Cisco CVPN3002-8E-K9 - Fast Ethernet VPN Gateway User manual

170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Cisco Systems, Inc.
Corporate Headquarters
Tel:
800 553-NETS (6387)
408 526-4000
Fax: [phone]
VPN 3002 Hardware Client
User Guide
Release 3.0
March 2001
Customer Order Number: OL-0874-=
Text Part Number: OL-0874-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE
PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR
APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cis o implementation of TCP header ompression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of
UCB’s publi domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED
“AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED,
INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
A essPath, AtmDire tor, Browse with Me, CCDA, CCDE, CCDP, CCIE, CCNA, CCNP, CCSI, CD-PAC, CiscoLink, the Cis o NetWorks logo, the Cis o
Powered Network logo, Cis o Systems Networking A ademy, the Cis o Systems Networking A ademy logo, Dis over AA That’s Possible, Fast Step,
Follow Me Browsing, FormShare, FrameShare, GigaSta k, IGX, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTra k, the iQ Logo, iQ
Net Readiness S ore ard, MGX, the Networkers logo, Packet, PIX, RateMUX, S riptBuilder, S riptShare, SlideCast, SMARTnet, TransPath, Voi e LAN,
Wavelength Router, WebViewer are trademarks of Cis o Systems, In .; Changing the Way We Work, Live, Play, and Learn, Empowering the Internet
Generation, are servi e marks of Cis o Systems, In .; and Aironet, ASIST, BPX, Catalyst, Cis o, the Cis o Certified Internetwork Expert logo, Cis o IOS,
the Cis o IOS logo, Cis o Systems, Cis o Systems Capital, the Cis o Systems logo, Enterprise/Solver, EtherChannel, EtherSwit h, FastHub, FastSwit h,
IOS, IP/TV, LightStream, MICA, Network Registrar, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, Swit hProbe, TeleRouter, and VCO
are registered trademarks of Cis o Systems, In . or its affiliates in the U.S. and ertain other ountries.
All other brands, names, or trademarks mentioned in this do ument or Web site are the property of their respe tive owners. The use of the word partner
does not imply a partnership relationship between Cis o and any other ompany. (0011R)
VPN 3002 Hardware Client User Guide
Copyright © 2001, Cis o Systems, In .
All rights reserved.

iii
VPN 3002 Hardware Client User Guide
CONTENTS
Table of contents
Table of contents
Preface
About this manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Additional documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii
Documentation on VPN software distribution CDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Obtaining documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Obtaining technical assistance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Other references . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Documentation conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Data formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
1 Using the VPN 3002 Hardware Client Manager
Browser requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
Recommended PC monitor / display settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Connecting to the VPN 3002 using HTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Installing the SSL certificate in your browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Connecting to the VPN 3002 using HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Logging in the VPN 3002 Hardware Client Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17
Configuring HTTP, HTTPS, and SSL parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-18
Understanding the VPN 3002 Hardware Client Manager window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19
Organization of the VPN 3002 Hardware Client Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-22
Navigating the VPN 3002 Hardware Client Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-23
2 Configuration
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
3 Interfaces
Configuration | Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Configuration | Interfaces | Private . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Configuration | Interfaces | Public . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5
4 System Configuration
Configuration | System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1

Contents—Table of contents
iv VPN 3002 Hardware Client User Guide
5Servers
Configuration | System | Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
Configuration | System | Servers | DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
6 Tunneling
Configuration | System | Tunneling Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
Configuration | System | Tunneling Protocols | IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
7IPRouting
Configuration | System | IP Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1
Configuration | System | IP Routing | Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2
Configuration | System | IP Routing | Static Routes |
Add or Modify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3
Configuration | System | IP Routing | Default Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-4
Configuration | System | IP Routing | DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5
Configuration | System | IP Routing | DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-7
Configuration | System | IP Routing | DHCP Options |
Add or Modify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8
8 Management Protocols
Configuration | System | Management Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1
Configuration | System | Management Protocols | HTTP/HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2
Configuration | System | Management Protocols | Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-4
Configuration | System | Management Protocols | SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-5
Configuration | System | Management Protocols |
SNMP Communities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-7
Configuration | System | Management Protocols | SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-9
Configuration | System | Management Protocols | SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12
9 Events
Event class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1
Event severity level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4
Event log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5
Configuration | System | Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-6
Configuration | System | Events | General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-6
Configuration | System | Events | Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-8
Configuration | System | Events | Classes | Add or Modify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9
Configuration | System | Events | Trap Destinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-11
Configuration | System | Events | Trap Destinations |
Add or Modify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-12
Configuration | System | Events | Syslog Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-13

