Cisco ROUTER-SDM-CD User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco Router and Security Device
Manager User’s Guide
2.5
Customer Order Number:
Text Part Number: OL-4015-12

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and
figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and
coincidental.
Cisco Router and Security Device Manager 2.5 User’s Guide
© 2007 Cisco Systems, Inc. All rights reserved.

iii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
CONTENTS
Home Page 1
Creating a New Connection 1
Creating a New Connection 1
New Connection Reference 2
Create Connection 2
Additional Procedures 3
How Do I Configure a Static Route? 4
How Do I View Activity on My LAN Interface? 4
How Do I Enable or Disable an Interface? 5
How Do I View the IOS Commands I Am Sending to the Router? 5
How Do I Launch the Wireless Application from Cisco SDM? 6
How Do I Configure an Unsupported WAN Interface? 6
How Do I Enable or Disable an Interface? 7
How Do I View Activity on My WAN Interface? 7
How Do I Configure NAT on a WAN Interface? 8
How Do I Configure NAT on an Unsupported Interface? 9
How Do I Configure a Dynamic Routing Protocol? 9
How Do I Configure Dial-on-Demand Routing for My ISDN or Asynchronous
Interface? 10
How Do I Edit a Radio Interface Configuration? 11
LAN Wizard 1
Ethernet Configuration 2
LAN Wizard: Select an Interface 2
LAN Wizard: IP Address and Subnet Mask 3

Contents
iv
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
LAN Wizard: Enable DHCP Server 3
LAN Wizard: DHCP Address Pool 4
DHCP Options 4
LAN Wizard: VLAN Mode 5
LAN Wizard: Switch Port 6
IRB Bridge 7
BVI Configuration 8
DHCP Pool for BVI 8
IRB for Ethernet 9
Layer 3 Ethernet Configuration 9
802.1Q Configuration 10
Trunking or Routing Configuration 10
Configure Switch Device Module 10
Configure Gigabit Ethernet Interface 11
Summary 11
802.1x Authentication 1
LAN Wizard: 802.1x Authentication (Switch Ports) 1
Advanced Options 2
LAN Wizard: RADIUS Servers for 802.1x Authentication 4
Edit 802.1x Authentication (Switch Ports) 6
LAN Wizard: 802.1x Authentication (VLAN or Ethernet) 7
802.1x Exception List 8
802.1x Authentication on Layer 3 Interfaces 9
Edit 802.1x Authentication 10
How Do I ... 11
How Do I Configure 802.1x Authentication on More Than One Ethernet
Port? 11

v
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
Configuring WAN Connections 1
Configuring an Ethernet WAN Connection 1
Ethernet WAN Connection Reference 2
WAN Wizard Interface Welcome Window 2
Select Interface 3
IP Address: Ethernet without PPPoE 3
Encapsulation: PPPoE 4
Summary 5
Advanced Options 5
Configuring a Serial Connection 6
Serial Connection Reference 7
IP Address: Serial with Point-to-Point Protocol 7
IP Address: Serial with HDLC or Frame Relay 8
Authentication 9
Configure LMI and DLCI 10
Configure Clock Settings 11
Configuring a DSL Connection 13
DSL Connection Reference 14
IP Address: ATM or Ethernet with PPPoE/PPPoA 14
IP Address: ATM with RFC 1483 Routing 15
Encapsulation Autodetect 16
PVC 18
Configuring an ISDN Connection 20
ISDN Connection Reference 20
ISDN Wizard Welcome Window 21
IP Address: ISDN BRI or Analog Modem 21
Switch Type and SPIDs 22
Dial String 23
Configuring an Aux Backup Connection 24
Aux Backup Connection Reference 24

