I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

1. R1 Configuration（HUB）.

2. R2 Configuration(Spoke).

3. R3 Configuration(Spoke).

4. Enable IPSec on R1 R2 and R3.

5. Use OSPF instead of EIGRP.

I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

In the lab, both access links advertise IP reachability of the loopback interface on the R2. In the event of failure of one of the access links, the loopback is still reachable from R1. The redundant link will maintain the established IKE and IPSec security associations.

1. R1 Configuration.

2. R2 Configuration.

I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

In the lab, both access link IP addresses are configured on R1 as IKE identities of R2. When R1 initiates IKE negotiation, the first peer IP address is used by IKE and becomes R2’s IKE identity for this peer. If this IKE SA times out during the negotiation, the second IP address becomes the IKE identity of the R2.

1. R1 Configuration.

2. R2 Configuration.

I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

On this lab, the VPN-GW peers (HUB1 and HUB2) are on a common public Ethernet using HSRP. The HSRP configuration makes one of the VPN-GW routers active and places the other one in standby at any given time. From an IPSec perspective, the spoke has an IPSec peer relationship with the HSRP virtual IP address owned by the active HSRP router. With stateful failover, a control channel is used to replicate the same SA information to public interfaces of the peer that is serving as the standby HSRP node. The replication of SA information ensures that the standby HSRP router and standby IPSec peer have the necessary information to immediately assume the role of an active HSRP and active IPSec peer.1. HUB1 Configuration.

(Part 3:Cisco Secure Desktop)
 Continue discussion in part 1, the topology is as follow:

Cisco Secure Desktop (CSD) extends the security of SSL VPN technology. CSD provides a separate partition on a user’s workstation for session activity. This vault area is encrypted during sessions and completely removed at the end of an SSL VPN session.

1. Preparing for Cisco Web VPN. (the same as part 1 or part 2)
 Because of the CSD is a plugin to Web VPN, so we must configure the WebVPN as part1 or part2.
 2. Installing and enabling CSD.
 

Copy the CSD image to dynamips 7200 disk0 via ftp, and then install CSD.
 c7206# copy ftp disk0:Address or name of remote host [10.10.1.2]?

Source filename [sslclient-win-1.1.2.169.pkg]? securedesktop-ios-3.1.1.45-k9.pkg

Destination filename [securedesktop-ios-3.1.1.45-k9.pkg]?

Accessing ftp://10.10.1.2/securedesktop-ios-3.1.1.45-k9.pkg…

Loading securedesktop-ios-3.1.1.45-k9.pkg !!!!!!!

[OK - 1697952/4096 bytes]

1697952 bytes copied in 76.704 secs (22136 bytes/sec)!

c7206(config)# webvpn install csd disk0:/securedesktop-ios-3.1.1.45-k9.pkg

SSLVPN Package Cisco-Secure-Desktop : installed successfully

!

c7206(config)# webvpn context mywebvpn-context1

c7206(config-webvpn-context)# csd enable

!enable CSD in default context policy.
  3. Configure CSD policy.
 All the CSD policy must configure in a special web page, we can not configure the CSD policy via CLI. Login “https://gataway_addr/csd_admin.html” to start the policy admin, the username is “admin”, and the password is enable password or enable secret of the router.Note: In my lab, the CSD admin address is “https://198.1.1.1/csd_admin.html”. The Cisco official documentation has an error, it says that the admin address is “https://gataway_addr/csd_admin”.

Select the webvpn context, in my lab, the context name is “mywebvpn-context1”.

The CSD admin home page, it is very similar witch Cisco VPN 3000 concentrator.

(Part 2:SSL VPN)
Continue discussion in part 1, the topology is as follow:

The Cisco SSL VPN supports on working on full-tunnel mode. In full-tunnel mode, an SSL tunnel is used to move data to and from the internal networks at the network (IP) layer. When the user logs into the SSLVPN gateway, the SSL VPN client (SVC) is automatically downloaded and installed at the end user’s PC, and the tunnel connection is established. Once the connection is established, the user has full VPN access to the corporate network.1. Preparing for Cisco Web VPN. (the same as part 1)
c7206(config)# int fa0/0c7206(config-if)# ip add 198.1.1.1 255.255.255.0

(Part 1:Web VPN)
 This test note describes how to configure Cisco SSL VPN on Cisco IOS routers. The whole lab is build on Dynamips 7200 simulator.

SSL VPNs use a methodology to transport private data across the public Internet. Instead of relying upon the end user to have a configured client on an agency-managed computer, SSL VPNs use SSL /HTTPS which is the secure transport mechanism built-in to all standard Web browsers. Using an SSL VPN, the connection between the user and the internal resource occurs via an HTTPS connection at the application-layer.