Contents—Table of contents
v
VPN 3002 Hardware Client User Guide
Configuration | System | Events | Syslog Servers | Add or Modify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-15
10 General
Configuration | System | General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1
Configuration | System | General | Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2
Configuration | System | General | Time and Date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3
11 Policy Management
Client mode/PAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1
Network Extension mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-2
Configuration | Policy Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3
Configuration | Policy Management | Traffic Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3
Configuration | Policy Management | Traffic
Management | PAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4
Configuration | Policy Management | Traffic Management |
PAT | Enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4
12 Administration
Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-1
Administration | Software Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-2
Administration | System Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-5
Administration | Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-7
Administration | Access Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-8
Administration | Access Rights | Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-9
Administration | Access Rights | Access Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-10
Administration | File Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-11
Administration | File Management | View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-12
Administration | File Management | Swap Config Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-13
Administration | File Management | Config File Upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-13
Administration | Certificate Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-15
Administration | Certificate Management | Enrollment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-17
Administration | Certificate Management | Enrollment |
Request Generated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-20
Administration | Certificate Management | Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-21
Administration | Certificate Management | Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-23
Administration | Certificate Management | Certificates | View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-24
Administration | Certificate Management | Certificates | Delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-27
13 Monitoring
Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-1
Monitoring | Routing Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-2

Contents—Table of contents
vi VPN 3002 Hardware Client User Guide
Monitoring | Filterable Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-3
Monitoring | Live Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-8
Monitoring | System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-9
Monitoring | System Status | Private/Public Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-12
Monitoring | Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-14
Monitoring | Statistics | IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-15
Monitoring | Statistics | HTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-21
Monitoring | Statistics | Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-22
Monitoring | Statistics | DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-23
Monitoring | Statistics | SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-24
Monitoring | Statistics | DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-26
Monitoring | Statistics | SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-27
Monitoring | Statistics | MIB-II . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-28
Monitoring | Statistics | MIB-II | Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-28
Monitoring | Statistics | MIB-II | TCP/UDP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-30
Monitoring | Statistics | MIB-II | IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-32
Monitoring | Statistics | MIB-II | ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-35
Monitoring | Statistics | MIB-II | ARP Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-37
Monitoring | Statistics | MIB-II | Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-39
Monitoring | Statistics | MIB-II | SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-41
14 Using the Command Line Interface
Accessing the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-1
Starting the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-2
Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-3
CLI menu reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-7
A Errors and troubleshooting
Files for troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1
LED indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Errors on the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3
Settings on the VPN 3000 Series Concentrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4
VPN 3002 Hardware Client Manager errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-5
Command Line Interface errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-10
B Copyrights, licenses, and notices
Software License Agreement of Cisco Systems, Inc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1
Other licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-3
Regulatory Standards Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-9

Index

Contents—Table of contents
viii VPN 3002 Hardware Client User Guide

Contents
ix
VPN 3002 Hardware Client User Guide
Tables
Table 9-1: VPN 3002 event classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1
Table 9-2: VPN 3002 event severity levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-4
Table 9-3: Configuring “well-known”SNMP traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-7

