVPN feature. I entered “https://198.1.1.1/group1″ in the address bar, and then I saw the WebVPN home page.

Note: the url format is https://webvpn_gateway_addr/context_domain_name

I entered my username and password in the dialog box, and then click “Login”.

Now I have successfully logon the webvpn!

I entered the Internal Server IP address in the URL page, and then I accessed the internal server web page successfully.

3. WebVPN extended services.
Now, let’s talk about how to configure the webvpn extended services:

1. File-access feature.

2. Custom the url-list.

3. Port-forward feature.

3.1. File-access feature
The file-access feature can provide browsing and file access of files on the windows file server (NetBIOS name service server).

To use the file access-feature, the user must have “file-access file-entry file-browsing” privilege.

c7206(config)# webvpn context mywebvpn-context1

c7206(config-webvpn-nbnslist)# nbns-server 10.10.1.2

c7206(config-webvpn-nbnslist)# exit

!You must define the NetBIOS name server for IOS WebVPN. In fact, this is optional if you use the ip address to access the file server in the future.
!

c7206(config-webvpn-context)# policy group context1-policy

c7206(config-webvpn-group)# functions file-access

c7206(config-webvpn-group)# functions file-browse

c7206(config-webvpn-group)# functions file-entry

c7206(config-webvpn-group)# exit

!define the group policy for this context, assign the “file-access file-entry file-browsing” privilege.
!

c7206(config-webvpn-context)# default-group-policy context1-policy

!assign the group policy as default policy.
Feature test:
Login WebVPN again, I saw the page as follow:

I entered “\\10.10.1.2″ as the network path, and then the browser prompted me to enter my username and password to access the resources of my file server:

3.2. Custom the url-list
c7206(config-webvpn-context)# url-list myurl

c7206(config-webvpn-url)#url-text “Home Page” url-value http://10.10.1.2

c7206(config-webvpn-url)#url-text “Site2″url-value http://10.10.1.3

!

c7206(config-webvpn-context)#policy group context1-policy

c7206(config-webvpn-group)#url-list myurl

Feature test:
Login WebVPN again, I saw the page as follow:

3.3. Port-forward
Port-forward feature provides access for remote end users to client and server applications that communicate over known, fixed TCP ports. Each internal server and port number that the user can have access to has to be configured on the gateway. The entries specify the local port number and the destination server name and port number to use for TCP port forwarding.

c7206(config-webvpn-context)# port-forward myport

c7206(config-webvpn-port-fwd)# local-port 2323 remote-server 10.10.1.2 remote-port 23 description test

c7206(config-webvpn-port-fwd)# exit

!

c7206(config-webvpn-context)# policy group context1-policy

c7206(config-webvpn-group)# port-forward myport

!when I login the WebVPN, the browser load the JAVA App, and then I can telnet the internal server via telnet localhost 2323 port.

Feature test:
Login WebVPN again, I saw the page as follow:

Click “Application Access”, and then the browser can load the java app.

Flickr : cisco exam, cisco simulator, cisco training, dynagen, dynamips, vpn

Related Posts

• dynamips lab:Cisco IOS Easy VPN Server & Remote on Dynamips (0)
• Cisco IOS site2site ipsec vpn on dynamips (2)
• dynamips lab:Cisco IOS l2tp voluntary tunnel mode on dynamips (0)
• dynamips lab:Cisco high availability IPSec VPN on dynamips(loopback address) (1)
• dynamips lab:Cisco ADSL PPPOE on dynamips (1)
• dynamips lab:Cisco ADSL PPPOA on dynamipsI have completed this lab on Dynamips 7200 (3)
• dynamips lab:ccnp lab for dynamips (1)
• dynamips lab:Cisco L2TP over IPSec With windows client (2)
• dynamips lab:Cisco ios ssl vpn on dynamips test note2 (2)
• ccie##IPexpert_Security4_WB_SAMPLE (1)

I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

The Dynagen configuration is as follow:

1. Easy VPN Server Configuration (R2).
server(config)# username steve password cisco!define the username and password for XAUTH, we can also use CISCO ACS to store the user information.
server(config)#aaa new-modelserver(config)#aaa authentication login default local

