Home arrow Articles arrow Cisco VPN Client for Linux
Cisco VPN Client for Linux PDF Print
Saturday, 21 January 2006

This is a quick HOWTO describing the steps required to setup a VPN with a Cisco PIX firewall and the Cisco VPN Client for Linux.

 
First setup your dynamic VPN in your PIX.

access-list inside_outbound_nat0_acl permit ip any DYNAMIC_VPN_network 255.255.255.224
access-list outside_cryptomap_dyn_20 permit ip any DYNAMIC_VPN_network 255.255.255.224
access-list VPNNAME_splitTunnelAcl permit ip WORK_network 255.255.255.0 any
access-list VPNNAME_splitTunnelAcl permit ip DYNAMIC_VPN_network 255.255.255.0 any
access-list VPNNAME_splitTunnelAcl permit ip WORK2_network 255.255.255.0 any
ip local pool vpnpool 192.168.46.1-192.168.46.20
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption 3des
isakmp policy 40 hash md5
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
vpngroup VPNNAME address-pool vpnpool
vpngroup VPNNAME dns-server intranet
vpngroup VPNNAME wins-server essex
vpngroup VPNNAME default-domain northtrailrv.com
vpngroup VPNNAME split-tunnel VPNNAME_splitTunnelAcl
vpngroup VPNNAME idle-time 1800
vpngroup VPNNAME password *****
username vpnclient password ***** encrypted privilege 3

Next, install the Cisco vpn client.

You have to download this from Cisco.
tar -xzvf vpnclient-linux-4.8.00.0490-k9.tar.gz
cd vpnclient
urpmi kernel-source
./vpn_install
Answer the questions to the best of your ability.

Configure the client.
cd /etc/opt/cisco-vpnclient/Profiles
cp sample.pcf your_vpn_name.pcf
vi your_vpn_name.pcf
Host=your.pix.firewall.ip
GroupName=VPNNAME
/etc/init.d/vpnclient_init start
vpnclient connect your_vpn_name 

Once connected the connection script will not go to the background.  This is normal.  I forget exactly why, but Cisco explains that this has something to do with the future key exchanges. 

To disconnect when you are done, in another terminal type: vpnclient disconnect.

Last Updated ( Saturday, 21 January 2006 )
 
< Prev