Contents
vi
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Aux Backup Welcome Window 25
Backup Configuration 25
Backup Configuration: Primary Interface and Next Hop IP Addresses 26
Backup Configuration: Hostname or IP Address to Be Tracked 27
Configuring an Analog Modem Connection 27
Analog Modem Connection Reference 28
Analog Modem Welcome 28
Configuring a Cable Modem Connection 29
Cable Modem Connection Reference 29
Cable Modem Connection Wizard Welcome 30
Select Interface 30
Summary 30
Edit Interface/Connection 1
Connection: Ethernet for IRB 5
Connection: Ethernet for Routing 6
Existing Dynamic DNS Methods 7
Add Dynamic DNS Method 7
Wireless 9
Association 9
NAT 11
Edit Switch Port 12
Application Service 13
General 14
Select Ethernet Configuration Type 16
Connection: VLAN 17
Subinterfaces List 17
Add or Edit BVI Interface 18
Add or Edit Loopback Interface 18

vii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
Connection: Virtual Template Interface 19
Connection: Ethernet LAN 19
Connection: Ethernet WAN 20
Connection: Ethernet Properties 22
Connection: Ethernet with No Encapsulation 24
Connection: ADSL 25
Connection: ADSL over ISDN 28
Connection: G.SHDSL 30
Connection: Cable Modem 34
Configure DSL Controller 35
Add a G.SHDSL Connection 37
Connection: Serial Interface, Frame Relay Encapsulation 40
Connection: Serial Interface, PPP Encapsulation 43
Connection: Serial Interface, HDLC Encapsulation 45
Add or Edit GRE Tunnel 46
Connection: ISDN BRI 48
Connection: Analog Modem 51
Connection: (AUX Backup) 53
Authentication 55
SPID Details 56
Dialer Options 57
Backup Configuration 59
Delete Connection 60
Connectivity Testing and Troubleshooting 62
Wide Area Application Services 1
Configuring a WAAS Connection 2
WAAS Reference 3

Contents
viii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
NM WAAS 4
Integrated Service Engine 6
WCCP 7
Central Manager Registration 8
Create Firewall 1
Basic Firewall Configuration Wizard 4
Basic Firewall Interface Configuration 4
Configuring Firewall for Remote Access 5
Advanced Firewall Configuration Wizard 5
Advanced Firewall Interface Configuration 5
Advanced Firewall DMZ Service Configuration 6
DMZ Service Configuration 7
Application Security Configuration 8
Domain Name Server Configuration 9
URL Filter Server Configuration 9
Select Interface Zone 9
ZPF Inside Zones 10
Voice Configuration 10
Summary 11
SDM Warning: SDM Access 13
How Do I... 15
How Do I View Activity on My Firewall? 15
How Do I Configure a Firewall on an Unsupported Interface? 17
How Do I Configure a Firewall After I Have Configured a VPN? 17
How Do I Permit Specific Traffic Through a DMZ Interface? 18
How Do I Modify an Existing Firewall to Permit Traffic from a New Network
or Host? 19
How Do I Configure NAT on an Unsupported Interface? 19
How Do I Configure NAT Passthrough for a Firewall? 20

ix
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
How Do I Permit Traffic Through a Firewall to My Easy VPN Concentrator? 20
How Do I Associate a Rule with an Interface? 22
How Do I Disassociate an Access Rule from an Interface 22
How Do I Delete a Rule That Is Associated with an Interface? 23
How Do I Create an Access Rule for a Java List? 23
How Do I Permit Specific Traffic onto My Network if I Don’t Have a DMZ
Network? 24
Firewall Policy 1
Edit Firewall Policy/ACL 1
Choose a Traffic Flow 3
Examine the Traffic Diagram and Choose a Traffic Direction 4
Make Changes to Access Rules 6
Make Changes to Inspection Rules 10
Add App-Name Application Entry 12
Add rpc Application Entry 12
Add Fragment application entry 13
Add or Edit http Application Entry 14
Java Applet Blocking 15
Cisco SDM Warning: Inspection Rule 16
Cisco SDM Warning: Firewall 17
Edit Firewall Policy 17
Add a New Rule 21
Add Traffic 22
Application Inspection 23
URL Filter 24
Quality of Service 24
Inspect Parameter 24
Select Traffic 24
Delete Rule 25