!define the default aaa authentication list, allow the administrator to login this router, this configuration is foreign to the ezvpn.

server(config)#aaa authentication login ezvpn-authentication local!define xauth authentication list.
server(config)#aaa authorization network ezvpn-authorization local!define the authorization list.server(config)#ip local pool ezvpn-pool 192.168.1.1 192.168.1.254server(config)#crypto isakmp policy 10server(config-isakmp)#authentication pre-shareserver(config-isakmp)#encryption 3des

server(config-isakmp)#hash sha

server(config-isakmp)#group 2

server(config-isakmp)#exit

server(config)#access-list 101 permit ip 10.10.1.0 0.0.0.255 any!define the split tunnel list, pay attention, the destination address is always “any”, and the source address is the network address of inside network.server(config)#crypto isakmp client configuration group myezvpnserver(config-isakmp-group)#key cisco1234server(config-isakmp-group)#dns 10.8.1.10

server(config-isakmp-group)#domain njut.edu.cn

server(config-isakmp-group)#pool ezvpn-pool

server(config-isakmp-group)#acl 101

!the acl is split tunnel acl.
server(config-isakmp-group)#save-password!allow the client save xauth password locally.
server(config-isakmp-group)#exitserver(config)#crypto ipsec transform-set ccsp esp-3des esp-sha-hmac server(cfg-crypto-trans)#mode tunnelserver(cfg-crypto-trans)#exit

server(config)#crypto dynamic-map ezvpn-dynamic-map 10 server(config-crypto-map)#set transform-set ccspserver(config-crypto-map)#reverse-route

server(config)#crypto map cisco client authentication list ezvpn-authentication!choose the xauth authentication list.server(config)#crypto map cisco isakmp authorization list ezvpn-authorization!choose the authorization list.
server(config)#crypto map cisco client configuration address respond!respond the client address request.server(config)#crypto map cisco 10 ipsec-isakmp dynamic ezvpn-dynamic-mapserver(config)#int s1/0server(config-if)#ip address 173.16.1.5 255.255.255.252server(config-if)#crypto map cisco

server(config)#int fa0/0server(config-if)#ip address 10.10.1.1 255.255.255.0server(config)#ip route 0.0.0.0 0.0.0.0 173.16.1.62. Easy VPN Remote Configuration (R1).
remote(config)#crypto ipsec client ezvpn newlabremote(config-crypto-ezvpn)#connect auto

remote(config-crypto-ezvpn)#group myezvpn key cisco1234

remote(config-crypto-ezvpn)#mode client

remote(config-crypto-ezvpn)#peer 173.16.1.5

remote(config-crypto-ezvpn)#username steve password cisco

!if you didn’t open save-password option on the ezvpn server, you should issue “crypto ipsec client ezvpn xauth” command to complete xauth.
!

remote(config)#interface FastEthernet0/0

remote(config-if)#ip address 10.30.1.1 255.255.255.0

remote(config-if)#crypto ipsec client ezvpn newlab inside!

remote(config)#interface Serial1/1

remote(config-if)#ip address 173.16.1.1 255.255.255.252

remote(config-if)#crypto ipsec client ezvpn newlab outside

3. Use the Cisco VPN Client Software to connect to Easy VPN Server.
The easy vpn server can also be connected by the Cisco VPN Client Software, you can download the software from cco site.

Flickr : cisco, cisco exam, cisco simulator, cisco training, dynagen, dynamips, vpn

Related Posts

• dynamips lab:Cisco IOS SSL VPN on dynamips test note (2)
• dynamips lab:Cisco IOS l2tp voluntary tunnel mode on dynamips (0)
• dynamips lab:Cisco ADSL PPPOA on dynamipsI have completed this lab on Dynamips 7200 (3)
• Cisco IOS site2site ipsec vpn on dynamips (2)
• dynamips lab:Cisco high availability IPSec VPN on dynamips(loopback address) (1)
• dynamips lab:Cisco ADSL PPPOE on dynamips (1)
• dynamips lab:ccnp lab for dynamips (1)
• ccie##IPexpert_Security4_WB_SAMPLE (1)
• dynamips lab:CCIE Security Home Lab with dynamips (0)
• dynamips lab:CCIE Practice LAB Dynamips (0)