| 14.7 |  | The Cisco VPN Client |
| 14.7.1 |  | Cisco VPN Client features |

| This module has focused primarily on site-to-site VPN configuration. However, the proliferation of home offices and telecommuting has resulted in an increased use of Cisco VPN Client-to-PIX Security Appliance VPNs. The VPN Client-to-PIX Security Appliance tunnel is used primarily with PIX Security Appliance software 6.0 and above and Client software 3.5 and above.

Client-to-PIX and PIX-to-PIX VPN tunneling have many similarities. IKE phase one negotiation and SAs precede IPSec SAs. Instead of a second PIX Security Appliance acting as the VPN endpoint, a computer running the VPN client software takes this role. One main difference is that VPN clients are often mobile, eliminating the ability to set a peer address in the PIX Security Appliance configuration and requiring dynamic crypto maps.

The VPN client is effective at creating a secure connection with these crypto maps. The client runs IPSec tunneling and allows data compression over this tunnel to speed transmission for home modem users.

The home or remote VPN Client user may launch their client software and gain access to the corporate network. A central-site authentication device such as a RADIUS server can be used to authenticate the purported user to improve security. The central site also has the ability to push VPN Client configuration changes to the software, improving centralized management.

Other security issues exist with VPN Client software users. One aspect of configuration that the firewall administrator must be aware of is split tunneling. The VPN Client can be configured to simultaneously direct packets over the Internet in clear text for nonprivate traffic, and encrypted through an IPSec tunnel for network traffic. Split tunneling can create security issues by allowing a home user unprotected access to the Internet while connected to the corporate network. If the home user employs a firewall, this issue is less of a concern.