Cisco OL-4015-08 User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco Router and Security Device Manager
(SDM) Version 2.2 User’s Guide
Customer Order Number:
Text Part Number: OL-4015-08

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco Router and Security Device Manager (SDM) Version 2.2 User’s Guide
Copyright © 2005, Cisco Systems, Inc.
All rights reserved.
CCSP, the Cisco Square Bridge logo, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live,
Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness
Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packe t, PIX, Post-Routing, Pre-Routing, ProConnect,
RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are
registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0406R)

iii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
CONTENTS
Home Page 1
LAN Wizard 1
Ethernet Configuration 2
LAN Wizard: Select an Interface 3
LAN Wizard: IP Address and Subnet Mask 3
LAN Wizard: Enable DHCP Server 4
LAN Wizard: DHCP Address Pool 4
DHCP Options 5
LAN Wizard: VLAN Mode 6
LAN Wizard: Switch Port 6
IRB Bridge 7
BVI Configuration 7
DHCP Pool for BVI 8
IRB for Ethernet 9
Layer 3 Ethernet Configuration 9
802.1Q Configuration 9
Trunking or Routing Configuration 9
Configure Switch Device Module 10
Summary 10
How Do I... 10
How Do I Configure a Static Route? 10
How Do I View Activity on My LAN Interface? 11
How Do I Enable or Disable an Interface? 12

Contents
iv
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
How Do I View the IOS Commands I Am Sending to the Router? 12
How Do I Launch the Wireless Application from SDM? 13
Create Connection Wizards 1
Create Connection 1
WAN Wizard Interface Welcome Window 2
ISDN Wizard Welcome Window 3
Analog Modem Welcome Window 3
Aux Backup Welcome Window 3
Select Interface 4
Encapsulation: PPPoE 4
IP Address: ATM or Ethernet with PPPoE/PPPoA 4
IP Address: ATM with RFC 1483 Routing 5
IP Address: Ethernet without PPPoE 6
IP Address: Serial with Point-to-Point Protocol 6
IP Address: Serial with HDLC or Frame Relay 7
IP Address: ISDN BRI or Analog Modem 8
Authentication 9
Switch Type and SPIDs 9
Dial String 11
Backup Configuration 11
Backup Configuration: Primary Interface & Next Hop IP Addresses 12
Backup Configuration: Hostname or IP Address to be Tracked 12
Advanced Options 13
Encapsulation 13
PVC 15
Configure LMI and DLCI 16
Configure Clock Settings 17

v
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Delete Connection 19
Summary 21
Connectivity testing and troubleshooting 22
How Do I... 26
How Do I View the IOS Commands I Am Sending to the Router? 26
How Do I Configure an Unsupported WAN Interface? 26
How Do I Enable or Disable an Interface? 26
How Do I View Activity on My WAN Interface? 27
How Do I Configure NAT on a WAN Interface? 27
How Do I Configure NAT on an Unsupported Interface? 28
How Do I Configure a Dynamic Routing Protocol? 28
How Do I Configure Dial-on-Demand Routing for my ISDN or Asynchronous
Interface? 29
How Do I Edit a Radio Interface Configuration? 30
Edit Interface/Connection 1
Connection: Ethernet for IRB 6
Connection: Ethernet for Routing 7
Existing Dynamic DNS Methods 8
Add Dynamic DNS Method 8
Wireless 10
Association 10
NAT 12
Edit Switch Port 12
General 13
QoS 15
Select Ethernet Configuration Type 16
Connection: VLAN 16
Connection: Subinterfaces 17