I have completed all the Cisco SSL labs on Dynamips 7200 simulator, the topology is as follow:

The Dynagen configuration is as follow:

1. Preparing for Cisco Web VPN.
c7206(config)# int fa0/0

c7206(config-if)# ip add 198.1.1.1 255.255.255.0

c7206(config-if)# no shutdown

c7206(config-if)# exit

!

c7206(config)# int fa1/0

c7206(config-if)# ip add 10.10.1.1 255.255.255.0

c7206(config-if)# no shutdown

c7206(config-if)# exit

!

c7206(config)# aaa new-model

c7206(config)# aaa authentication login default local

!define the default aaa authentication list, allow the administrator to login this router, this configuration is foreign to the Web VPN.
!

c7206(config)# aaa authentication login aaa-webvpn local

c7206(config)# username steve6307 password cisco

!define the WebVPN authentication list.
!

c7206(config)# webvpn gateway mygateway

c7206(config-webvpn-gateway)# ip address 198.1.1.1 port 443

c7206(config-webvpn-gateway)# inservice

!define the WebVPN gateway address and port, usually the port is 443.
!

c7206(config)# webvpn context mywebvpn-context1

c7206(config-webvpn-context)# gateway mygateway domain group1

c7206(config-webvpn-context)# aaa authentication list aaa-webvpn

c7206(config-webvpn-context)# inservice

!define a WebVPN context. You must select a gateway and a aaa authentication list for each context. The domain name is very important to the configuration, because the end user will select the context by this domain name in the future.
 2. Basic feature test(Web browsing).
I used Firefox to test the WebVPN feature. I entered “https://198.1.1.1/group1” in the address bar, and then I saw the WebVPN home page.

Note: the url format is https://webvpn_gateway_addr/context_domain_name

I entered my username and password in the dialog box, and then click “Login”.

Now I have successfully logon the webvpn!

I entered the Internal Server IP address in the URL page, and then I accessed the internal server web page successfully.

3. WebVPN extended services.
 Now, let’s talk about how to configure the webvpn extended services:

1. File-access feature.

2. Custom the url-list.

3. Port-forward feature.

3.1. File-access feature
 The file-access feature can provide browsing and file access of files on the windows file server (NetBIOS name service server).

To use the file access-feature, the user must have “file-access file-entry file-browsing” privilege.

c7206(config)# webvpn context mywebvpn-context1

c7206(config-webvpn-nbnslist)# nbns-server 10.10.1.2

c7206(config-webvpn-nbnslist)# exit

!You must define the NetBIOS name server for IOS WebVPN. In fact, this is optional if you use the ip address to access the file server in the future.
!

c7206(config-webvpn-context)# policy group context1-policy

c7206(config-webvpn-group)# functions file-access

c7206(config-webvpn-group)# functions file-browse

c7206(config-webvpn-group)# functions file-entry

c7206(config-webvpn-group)# exit

!define the group policy for this context, assign the “file-access file-entry file-browsing” privilege.
!

c7206(config-webvpn-context)# default-group-policy context1-policy

!assign the group policy as default policy.
  Feature test:
 Login WebVPN again, I saw the page as follow:

I entered “\\10.10.1.2” as the network path, and then the browser prompted me to enter my username and password to access the resources of my file server:

3.2. Custom the url-list
 c7206(config-webvpn-context)# url-list myurl

c7206(config-webvpn-url)#url-text “Home Page” url-value http://10.10.1.2

c7206(config-webvpn-url)#url-text “Site2″ url-value http://10.10.1.3

!

c7206(config-webvpn-context)#policy group context1-policy

c7206(config-webvpn-group)#url-list myurl

Feature test:
 Login WebVPN again, I saw the page as follow:

3.3. Port-forward
 Port-forward feature provides access for remote end users to client and server applications that communicate over known, fixed TCP ports. Each internal server and port number that the user can have access to has to be configured on the gateway. The entries specify the local port number and the destination server name and port number to use for TCP port forwarding.

c7206(config-webvpn-context)# port-forward myport

c7206(config-webvpn-port-fwd)# local-port 2323 remote-server 10.10.1.2 remote-port 23 description test

c7206(config-webvpn-port-fwd)# exit

!

c7206(config-webvpn-context)# policy group context1-policy

c7206(config-webvpn-group)# port-forward myport

!when I login the WebVPN, the browser load the JAVA App, and then I can telnet the internal server via telnet localhost 2323 port.
  Feature test:
 Login WebVPN again, I saw the page as follow:

Click “Application Access”, and then the browser can load the java app.

I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

The Dynagen configuration is as follow:

1. PPTP Server Configuration (R2).

2. Windows Client Configuration.

 Use the windows dialer configuration guide to complete the configuration.

I have completed this lab on Dynamips 7200 simulator, the topology is as follow:

The Dynagen configuration is as follow:

1. ENT LNS L2TP Configuration (R2).

2. Windows Client Configuration.
First of all, modify the windows register as follow and restart the windows:

Then use the windows dialer configuration guide to complete the configuration.