xi
VPN 3002 Hardware Client User Guide
Preface
About this manual
The VPN 3002 Hardware Client User Guide provides guidelines for onfiguring the Cis o VPN 3002,
details on all the fun tions available in the VPN 3002 Hardware Client Manager, and instru tions for
using the VPN 3002 Command Line Interfa e.
Prerequisites
We assume you have read the VPN 3002 Hardware Client Getting Started manual and have followed the
minimal onfiguration steps in Qui k Configuration. That se tion of the VPN Hardware Client Manager
is not des ribed here.
We also assume you are an experien ed system administrator or network administrator with appropriate
edu ation and training, who knows how to install, onfigure, and manage internetworking systems.
However, virtual private networks and VPN devi es may be new to you. You should be familiar with
Windows® 95/98 or Windows NT® system onfiguration and management, and you should be familiar
with Mi rosoft Internet Explorer or Nets ape® Navigator® or Communi ator browsers.
Organization
This manual is organized by the order in whi h se tions appear in the VPN 3002 Hardware Client
Manager table of ontents (the left frame of the Manager browser window; see Figure 1-30 in Chapter 1.
Chapter 1, Using the VPN 3002 Hardware Client Manager explains how to log in, navigate, and use the
VPN 3002 Hardware Client Manager with a browser. It explains both HTTP and HTTPS browser
onne tions, and how to install the SSL ertifi ate for a se ure (HTTPS) onne tion.
Chapter 2, Con iguration des ribes the main VPN 3002 Hardware Client Manager onfiguration s reen.
Chapter 3, Inter aces explains how to onfigure the VPN 3002 Private and Publi interfa es.
Chapter 4, System Con iguration des ribes the system onfiguration s reen of the VPN 3002 Hardware
Client Manager.
Chapter 5, Servers explains how to onfigure the VPN 3002 to ommuni ate with DNS servers to
onvert hostnames to IP addresses (DNS).
Chapter 6, Tunneling explains how to onfigure IPSe .

Preface
xii VPN 3002 Hardware Client User Guide
Chapter 7, IP Routing explains how to onfigure stati routes, default gateways, and DHCP parameters
and options.
Chapter 8, Management Protocols explains how to onfigure built-in VPN 3002 servers that provide
management fun tions:, HTTP and HTTPS, Telnet, SNMP, SNMP Community Strings, SSL and SSH.
Chapter 9, Events explains how to onfigure system events su h as alarms, traps, error onditions,
network problems, task ompletion, or status hanges.
Chapter 10, General explains how to onfigure the system identifi ation, date, and time.
Chapter 11, Policy Management explains how to onfigure PAT and use LAN Extension mode.
Chapter 12, Administration explains how to onfigure and use high-level VPN 3002 administrator
a tivities su h as who is allowed to onfigure the system, what software runs on it, rebooting and
shutting down the system, managing its onfiguration files, and managing X.509 digital ertifi ates.
Chapter 13, Monitoring explains the many status, statisti s, sessions, and event log s reens that you an
use to monitor the VPN 3002.
Chapter 14, Using the Command Line Inter ace explains how to use the built-in menu- and
ommand-line-based administrative management system via the system onsole or a Telnet session.
With the CLI, you an a ess and onfigure all the same parameters as the HTML-based VPN 3002
Hardware Client Manager.
Appendix A, Errors and troubleshooting des ribes ommon errors that may o ur while onfiguring the
system, and how to orre t them. It also des ribes all system and module LED indi ators.
Appendix B, Copyrights, licenses, and notices provides all opyright and li ense information for Cis o
software on the VPN 3002, and for software that the system uses under li ense from other firms.
Additional documentation
The VPN 3002 Hardware Client Getting Started manual provides information to take you from
unpa king and installing the VPN 3002, through onfiguring the minimal parameters to make it
operational ( alled Qui k Configuration). This manual is online only.
The VPN 3002 Hardware Client Manager also in ludes extensive ontext-sensitive online help that you
an a ess by li king the Help i on on the toolbar in the Manager window.
The VPN 3002 Hardware Client Quick Re erence Card summarizes information for Qui k
Configuration. This qui k referen e ard is provided with the VPN 3002, and is also available online.
The VPN 3002 Hardware Client Basic In ormation sti ky label summarizes information for installing
the VPN 3002 and beginning onfiguration. It is provided with the VPN 3002 and you an also print it
from the online version; you an afix the label to the VPN 3002 if you want.
The VPN 3000 Concentrator Series Getting Started manual provides information to take you from
unpa king and installing the VPN 3000, through onfiguring the minimal parameters to make it
operational ( alled Qui k Configuration).
The VPN 3000 Concentrator Series User Guide provides details on all the fun tions available in the
VPN Con entrator Manager, and guidelines for onfiguring the VPN 3000 Con entrator.
The VPN Client User Guide explains how to install, onfigure, and use the VPN Client, whi h lets a
remote lient use the IPSe tunneling proto ol for se ure onne tion to a private network through the
VPN 3000 Con entrator.
The VPN Client Administrator Guide tells how to onfigure a VPN 3000 Con entrator for remote user
onne tions via the VPN Client, how to automate remote user profiles, how to use the VPN Client
ommand line interfa e, and how to get troubleshooting information.