Contents
vi
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Add or Edit BVI Interface 18
Add Loopback Interface/Connection—Loopback 18
Connection: Ethernet LAN 19
Connection: Ethernet WAN 20
Ethernet Properties 21
Connection: Ethernet with No Encapsulation 22
Connection: ADSL 23
Connection: ADSL over ISDN 26
Connection: G.SHDSL 28
Configure DSL Controller 32
Connection: G.SHDSL with DSL Controller 34
Connection: Serial Interface, Frame Relay Encapsulation 36
Connection: Serial Interface, PPP Encapsulation 39
Connection: Serial Interface, HDLC Encapsulation 41
Add or Edit GRE Tunnel' 42
Connection: ISDN BRI 44
Connection: Analog Modem 47
Connection: (AUX Backup) 49
Authentication 51
SPID Details 52
Dialer Options 53
Backup Configuration 55
Create Firewall 1
Basic Firewall Configuration Wizard 4
Basic Firewall Interface Configuration 4
Firewall Remote Management Access 4
Advanced Firewall Configuration Wizard 5

vii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Advanced Firewall Interface Configuration 5
Advanced Firewall DMZ Service Configuration 6
DMZ Service Configuration 7
Advanced Firewall Inspection Rule Configuration 7
Application Security Configuration 9
Domain Name Server Configuration 10
Summary 10
How Do I... 11
How Do I View Activity on My Firewall? 12
How Do I Configure a Firewall on an Unsupported Interface? 13
How Do I Configure a Firewall After I Have Configured a VPN? 14
How Do I Permit Specific Traffic Through a DMZ Interface? 15
How Do I Modify an Existing Firewall to Permit Traffic from a New Network
or Host? 16
How Do I Configure NAT on an Unsupported Interface? 16
How Do I Configure NAT Passthrough for a Firewall? 17
How Do I Permit Traffic Through a Firewall to My Easy VPN Concentrator? 17
How Do I Associate a Rule with an Interface? 19
How Do I Disassociate an Access Rule from an Interface 19
How Do I Delete a Rule That Is Associated with an Interface? 20
How Do I Create an Access Rule for a Java List? 20
How Do I Permit Specific Traffic onto My Network if I Don’t Have a DMZ
Network? 21
Firewall Policy 1
Edit Firewall Policy/ACL 1
Add App-Name Application Entry 11
Add rpc Application Entry 11
Add Fragment application entry 12
Add or Edit http Application Entry 13
Java Applet Blocking 14

Contents
viii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
SDM Warning: Inspection Rule 15
SDM Warning: Firewall 16
Application Security 17
Application Security Windows 17
No Application Security Policy 19
E-mail 20
HTTP 21
Header Options 23
Content Options 23
Instant Messaging 25
Point-to-Point Applications 25
Applications/Protocols 26
Global Timeouts and Thresholds 27
Associate Policy with an Interface 29
Edit Inspection Rule 30
Permit, Block, and Alarm Controls 31
Site-to-Site VPN 33
Create Site to Site VPN 33
Site-to-Site VPN Wizard 36
View Defaults 37
VPN Connection Information 38
IKE Proposals 40
Transform Set 43
Traffic to Protect 45
Summary of the Configuration 46
Spoke Configuration 47
Secure GRE Tunnel (GRE-over-IPSec) 48
GRE Tunnel Information 48

ix
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
VPN Authentication Information 49
Backup GRE Tunnel Information 51
Routing Information 52
Static Routing Information 53
Select Routing Protocol 54
Summary of Configuration 55
Edit Site-to-Site VPN 55
Add new connection 58
Add Additional Crypto Maps 59
Crypto Map Wizard: Welcome 60
Crypto Map Wizard: General 60
Crypto Map Wizard: Peers 62
Crypto Map Wizard: Transform Set 62
Crypto Map Wizard: Traffic to Protect 63
Crypto Map Wizard: Summary of the configuration 64
Delete Connection 65
Ping 65
Generate Mirror... 66
SDM Warning: NAT Rules with ACL 67
How Do I... 67
How Do I Create a VPN to More Than One Site? 68
After Configuring a VPN, How Do I Configure the VPN on the Peer Router? 70
How Do I Edit an Existing VPN Tunnel? 71
How Do I Confirm That My VPN Is Working? 72
How Do I Configure a Backup Peer for My VPN? 73
How Do I Accommodate Multiple Devices with Different Levels of VPN
Support? 73
How Do I Configure a VPN on an Unsupported Interface? 74
How Do I Configure a VPN After I Have Configured a Firewall? 75
How Do I Configure NAT Passthrough for a VPN? 75

