| 7.2 |  | Cisco Easy VPN |
| 7.2.2 |  | Overview of the Easy VPN Server |

| The Cisco IOS Release 12.2(8)T Easy VPN Server introduces server support for the Cisco VPN Client release 3.x software clients and supported hardware clients. It allows remote end users to communicate using IP Security (IPSec) with supported Cisco IOS Release 12.2(8)T VPN gateways. Centrally managed IPSec policies are pushed to the clients by the server which minimizes configuration by the end users.

The Cisco IOS Release 12.2(8)T Easy VPN Server adds support for the following functions:

- Mode Configuration Version 6 Support - Mode Configuration version 6 now supports more attributes as described in an Internet Engineering Task Force draft submission.
- Xauth Version 6 Support - Cisco IOS has been enhanced to support version 6 of Xauth. Xauth for user authentication is based on an IETF draft submission.
- Internet Key Exchange (IKE) Dead Peer Detection (DPD) - The VPN Client implements a new keepalives scheme—IKE DPD.

> DPD enables two IPSec peers to determine if the other is still “alive” during the lifetime of a VPN connection. DPD is useful because a host may reboot or the dialup link of a remote user may disconnect without notifying the peer that the VPN connection has gone away. When an IPSec host determines that a VPN connection no longer exists, it can notify a user, attempt to switch to another IPSec host, or clean up valuable resources that were allocated for the peer that no longer exists.

> A Cisco IOS VPN device can be configured to send and reply to DPD messages. DPD messages are sent if no other traffic is being passed through the IPSec tunnel. If a configured amount of time has lapsed since the last inbound data was received, DPD will send a message (“DPD R-U-THERE”). DPD messages are unidirectional and are automatically sent by VPN Clients. DPD must be configured on the router only if the router wishes to send DPD messages to the VPN Client to determine the health of the VPN Client.

- Split Tunneling Control - Remote VPN Clients can support split tunneling, which is the ability for a VPN Client to have intranet and Internet access at the same time. If split tunneling is not configured, the VPN Client will direct all traffic through the tunnel, even traffic destined for the Internet.
- Initial Contact - If a VPN Client is suddenly disconnected, the gateway may not be notified. Consequently, removal of connection information (IKE and IPSec Security Associations [SAs]) for that VPN Client will not immediately occur. Thus, if the VPN Client attempts to reconnect to the gateway again, the gateway will refuse the connection because the previous connection information is still valid. To avoid this scenario, a new capability called initial contact has been introduced. It is supported by all Cisco VPN products. If a VPN Client or router is connecting to another Cisco gateway for the first time, an initial contact message is sent that tells the receiver to ignore and delete any old connection information that has been maintained for that newly connecting peer. Initial contact ensures that connection attempts are not refused because of SA synchronization problems, which are often identified via invalid security parameter index (SPI) messages and require devices to have their connections cleared.
- Group-Based Policy Control - Policy attributes such as IP addresses, DNS, and split tunnel access can be provided on a per-group or per-user basis.

Figure displays the Cisco Easy VPN IPSec options and attributes. Some IPSec attributes are not currently supported by the Cisco Easy VPN, and, therefore, should not be configured on the Easy VPN Server for these VPN Clients.