| 14.7 |  | The Cisco VPN Client |
| 14.7.4 |  | Configuring a PIX Security Appliance for a PIX-to-VPN Client tunnel |

| Figure shows a sample configuration for the PIX Security Appliance to support the VPN Client, which is explained as follows. An ACL is configured to designate traffic between the inside network and the IP local pool as interesting traffic. The source is the inside network, and the destination is the network address of the IP local pool, a range of addresses that will be dynamically assigned to the VPN Clients.

> access-list 80 permit ip 10.0.0.0 255.255.255.0 10.0.20.0 255.255.255.0
> ip address outside 192.168.0.2 255.255.255.0
> ip address inside 10.0.0.1 255.255.255.0

A nat 0 access list specifies that no NAT takes place inside the tunnel:

> nat (inside) 0 access-list 80
> route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

The CSACS server is set up for Xauth user authentication. CSACS, or a remote database it uses such as Microsoft NT, must be configured with usernames and passwords, and must point to the PIX Security Appliance as the Network Access Server (NAS). The PIX Security Appliance is configured to require all inbound connections to be authenticated by the 10.0.0.10 ACS server. The TACACS+ key, tacacskey in this example, matches the key in CSACS:

> aaa-server MYTACACS protocol tacacs+
> aaa-server MYTACACS (inside) host 10.0.0.10 tacacskey timeout 5
> sysopt connection permit-IPSec

The transform set to be used for the VPN Clients is created:

> crypto IPSec transform-set AAADES esp-des esp-md5-hmac

A dynamic crypto map is created to enable the VPN Clients to connect to the PIX Security Appliance. A transform set in the dynamic map must be configured at a minimum.

> crypto dynamic-map DYNOMAP 10 set transform-set AAADES

A crypto map is created, and the dynamic crypto map is assigned to it:

> crypto map VPNPEER 20 IPSec-isakmp dynamic DYNOMAP

The Xauth is configured to point to the TACACS+ server:

> crypto map VPNPEER client authentication MYTACACS

The crypto map is applied to the PIX interface:

> crypto map VPNPEER interface outside

ISAKMP is enabled on the outside interface, and the ISAKMP identity is defined as an IP address:

> isakmp enable outside
> isakmp identity address

The ISAKMP policy is configured:

> isakmp policy 10 authentication pre-share
> isakmp policy 10 encryption des
> isakmp policy 10 hash md5
> isakmp policy 10 group 2
> isakmp policy 10 lifetime 86400

A VPN group is configured to support pushing mode configuration parameters to the VPN Client. The VPN group name of TRAINING matches the group name in the VPN Client. The VPN group password matches the password in the VPN Client. VPN group can be configured to push DNS, WINS, domain name, and split tunneling information to the VPN Client:

> vpngroup TRAINING address-pool MYPOOL
> vpngroup TRAINING idle-time 1800
> vpngroup TRAINING password ********

Cisco VPN Client versions 3.0 and higher use DH group 2, and Cisco VPN Client 3000 version 2.5 uses DH group 1. If the VPN Client version 3.0 or higher is being used, configure DH group 2 by using the isakmp policy command.

A sample configuration of a PIX to VPN client tunnel is shown in Figure .