Cisco OL-4015-08 User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco Router and Security Device Manager
(SDM) Version 2.2 User’s Guide
Customer Order Number:
Text Part Number: OL-4015-08

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco Router and Security Device Manager (SDM) Version 2.2 User’s Guide
Copyright © 2005, Cisco Systems, Inc.
All rights reserved.
CCSP, the Cisco Square Bridge logo, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live,
Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness
Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packe t, PIX, Post-Routing, Pre-Routing, ProConnect,
RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are
registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0406R)

iii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
CONTENTS
Home Page 1
LAN Wizard 1
Ethernet Configuration 2
LAN Wizard: Select an Interface 3
LAN Wizard: IP Address and Subnet Mask 3
LAN Wizard: Enable DHCP Server 4
LAN Wizard: DHCP Address Pool 4
DHCP Options 5
LAN Wizard: VLAN Mode 6
LAN Wizard: Switch Port 6
IRB Bridge 7
BVI Configuration 7
DHCP Pool for BVI 8
IRB for Ethernet 9
Layer 3 Ethernet Configuration 9
802.1Q Configuration 9
Trunking or Routing Configuration 9
Configure Switch Device Module 10
Summary 10
How Do I... 10
How Do I Configure a Static Route? 10
How Do I View Activity on My LAN Interface? 11
How Do I Enable or Disable an Interface? 12

Contents
iv
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
How Do I View the IOS Commands I Am Sending to the Router? 12
How Do I Launch the Wireless Application from SDM? 13
Create Connection Wizards 1
Create Connection 1
WAN Wizard Interface Welcome Window 2
ISDN Wizard Welcome Window 3
Analog Modem Welcome Window 3
Aux Backup Welcome Window 3
Select Interface 4
Encapsulation: PPPoE 4
IP Address: ATM or Ethernet with PPPoE/PPPoA 4
IP Address: ATM with RFC 1483 Routing 5
IP Address: Ethernet without PPPoE 6
IP Address: Serial with Point-to-Point Protocol 6
IP Address: Serial with HDLC or Frame Relay 7
IP Address: ISDN BRI or Analog Modem 8
Authentication 9
Switch Type and SPIDs 9
Dial String 11
Backup Configuration 11
Backup Configuration: Primary Interface & Next Hop IP Addresses 12
Backup Configuration: Hostname or IP Address to be Tracked 12
Advanced Options 13
Encapsulation 13
PVC 15
Configure LMI and DLCI 16
Configure Clock Settings 17

v
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Delete Connection 19
Summary 21
Connectivity testing and troubleshooting 22
How Do I... 26
How Do I View the IOS Commands I Am Sending to the Router? 26
How Do I Configure an Unsupported WAN Interface? 26
How Do I Enable or Disable an Interface? 26
How Do I View Activity on My WAN Interface? 27
How Do I Configure NAT on a WAN Interface? 27
How Do I Configure NAT on an Unsupported Interface? 28
How Do I Configure a Dynamic Routing Protocol? 28
How Do I Configure Dial-on-Demand Routing for my ISDN or Asynchronous
Interface? 29
How Do I Edit a Radio Interface Configuration? 30
Edit Interface/Connection 1
Connection: Ethernet for IRB 6
Connection: Ethernet for Routing 7
Existing Dynamic DNS Methods 8
Add Dynamic DNS Method 8
Wireless 10
Association 10
NAT 12
Edit Switch Port 12
General 13
QoS 15
Select Ethernet Configuration Type 16
Connection: VLAN 16
Connection: Subinterfaces 17

Contents
vi
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Add or Edit BVI Interface 18
Add Loopback Interface/Connection—Loopback 18
Connection: Ethernet LAN 19
Connection: Ethernet WAN 20
Ethernet Properties 21
Connection: Ethernet with No Encapsulation 22
Connection: ADSL 23
Connection: ADSL over ISDN 26
Connection: G.SHDSL 28
Configure DSL Controller 32
Connection: G.SHDSL with DSL Controller 34
Connection: Serial Interface, Frame Relay Encapsulation 36
Connection: Serial Interface, PPP Encapsulation 39
Connection: Serial Interface, HDLC Encapsulation 41
Add or Edit GRE Tunnel' 42
Connection: ISDN BRI 44
Connection: Analog Modem 47
Connection: (AUX Backup) 49
Authentication 51
SPID Details 52
Dialer Options 53
Backup Configuration 55
Create Firewall 1
Basic Firewall Configuration Wizard 4
Basic Firewall Interface Configuration 4
Firewall Remote Management Access 4
Advanced Firewall Configuration Wizard 5