Contents
x
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Application Security 1
Application Security Windows 1
No Application Security Policy 3
E-mail 4
Instant Messaging 5
Peer-to-Peer Applications 6
URL Filtering 7
HTTP 8
Header Options 9
Content Options 10
Applications/Protocols 12
Timeouts and Thresholds for Inspect Parameter Maps and CBAC 13
Associate Policy with an Interface 16
Edit Inspection Rule 16
Permit, Block, and Alarm Controls 17
Site-to-Site VPN 1
VPN Design Guide 1
Create Site to Site VPN 1
Site-to-Site VPN Wizard 4
View Defaults 5
VPN Connection Information 6
IKE Proposals 8
Transform Set 11
Traffic to Protect 13
Summary of the Configuration 14
Spoke Configuration 15
Secure GRE Tunnel (GRE-over-IPSec) 16
GRE Tunnel Information 16

xi
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
VPN Authentication Information 17
Backup GRE Tunnel Information 18
Routing Information 19
Static Routing Information 20
Select Routing Protocol 22
Summary of Configuration 23
Edit Site-to-Site VPN 23
Add new connection 26
Add Additional Crypto Maps 26
Crypto Map Wizard: Welcome 27
Crypto Map Wizard: Summary of the configuration 28
Delete Connection 28
Ping 29
Generate Mirror... 29
Cisco SDM Warning: NAT Rules with ACL 30
How Do I... 31
How Do I Create a VPN to More Than One Site? 31
After Configuring a VPN, How Do I Configure the VPN on the Peer Router? 33
How Do I Edit an Existing VPN Tunnel? 34
How Do I Confirm That My VPN Is Working? 35
How Do I Configure a Backup Peer for My VPN? 36
How Do I Accommodate Multiple Devices with Different Levels of VPN
Support? 36
How Do I Configure a VPN on an Unsupported Interface? 37
How Do I Configure a VPN After I Have Configured a Firewall? 38
How Do I Configure NAT Passthrough for a VPN? 38
Easy VPN Remote 1
Creating an Easy VPN Remote Connection 2
Create Easy VPN Remote Reference 3

Contents
xii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Create Easy VPN Remote 4
Configure an Easy VPN Remote Client 5
Easy VPN Remote Wizard: Network Information 5
Easy VPN Remote Wizard: Identical Address Configuration 6
Easy VPN Remote Wizard: Interfaces and Connection Settings 7
Easy VPN Remote Wizard: Server Information 9
Easy VPN Remote Wizard: Authentication 11
Easy VPN Remote Wizard: Summary of Configuration 13
Administering Easy VPN Remote Connections 14
Editing an Existing Easy VPN Remote Connection 15
Creating a New Easy VPN Remote Connection 15
Deleting an Easy VPN Remote Connection 16
Resetting an Established Easy VPN Remote Connection 16
Connecting to an Easy VPN Server 17
Connecting other Subnets to the VPN Tunnel 17
Administering Easy VPN Remote Reference 18
Edit Easy VPN Remote 18
Add or Edit Easy VPN Remote 23
Add or Edit Easy VPN Remote: General Settings 25
Network Extension Options 28
Add or Edit Easy VPN Remote: Easy VPN Settings 28
Add or Edit Easy VPN Remote: Authentication Information 30
Add or Edit Easy VPN Remote: Easy VPN Client Phase III
Authentication 33
Add or Edit Easy VPN Remote: Interfaces and Connections 35
Add or Edit Easy VPN Remote: Identical Addressing 37
Easy VPN Remote: Add a Device 39
Enter SSH Credentials 39
XAuth Login Window 40
Other Procedures 40

xiii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
How Do I Edit an Existing Easy VPN Connection? 40
How Do I Configure a Backup for an Easy VPN Connection? 41
Easy VPN Server 1
Creating an Easy VPN Server Connection 1
Create an Easy VPN Server Reference 3
Create an Easy VPN Server 4
Welcome to the Easy VPN Server Wizard 4
Interface and Authentication 4
Group Authorization and Group Policy Lookup 5
User Authentication (XAuth) 6
User Accounts for XAuth 7
Add RADIUS Server 8
Group Authorization: User Group Policies 9
General Group Information 10
DNS and WINS Configuration 11
Split Tunneling 11
Client Settings 12
Choose Browser Proxy Settings 15
Add or Edit Browser Proxy Settings 16
User Authentication (XAuth) 17
Client Update 18
Add or Edit Client Update Entry 19
Cisco Tunneling Control Protocol 20
Summary 21
Browser Proxy Settings 21
Editing Easy VPN Server Connections 23
Edit Easy VPN Server Reference 23
Edit Easy VPN Server 24
Add or Edit Easy VPN Server Connection 25