Contents
x
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Easy VPN Remote 77
Create Easy VPN Remote 77
Configure an Easy VPN Remote Client 77
Connection Settings 78
Authentication 79
Interfaces 80
Summary of Configuration 82
Edit Easy VPN Remote 83
Add or Edit Easy VPN Remote 89
Add or Edit Easy VPN Remote: Easy VPN Settings 91
Add or Edit Easy VPN Remote: Authentication Information 94
Enter SSH Credentials 95
XAuth Login Window 96
Add or Edit Easy VPN Remote: General Settings 96
Network Extension Options 98
Add or Edit Easy VPN Remote: Authentication Information 98
Add or Edit Easy VPN Remote: Interfaces and Connections 100
How Do I... 101
How Do I Edit an Existing Easy VPN Connection? 102
How Do I Configure a Backup for an Easy VPN Connection? 102
Easy VPN Server 105
Create an Easy VPN Server 105
Welcome to the Easy VPN Server Wizard 106
Interface and Authentication 106
Group Authorization: Group Policy Lookup 107
User Authentication (XAuth) 108
User Accounts for XAuth 109
Add RADIUS Server 109
Group Authorization: User Group Policies 110

xi
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
General Group Information 111
DNS and WINS Configuration 112
Split Tunneling 113
Client Settings 115
Choose Browser Proxy Settings 117
Add or Edit Browser Proxy Settings 117
User Authentication (XAuth) 119
Client Update 120
Add or Edit Client Update Entry 121
Summary 121
Browser Proxy Settings 122
Add or Edit Easy VPN Server 123
Add or Edit Easy VPN Server Connection 125
Restrict Access 126
Group Policies Configuration 126
Local Pools 129
Add or Edit IP Local Pool 130
Add IP Address Range 130
DMVPN 1
Dynamic Multipoint VPN 1
Dynamic Multipoint VPN (DMVPN) Hub Wizard 2
Type of Hub 3
Configure Pre-Shared Key 3
Hub GRE Tunnel Interface Configuration 4
Advanced Configuration for the Tunnel Interface 5
Primary Hub 6
Select Routing Protocol 7
Routing Information 7
Dynamic Multipoint VPN (DMVPN) Spoke Wizard 9

Contents
xii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
DMVPN Network Topology 9
Specify Hub Information 10
Spoke GRE Tunnel Interface Configuration 10
SDM Warning: DMVPN Dependency 11
Edit Dynamic Multipoint VPN (DMVPN) 12
General Panel 14
NHRP Panel 15
NHRP Map Configuration 16
Routing Panel 17
How Do I Configure a DMVPN Manually? 19
VPN Global Settings 21
VPN Global Settings 21
VPN Global Settings: IKE 23
VPN Global Settings: IPSec 24
VPN Key Encryption Settings 25
IP Security 27
IPSec Policies 27
Add or Edit IPSec Policy 29
Add or Edit Crypto Map: General Panel 31
Add or Edit Crypto Map: Peer Information Panel 32
Add or Edit Crypto Map: Transform Sets Panel 32
Add or Edit Crypto Map: IPSec Rules Panel 34
Dynamic Crypto Map Sets 35
Add or Edit Dynamic Crypto Map Set 35
Associate Crypto Map with this IPSec Policy 36
IPSec Profiles 36
Add or Edit IPSec Profile and Add Dynamic Crypto Map 37
Transform Set 37

