| 15.6 |  | Using PDM to Create Remote Access VPNs |
| 15.6.1 |  | The PIX Security Appliance for Unity and Cisco VPN Clients |

| This section gives an overview of how PDM configures the PIX Security Appliance-supported VPN clients. The PIX Security Appliance supports the following VPN clients. PDM supports all of them except the IRE client:

- Cisco VPN Client version 1.1 or later, also known as the IRE client
- Cisco VPN 3000 Client version 2.5 or later, also known as the Altiga client
- Cisco VPN Client version 3.0, also known as the Unity client
- Windows 2000 Client

To configure support for the Unity and Altiga clients, it is necessary to select Cisco VPN Client from the Remote Access branch of the Categories tree. In the CLI, the vpngroup command set configures Cisco VPN 3000 Client policy attributes to be associated with a VPN group name and downloaded to Cisco VPN 3000 clients that are part of the given group. The same VPN group name is configured in the PDM Edit Client Settings window shown in Figure .

The following parameters, which appear in the General Info group box within the Add Client Settings window, consist of information pertaining to the pool of local addresses assigned to this VPN group:

- Idle Timeout - Sets the inactivity timeout for a client. When the inactivity timeout for all IPSec SAs have expired for a given VPN client, the tunnel is terminated. The default inactivity timeout is 1800 seconds or 30 minutes.
- Max. Conn. Time - Sets the maximum connection time for a client. When the maximum connection time is reached for a given VPN client, the tunnel is terminated. This means the connection between the client and the PIX Security Appliance will have to be re-established. The default maximum connection time is set to an unlimited amount of time.
- Primary DNS - Enables the PIX Security Appliance to download the IP address of a primary DNS server to the client as part of an IKE negotiation.
- Secondary DNS - Enables the PIX Security Appliance to download the IP address of a secondary DNS server to the client as part of an IKE negotiation.
- Primary WINS - Enables the PIX Security Appliance to download the IP address of a primary WINS server to the client as part of an IKE negotiation.
- Secondary WINS - Enables the PIX Security Appliance to download the IP address of a secondary WINS server to the client as part of an IKE negotiation.
- Domain - Specifies a domain name to enable the PIX Security Appliance to download a default domain name to a client of IKE negotiation.

Selecting the Enable PFS check box enables Perfect Forward Secrecy (PFS). Clicking the Manage Split DNS or Manage Split Tunneling button opens a window to configure split DNS or split tunneling.

| Web Links http://www.cisco.com/en/US/products/ sw/netmgtsw/ps2032/index.html