Contents
xiv
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Restrict Access 26
Group Policies Configuration 26
IP Pools 29
Add or Edit IP Local Pool 29
Add IP Address Range 30
Enhanced Easy VPN 1
Interface and Authentication 1
RADIUS Servers 2
Group Authorization and Group User Policies 4
Add or Edit Easy VPN Server: General Tab 5
Add or Edit Easy VPN Server: IKE Tab 6
Add or Edit Easy VPN Server: IPSec Tab 8
Create Virtual Tunnel Interface 10
DMVPN 1
Dynamic Multipoint VPN 1
Dynamic Multipoint VPN (DMVPN) Hub Wizard 2
Type of Hub 3
Configure Pre-Shared Key 3
Hub GRE Tunnel Interface Configuration 4
Advanced Configuration for the Tunnel Interface 5
Primary Hub 6
Select Routing Protocol 7
Routing Information 7
Dynamic Multipoint VPN (DMVPN) Spoke Wizard 9
DMVPN Network Topology 9
Specify Hub Information 10
Spoke GRE Tunnel Interface Configuration 10
Cisco SDM Warning: DMVPN Dependency 11
Edit Dynamic Multipoint VPN (DMVPN) 12

xv
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
General Panel 14
NHRP Panel 15
NHRP Map Configuration 16
Routing Panel 17
How Do I Configure a DMVPN Manually? 19
VPN Global Settings 1
VPN Global Settings 1
VPN Global Settings: IKE 3
VPN Global Settings: IPSec 4
VPN Global Settings: Easy VPN Server 5
VPN Key Encryption Settings 6
IP Security 1
IPSec Policies 1
Add or Edit IPSec Policy 3
Add or Edit Crypto Map: General 5
Add or Edit Crypto Map: Peer Information 6
Add or Edit Crypto Map: Transform Sets 7
Add or Edit Crypto Map: Protecting Traffic 9
Dynamic Crypto Map Sets 11
Add or Edit Dynamic Crypto Map Set 11
Associate Crypto Map with this IPSec Policy 12
IPSec Profiles 12
Add or Edit IPSec Profile 13
Add or Edit IPSec Profile and Add Dynamic Crypto Map 14
Transform Set 15
Add or Edit Transform Set 18
IPSec Rules 20

Contents
xvi
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Internet Key Exchange 1
Internet Key Exchange (IKE) 1
IKE Policies 2
Add or Edit IKE Policy 4
IKE Pre-shared Keys 6
Add or Edit Pre Shared Key 7
IKE Profiles 8
Add or Edit an IKE Profile 9
Public Key Infrastructure 1
Certificate Wizards 1
Welcome to the SCEP Wizard 2
Certificate Authority (CA) Information 3
Advanced Options 4
Certificate Subject Name Attributes 4
Other Subject Attributes 6
RSA Keys 7
Summary 8
CA Server Certificate 9
Enrollment Status 9
Cut and Paste Wizard Welcome 9
Enrollment Task 10
Enrollment Request 10
Continue with Unfinished Enrollment 11
Import CA certificate 12
Import Router Certificate(s) 12
Digital Certificates 13
Trustpoint Information 15
Certificate Details 15