xiii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Add or Edit Transform Set 40
IPSec Rules 43
Internet Key Exchange 45
Internet Key Exchange (IKE) 45
IKE Policies 46
Add or Edit IKE Policy 48
IKE Pre-shared Keys 50
Add or Edit Pre Shared Key 51
VPN Troubleshooting 53
VPN Troubleshooting 53
VPN Troubleshooting: Specify Easy VPN Client 55
VPN Troubleshooting: Generate Traffic 56
VPN Troubleshooting: Generate GRE Traffic 57
SDM Warning: SDM will enable router debugs... 58
Security Audit 1
Welcome Page 4
Interface Selection Page 4
Report Card Page 5
Fix It Page 5
Disable Finger Service 6
Disable PAD Service 7
Disable TCP Small Servers Service 7
Disable UDP Small Servers Service 8
Disable IP BOOTP Server Service 8
Disable IP Identification Service 9
Disable CDP 9
Disable IP Source Route 10

Contents
xiv
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Enable Password Encryption Service 10
Enable TCP Keepalives for Inbound Telnet Sessions 11
Enable TCP Keepalives for Outbound Telnet Sessions 11
Enable Sequence Numbers and Time Stamps on Debugs 11
Enable IP CEF 12
Disable IP Gratuitous ARPs 12
Set Minimum Password Length to Less Than 6 Characters 12
Set Authentication Failure Rate to Less Than 3 Retries 13
Set TCP Synwait Time 13
Set Banner 14
Enable Logging 14
Set Enable Secret Password 15
Disable SNMP 15
Set Scheduler Interval 16
Set Scheduler Allocate 16
Set Users 17
Enable Telnet Settings 17
Enable NetFlow Switching 17
Disable IP Redirects 18
Disable IP Proxy ARP 18
Disable IP Directed Broadcast 19
Disable MOP Service 20
Disable IP Unreachables 20
Disable IP Mask Reply 20
Disable IP Unreachables on NULL Interface 21
Enable Unicast RPF on Outside Interfaces 22
Enable Firewall on All of the Outside Interfaces 22
Set Access Class on HTTP Server Service 23
Set Access Class on VTY Lines 23
Enable SSH for Access to the Router 24

xv
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Enable AAA 24
Configuration Summary Screen 25
SDM and Cisco IOS AutoSecure 25
Security Configurations SDM Can Undo 27
Undoing Security Audit Fixes 28
Add or Edit Telnet/SSH Account Screen 28
Configure User Accounts for Telnet/SSH Page 29
Enable Secret and Banner Page 30
Logging Page 31
Routing 1
Add or Edit IP Static Route 3
Add or Edit an RIP Route 5
Add or Edit an OSPF Route 5
Add or Edit EIGRP Route 7
Network Address Translation 1
Network Address Translation Wizards 1
Basic NAT Wizard: Welcome 2
Basic NAT Wizard: Connection 2
Summary 3
Advanced NAT Wizard: Welcome 3
Advanced NAT Wizard: Connection 4
Add IP Address 4
Advanced NAT Wizard: Networks 4
Add Network 5
Advanced NAT Wizard: Server Public IP Addresses 5
Add or Edit Address Translation Rule 6
Advanced NAT Wizard: VPN Conflict 8

Contents
xvi
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Details 8
Network Address Translation Rules 8
Designate NAT Interfaces 12
Translation Timeout Settings 12
Edit Route Map 14
Edit Route Map Entry 15
Address Pools 15
Add or Edit Address Pool 16
Add or Edit Static Address Translation Rule: Inside to Outside 17
Add or Edit Static Address Translation Rule: Outside to Inside 20
Add or Edit Dynamic Address Translation Rule: Inside to Outside 23
Add or Edit Dynamic Address Translation Rule: Outside to Inside 26
How Do I . . . 28
How Do I Configure NAT With One LAN and Multiple WANs? 28
Intrusion Prevention System 31
IPS Rules 32
Create IPS Rule 32
Welcome to the IPS Rule Configuration Wizard 33
Select Interfaces 33
SDF Location 33
IPS Rule Wizard Summary 34
IPS Rules Configuration 34
Enable or Edit IPS on an Interface 37
Import Signatures 38
File Selection 39
Welcome to the IPS Signature Import Wizard 40
Signature Definition File (SDF) and Signature Selection 40
Signature Filter 40
Signature Edit 41