Documentation on VPN software distribution CDs
xiii
VPN 3002 Hardware Client User Guide
Documentation on VPN software distribution CDs
The VPN 3000 Con entrator and VPN 3002 Hardware Client do umentation is provided on the VPN
3000 Con entrator software distribution CD-ROM in PDF format. The VPN Client do umentation is
in luded on the VPN Client software distribution CD-ROM, also in PDF format. To view the latest
versions on the Cis o Web site, li k the Support i on on the toolbar at the top of the VPN Con entrator,
Manager, Hardware Client Manager or Client window. To open the do umentation, you need Adobe®
A robat® Reader 3.0 or later; version 4.5 is in luded on the Cis o VPN 3000 Con entrator software
distribution CD-ROM.
Obtaining documentation
The following se tions provide sour es for obtaining do umentation from Cis o Systems.
World Wide Web
You an a ess the most urrent Cis o do umentation on the World Wide Web at the following sites:
• http://www. is o. om
• http://www- hina. is o. om
• http://www-europe. is o. om
Documentation CD-ROM
Cis o do umentation and additional literature are available in a CD-ROM pa kage, whi h ships
with your produ t. The Do umentation CD-ROM is updated monthly and may be more urrent than
printed do umentation. The CD-ROM pa kage is available as a single unit or as an annual subs ription.
Ordering documentation
Cis o do umentation is available in the following ways:
• Registered Cis o Dire t Customers an order Cis o Produ t do umentation from the Networking
Produ ts MarketPla e:
http://www. is o. om/ gi-bin/order/order_root.pl
• Registered Cis o. om users an order the Do umentation CD-ROM through the online Subs ription
Store:
http://www. is o. om/go/subs ription
• Nonregistered Cis o. om users an order do umentation through a lo al a ount representative by
alling Cis o orporate headquarters (California, USA) at 408 526-7208 or, in North Ameri a, by
alling 800 553-NETS(6387).

Preface
xiv VPN 3002 Hardware Client User Guide
Documentation feedback
If you are reading Cis o produ t do umentation on the World Wide Web, you an submit te hni al
omments ele troni ally. Cli k Feedback in the toolbar and sele t Documentation. After you omplete
the form, li k Submit to send it to Cis o.
You an e-mail your omments to bug-do @ is o. om.
To submit your omments by mail, for your onvenien e many do uments ontain a response ard
behind the front over. Otherwise, you an mail your omments to the following address:
Cis o Systems, In .
Do ument Resour e Conne tion
170 West Tasman Drive
San Jose, CA 95134-9883
We appre iate your omments.
Obtaining technical assistance
Cis o provides Cis o. om as a starting point for all te hni al assistan e. Customers and partners an
obtain do umentation, troubleshooting tips, and sample onfigurations from online tools. For Cis o. om
registered users, additional troubleshooting tools are available from the TAC website.
Cisco.com
Cis o. om is the foundation of a suite of intera tive, networked servi es that provides immediate, open
a ess to Cis o information and resour es at anytime, from anywhere in the world. This highly
integrated Internet appli ation is a powerful, easy-to-use tool for doing business with Cis o.
Cis o. om provides a broad range of features and servi es to help ustomers and partners streamline
business pro esses and improve produ tivity. Through Cis o. om, you an find information about Cis o
and our networking solutions, servi es, and programs. In addition, you an resolve te hni al issues with
online te hni al support, download and test software pa kages, and order Cis o learning materials and
mer handise. Valuable online skill assessment, training, and ertifi ation programs are also available.
Customers and partners an self-register on Cis o. om to obtain additional personalized information and
servi es. Registered users an order produ ts, he k on the status of an order, a ess te hni al support,
and view benefits spe ifi to their relationships with Cis o.
To a ess Cis o. om, go to the following website:
http://www. is o. om
Technical Assistance Center
The Cis o TAC website is available to all ustomers who need te hni al assistan e with a Cis o produ t
or te hnology that is under warranty or overed by a maintenan e ontra t.
Contacting TAC by using the Cisco TAC website
If you have a priority level 3 (P3) or priority level 4 (P4) problem, onta t TAC by going to the TAC
website:

Other references
xv
VPN 3002 Hardware Client User Guide
http://www. is o. om/ta
P3 and P4 level problems are defined as follows:
• P3—Your network performan e is degraded. Network fun tionality is noti eably impaired, but most
business operations ontinue.
• P4—You need information or assistan e on Cis o produ t apabilities, produ t installation, or basi
produ t onfiguration.
In ea h of the above ases, use the Cis o TAC website to qui kly find answers to your questions.
To register for Cis o. om, go to the following website:
http://www. is o. om/register/
If you annot resolve your te hni al issue by using the TAC online resour es, Cis o. om registered users
an open a ase online by using the TAC Case Open tool at the following website:
http://www. is o. om/ta / aseopen
Contacting TAC by telephone
If you have a priority level 1(P1) or priority level 2 (P2) problem, onta t TAC by telephone and
immediately open a ase. To obtain a dire tory of toll-free numbers for your ountry, go to the following
website:
http://www. is o. om/warp/publi /687/Dire tory/DirTAC.shtml
P1 and P2 level problems are defined as follows:
• P1—Your produ tion network is down, ausing a riti al impa t to business operations if servi e is
not restored qui kly. No workaround is available.
• P2—Your produ tion network is severely degraded, affe ting signifi ant aspe ts of your business
operations. No workaround is available.
Other references
Other useful books and arti les in lude:
Frequently Asked Questions about Microso t VPN Security. Mi rosoft Corporation: 1998.
(Available from Mi rosoft web site, www.microsoft.com.)
Kosiur, Dave. Building and Managing Virtual Private Networks. Wiley: 1998.
Sheldon, Tom. Encyclopedia o Networking. Osborne/M Graw-Hill: 1998.
Stallings, William. Data and Computer Communications, 5th ed. Prenti e-Hall: 1997.
www.ietf.org for Internet Engineering Task For e (IETF) Working Group drafts on IP Se urity
Proto ol (IPSe ).
www.whatis.com, a Web referen e site with definitions for omputer, networking, and data
ommuni ation terms.

Documentation conventions
We use these typographi onventions in this manual:
Data formats
As you onfigure and manage the system, enter data in these formats unless the instru tions indi ate
otherwise.
IP addresses
IP addresses use 4-byte dotted de imal notation; for example, 192.168.12.34. You an omit leading
zeros in a byte position.
Subnet masks and wildcard masks
Subnet masks use 4-byte dotted de imal notation; for example, 255.255.255.0. Wild ard masks use
the same notation; for example, 0.0.0.255. You an omit leading zeros in a byte position.
MAC addresses
MAC addresses use 6-byte hexade imal notation; for example, 00.10.5A.1F.4F.07.
Hostnames
Hostnames use legitimate network host or end-system name notation; for example, VPN01. Spa es are
not allowed. A hostname must uniquely identify a spe ifi system on a network.
Text strings
Text strings use alphanumeri hara ters, upper- and lower- ase. Most text strings are ase-sensitive; for
example, simon and Simon represent different usernames. The maximum length of text strings is
generally 48 hara ters.
Font Meaning
This ont Do ument, hapter, and se tion titles. Emphasized text.
This font Command-line prompts and entries, data-entry-field entries, system displays,
filenames, et .
This font Literal entries you should make exa tly as shown.
<This font> Variables that the system supplies. Ignore the angle bra kets.
This font Menus, menu items, keyboard keys, i ons, s reen names, data-entry field
names, et .