xvii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
Revocation Check 15
Revocation Check, CRL Only 16
RSA Keys Window 16
Generate RSA Key Pair 17
USB Token Credentials 18
USB Tokens 19
Add or Edit USB Token 20
Open Firewall 22
Open Firewall Details 23
Certificate Authority Server 1
Create CA Server 1
Prerequisite Tasks for PKI Configurations 2
CA Server Wizard: Welcome 3
CA Server Wizard: Certificate Authority Information 3
Advanced Options 5
CA Server Wizard: RSA Keys 7
Open Firewall 8
CA Server Wizard: Summary 8
Manage CA Server 9
Backup CA Server 11
Manage CA Server Restore Window 11
Restore CA Server 11
Edit CA Server Settings: General Tab 12
Edit CA Server Settings: Advanced Tab 13
Manage CA Server: CA Server Not Configured 13
Manage Certificates 13
Pending Requests 13
Revoked Certificates 15
Revoke Certificate 16

Contents
xviii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Cisco IOS SSL VPN 1
Cisco IOS SSL VPN links on Cisco.com 2
Creating an SSL VPN Connection 2
Create an SSL VPN Connection Reference 3
Create SSL VPN 4
Persistent Self-Signed Certificate 6
Welcome 7
SSL VPN Gateways 7
User Authentication 8
Configure Intranet Websites 10
Add or Edit URL 10
Customize SSL VPN Portal 11
SSL VPN Passthrough Configuration 11
User Policy 12
Details of SSL VPN Group Policy: Policyname 12
Select the SSL VPN User Group 13
Select Advanced Features 13
Thin Client (Port Forwarding) 13
Add or Edit a Server 14
Full Tunnel 15
Locating the Install Bundle for Cisco SDM 16
Enable Cisco Secure Desktop 18
Common Internet File System 19
Enable Clientless Citrix 19
Summary 20
Editing SSL VPN Connections 20
Editing SSL VPN Connection Reference 21
Edit SSL VPN 22
SSL VPN Context 23
Designate Inside and Outside Interfaces 25

xix
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
Select a Gateway 25
Context: Group Policies 26
Group Policy: General Tab 26
Group Policy: Clientless Tab 27
Group Policy: Thin Client Tab 29
Group Policy: SSL VPN Client (Full Tunnel) Tab 29
Advanced Tunnel Options 31
DNS and WINS Servers 33
Context: HTML Settings 33
Select Color 35
Context: NetBIOS Name Server Lists 35
Add or Edit a NBNS Server List 35
Add or Edit an NBNS Server 36
Context: Port Forward Lists 36
Add or Edit a Port Forward List 36
Context: URL Lists 36
Add or Edit a URL List 37
Context: Cisco Secure Desktop 37
SSL VPN Gateways 37
Add or Edit a SSL VPN Gateway 38
Packages 39
Install Package 40
Additional Help Topics 40
Cisco IOS SSL VPN Contexts, Gateways, and Policies 40
Learn More about Port Forwarding Servers 46
Learn More About Group Policies 47
Learn More About Split Tunneling 48
How do I verify that my Cisco IOS SSL VPN is working? 49
How do I configure a Cisco IOS SSL VPN after I have configured a
firewall? 50

Contents
xx
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
How do I associate a VRF instance with a Cisco IOS SSL VPN context? 50
SSL VPN Enhancements 1
SSL VPN Reference 1
SSL VPN Context: Access Control Lists 1
Add or Edit Application ACL 2
Add ACL Entry 3
Action URL Time Range 4
Add or Edit Action URL Time Range Dialog 5
Add or Edit Absolute Time Range Entry 6
Add or Edit Periodic Time Range Entry 7
VPN Troubleshooting 1
VPN Troubleshooting 1
VPN Troubleshooting: Specify Easy VPN Client 3
VPN Troubleshooting: Generate Traffic 4
VPN Troubleshooting: Generate GRE Traffic 5
Cisco SDM Warning: SDM will enable router debugs... 6
Security Audit 1
Welcome Page 4
Interface Selection Page 4
Report Card Page 5
Fix It Page 5
Disable Finger Service 6
Disable PAD Service 7
Disable TCP Small Servers Service 7
Disable UDP Small Servers Service 8
Disable IP BOOTP Server Service 8
Disable IP Identification Service 9