xvii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Signature Import Wizard Summary 41
Signatures 42
Assign Actions 46
Import Signatures 46
Add, Edit, or Clone Signature 48
Add or Edit a Signature Location 49
Cisco Intrusion Prevention Alert Center 50
IPS-Supplied Signature Definition Files 50
Global Settings 51
Edit Global Settings 53
SDEE Messages 54
SDEE Message Text 55
Network Module Management 1
IDS Network Module Management 1
IDS Sensor Interface IP Address 3
IP Address Determination 4
IDS NM Configuration Checklist 5
IDS NM Interface Monitoring Configuration 7
Network Module Login 7
Feature Unavailable 7
Switch Module Interface Selection 8
Quality of Service 9
Create QoS Policy 9
QoS Wizard 10
Interface Selection 10
QoS Policy Generation 10
View QoS Class Details 12
Summary of the configuration 13

Contents
xviii
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Edit QoS Policy 13
Edit QoS Class 15
Add a Protocol 17
Interface Association 18
QoS Status 18
Network Admission Control 21
Create NAC Tab 21
Other Tasks in a NAC Implementation 22
Welcome 23
RADIUS Server 23
Select the Interface(s) 25
NAC Exception List 25
Configure Exception List Entry Dialog 26
Policy List 27
Add Exception Policy 27
Agentless Host Policy 28
NAC Router Management Access 29
Open Interface ACL 29
Details Window 30
Summary of the configuration 30
Edit NAC Tab 31
EAPoUDP Components 31
Exception List Window 32
Exception Policies Window 32
EAPoUDP Timeouts 33
Configure a NAC Policy 34
How Do I... 35
How Do I Configure a NAC Policy Server? 35
How Do Install and Configure a Posture Agent on a Host? 35

xix
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
Contents
Router Properties 1
Device Properties 1
Date and Time: Clock Properties 2
Date and Time Properties 3
NTP 4
Add or Edit NTP Server Details 5
SNTP 7
Add an NTP Server 7
Syslog 8
SNMP 8
Router Access 10
User Accounts: Configure User Accounts for Router Access 10
Add or Edit a Username 11
View Password 13
VTYs 13
Edit VTY Lines 14
Configure Management Access Policies 15
Add or Edit a Management Policy 17
Management Access Error Messages 18
SDM Warning: ANY Not Allowed 18
SDM Warning: Unsupported Access Control Entry 19
SDM Warning: SDM Not Allowed 19
SDM Warning: Current Host Not Allowed 19
SSH 20
DHCP Configuration 21
DHCP Pools 21
Add or Edit DHCP Pool 22
DHCP Bindings 23
Add or Edit DHCP Binding 24

Contents
xx
Cisco Router and Security Device Manager (SDM) Version 2.1 User’s Guide
OL-4015-06
DNS Properties 26
Dynamic DNS Methods 26
Add or Edit Dynamic DNS Method 27
ACL Editor 1
Useful Procedures for Access Rules and Firewalls 2
Rules Windows 3
Add or Edit a Rule 7
Associate with an Interface 9
Add a Standard Rule Entry 11
Add an Extended Rule Entry 13
Select a Rule 16
Port-to-Application Mapping 19
Port-to-Application Mappings 19
Add or Edit Port Map Entry 21
Authentication, Authorization, and Accounting 23
AAA Main Window 23
AAA Servers and Groups 24
AAA Servers Window 25
Add or Edit a TACACS+ Server 26
Add or Edit a RADIUS Server 27
Edit Global Settings 27
AAA Server Groups Window 28
Authentication and Authorization Policies 29
Authentication and Authorization Windows 29
Authentication NAC 30
Add or Edit a Method List for Authentication or Authorization 31