|
Cisco VPN Client for Linux |
|
|
|
Saturday, 21 January 2006 |
|
This is a quick HOWTO describing the steps required to setup a VPN with a Cisco PIX firewall and the Cisco VPN Client for Linux. First setup your dynamic VPN in your PIX. access-list inside_outbound_nat0_acl permit ip any DYNAMIC_VPN_network 255.255.255.224 access-list outside_cryptomap_dyn_20 permit ip any DYNAMIC_VPN_network 255.255.255.224 access-list VPNNAME_splitTunnelAcl permit ip WORK_network 255.255.255.0 any access-list VPNNAME_splitTunnelAcl permit ip DYNAMIC_VPN_network 255.255.255.0 any access-list VPNNAME_splitTunnelAcl permit ip WORK2_network 255.255.255.0 any ip local pool vpnpool 192.168.46.1-192.168.46.20 crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20 crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map isakmp policy 40 authentication pre-share isakmp policy 40 encryption 3des isakmp policy 40 hash md5 isakmp policy 40 group 2 isakmp policy 40 lifetime 86400 vpngroup VPNNAME address-pool vpnpool vpngroup VPNNAME dns-server intranet vpngroup VPNNAME wins-server essex vpngroup VPNNAME default-domain northtrailrv.com vpngroup VPNNAME split-tunnel VPNNAME_splitTunnelAcl vpngroup VPNNAME idle-time 1800 vpngroup VPNNAME password ***** username vpnclient password ***** encrypted privilege 3
Next, install the Cisco vpn client. You have to download this from Cisco. tar -xzvf vpnclient-linux-4.8.00.0490-k9.tar.gz cd vpnclient urpmi kernel-source ./vpn_install Answer the questions to the best of your ability. Configure the client. cd /etc/opt/cisco-vpnclient/Profiles cp sample.pcf your_vpn_name.pcf vi your_vpn_name.pcf Host=your.pix.firewall.ip GroupName=VPNNAME /etc/init.d/vpnclient_init start vpnclient connect your_vpn_name Once connected the connection script will not go to the background. This is normal. I forget exactly why, but Cisco explains that this has something to do with the future key exchanges. To disconnect when you are done, in another terminal type: vpnclient disconnect. |
|
Last Updated ( Saturday, 21 January 2006 )
|