vii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Advanced Firewall Interface Configuration 5
Advanced Firewall DMZ Service Configuration 6
DMZ Service Configuration 7
Advanced Firewall Inspection Rule Configuration 7
Application Security Configuration 9
Domain Name Server Configuration 10
Summary 10
How Do I... 11
How Do I View Activity on My Firewall? 12
How Do I Configure a Firewall on an Unsupported Interface? 13
How Do I Configure a Firewall After I Have Configured a VPN? 14
How Do I Permit Specific Traffic Through a DMZ Interface? 15
How Do I Modify an Existing Firewall to Permit Traffic from a New Network
or Host? 16
How Do I Configure NAT on an Unsupported Interface? 16
How Do I Configure NAT Passthrough for a Firewall? 17
How Do I Permit Traffic Through a Firewall to My Easy VPN Concentrator? 17
How Do I Associate a Rule with an Interface? 19
How Do I Disassociate an Access Rule from an Interface 19
How Do I Delete a Rule That Is Associated with an Interface? 20
How Do I Create an Access Rule for a Java List? 20
How Do I Permit Specific Traffic onto My Network if I Don’t Have a DMZ
Network? 21
Firewall Policy 1
Edit Firewall Policy/ACL 1
Add App-Name Application Entry 11
Add rpc Application Entry 11
Add Fragment application entry 12
Add or Edit http Application Entry 13
Java Applet Blocking 14

Contents
viii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
SDM Warning: Inspection Rule 15
SDM Warning: Firewall 16
Application Security 17
Application Security Windows 17
No Application Security Policy 19
E-mail 20
HTTP 21
Header Options 23
Content Options 23
Instant Messaging 25
Point-to-Point Applications 25
Applications/Protocols 26
Global Timeouts and Thresholds 27
Associate Policy with an Interface 29
Edit Inspection Rule 30
Permit, Block, and Alarm Controls 31
Site-to-Site VPN 33
Create Site to Site VPN 33
Site-to-Site VPN Wizard 36
View Defaults 37
VPN Connection Information 38
IKE Proposals 40
Transform Set 43
Traffic to Protect 45
Summary of the Configuration 46
Spoke Configuration 47
Secure GRE Tunnel (GRE-over-IPSec) 48
GRE Tunnel Information 48

ix
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
VPN Authentication Information 49
Backup GRE Tunnel Information 51
Routing Information 52
Static Routing Information 53
Select Routing Protocol 54
Summary of Configuration 55
Edit Site-to-Site VPN 55
Add new connection 58
Add Additional Crypto Maps 59
Crypto Map Wizard: Welcome 60
Crypto Map Wizard: General 60
Crypto Map Wizard: Peers 62
Crypto Map Wizard: Transform Set 62
Crypto Map Wizard: Traffic to Protect 63
Crypto Map Wizard: Summary of the configuration 64
Delete Connection 65
Ping 65
Generate Mirror... 66
SDM Warning: NAT Rules with ACL 67
How Do I... 67
How Do I Create a VPN to More Than One Site? 68
After Configuring a VPN, How Do I Configure the VPN on the Peer Router? 70
How Do I Edit an Existing VPN Tunnel? 71
How Do I Confirm That My VPN Is Working? 72
How Do I Configure a Backup Peer for My VPN? 73
How Do I Accommodate Multiple Devices with Different Levels of VPN
Support? 73
How Do I Configure a VPN on an Unsupported Interface? 74
How Do I Configure a VPN After I Have Configured a Firewall? 75
How Do I Configure NAT Passthrough for a VPN? 75

Contents
x
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Easy VPN Remote 77
Create Easy VPN Remote 77
Configure an Easy VPN Remote Client 77
Connection Settings 78
Authentication 79
Interfaces 80
Summary of Configuration 82
Edit Easy VPN Remote 83
Add or Edit Easy VPN Remote 89
Add or Edit Easy VPN Remote: Easy VPN Settings 91
Add or Edit Easy VPN Remote: Authentication Information 94
Enter SSH Credentials 95
XAuth Login Window 96
Add or Edit Easy VPN Remote: General Settings 96
Network Extension Options 98
Add or Edit Easy VPN Remote: Authentication Information 98
Add or Edit Easy VPN Remote: Interfaces and Connections 100
How Do I... 101
How Do I Edit an Existing Easy VPN Connection? 102
How Do I Configure a Backup for an Easy VPN Connection? 102
Easy VPN Server 105
Create an Easy VPN Server 105
Welcome to the Easy VPN Server Wizard 106
Interface and Authentication 106
Group Authorization: Group Policy Lookup 107
User Authentication (XAuth) 108
User Accounts for XAuth 109
Add RADIUS Server 109
Group Authorization: User Group Policies 110