| 14.7 |  | The Cisco VPN Client |
| 14.7.2 |  | Topology overview |

| This section introduces the Cisco VPN Client topology. The topology is very similar to a PIX-to-PIX site-to-site topology, except that one VPN endpoint may be a normal personal computer, which can also be mobile. The PIX Security Appliance supports the VPN Client software program that runs on all current Windows operating systems including Windows 95, 98, Millennium Edition (Me), NT 4.0, 2000, and XP. The VPN Client enables secure, end-to-end encrypted tunnels to Cisco remote access VPN devices supporting the Unified Client Framework. The VPN Client can be used for either low or high-speed remote users who need to securely access their corporate networks across the Internet.

A remote user is most likely to first establish a connection to the Internet before opening a VPN tunnel. The VPN Client enables the user to use plain old telephone service (POTS), ISDN, digital subscriber line (DSL), or cable modem connection technologies for this connection. The VPN Client is compatible with Point-to-Point Protocol over Ethernet (PPPoE) -based DSL and it has been tested with Network Telesystems Ethernet, Wind River PoET, and PPPoE for Windows 95, 98, ME, NT, and 2000. After connecting to the Internet, the VPN Client software negotiates a tunnel with the VPN head-end device, such as a PIX Security Appliance.

The VPN Client can be configured for mass deployments, and initial logins require very little user intervention. When a connection is established, VPN access policies and configurations are downloaded from the central gateway and pushed to the VPN Client. This allows simple deployment and management, as well as high scalability. Items pushed to the VPN Client from the central site concentrator include the following:

- Domain Name System (DNS)
- Windows Internet Naming System (WINS)
- Split tunneling networks
- Default domain name
- IP address
- Ability to save a password for the VPN connection

The network topology in Figure shows that a remote user with the VPN Client installed can create an IPSec tunnel to the PIX Security Appliance using remote access. The PIX Security Appliance is configured for wildcard pre-shared keys, dynamic crypto maps, Xauth, and IKE mode configuration, and has VPN groups configured with the vpngroup command. This is to enable the PIX Security Appliance to push IPSec policy to the VPN Client. Authentication may be done with pre-shared keys, TACACS+, or digital certificates.