Data formats
xvii
VPN 3002 Hardware Client User Guide
Filenames
Filenames on the VPN 3002 follow the DOS 8.3 naming onvention: a maximum of eight hara ters for
the name, plus a maximum of three hara ters for an extension. For example, LOG00007.TXT is a
legitimate filename. The VPN3002 always stores filenames as upper ase.
Port numbers
Port numbers use de imal numbers from 0 to 65535 with no ommas or spa es.

1-1
VPN 3002 Hardware Client User Guide
CHAPTER 1
Using the VPN 3002 Hardware Client Manager
The VPN 3002 Hardware Client Manager is an HTML-based interfa e that lets you onfigure,
administer, monitor, and manage the VPN 3002 with a standard Web browser. To use it, you need only
to onne t to the VPN 3002 using a PC and browser on the same private network with the VPN 3002.
The Manager uses the standard Web lient / server proto ol, HTTP (Hypertext Transfer Proto ol), whi h
is a leartext proto ol. However, you an also use the Manager in a se ure, en rypted HTTP onne tion
over SSL (Se ure So kets Layer) proto ol, whi h is known as HTTPS.
•To use a leartext HTTP onne tion, see Connecting to the VPN 3002 using HTTP.
•To use HTTP over SSL (HTTPS) with the Manager:
1The first time, onne t to the Manager using HTTP, and
2Install an SSL ertifi ate in the browser; see Installing the SSL certi icate in your browser on page
1-3.
On e the SSL ertifi ate is installed, you an onne t dire tly using HTTPS; see Connecting to the
VPN 3002 using HTTPS on page 1-16.
Browser requirements
The VPN 3002 Hardware Client Manager requires either Mi rosoft Internet Explorer version 4.0 or
higher, or Nets ape Navigator / Communi ator version 4.5-4.7. For best results, we re ommend Internet
Explorer. Whatever browser and version you use, install the latest pat hes and servi e pa ks for it.
Note: You annot use the Live Event Log feature with Nets ape navigator/Communi ator version 4.0.
JavaScript
Be sure JavaS ript is enabled in the browser. Che k these settings:

1 Using the VPN 3002 Hardware Client Manager
1-2 VPN 3002 Hardware Client User Guide
•Internet Explorer 4.0:
–On the View menu, sele t Internet Options.
–On the Security tab, li k Custom (for expert users) then li k Settings.
–In the Security Settings window, s roll down to Scripting.
–Cli k Enable under Scripting of Java applets.
–Cli k Enable under Active scripting.
•Internet Explorer 5.0:
–On the Tools menu, sele t Internet Options.
–On the Security tab, li k Custom Level.
–In the Security Settings window, s roll down to Scripting.
–Cli k Enable under Active scripting.
–Cli k Enable under Scripting of Java applets.
•Navigator / Communi ator 4.x:
–On the Edit menu, sele t Preferences.
–On the Advanced s reen, he k the box for Enable JavaScript.
Cookies
Be sure ookies are enabled in the browser. Che k these settings:
•Internet Explorer 4.0:
–On the View menu, sele t Internet Options.
–On the Advanced tab, s roll down to Security then Cookies.
–Cli k Always accept cookies.
•Internet Explorer 5.0:
–On the Tools menu, sele t Internet Options.
–On the Security tab, li k Custom Level.
–In the Security Settings window, s roll down to Cookies.
–Cli k Enable under Allow cookies that are stored on your computer.
–Cli k Enable under Allow per-session cookies (not stored).
•Navigator / Communi ator 4.5:
–On the Edit menu, sele t Preferences.
–On the Advanced s reen, li k one of the Accept ... cookies hoi es, and do not he k Warn me before
accepting a cookie.
Navigation toolbar
Do not use the browser navigation toolbar buttons Back, Forward, or Refresh / Reload with the VPN 3002
Hardware Client Manager unless instru ted to do so. To prote t a ess se urity, li king Refresh / Reload
automati ally logs out the Manager session. Cli king Back or Forward may display stale Manager s reens
with in orre t data or settings.
We re ommend that you hide the browser navigation toolbar to prevent mistakes while using the VPN
3002 Hardware Client Manager.