Cisco IOS Easy VPN

This early field testing deployment guide highlights the steps to configure the Cisco® Tunnel Control Protocol (cTCP) feature on Cisco IOS® Easy VPN Servers, Easy VPN Remotes, and Cisco VPN Clients. With this feature enabled, VPN users will be able to establish VPN tunnels from the client/remote to the Easy VPN Server through a third-party Network Address Transport (NAT) device or firewall.

Challenge

• Small/home office router performing Network/Port Address Translation (NAT/PAT). This router sits between the EasyVPN Remote/Client and the Server and usually supports both TCP and UDP translation by default with no restrictions, but ESP might not be permitted.

• PAT-provided IP address behind a large corporation. This could exist if a service provider provides non-public addresses to clients and then performs PAT. This scenario is identical to that documented above. However, in the corporation scenario, it is common that only predefined TCP applications are permitted (TCP 80, TCP 443, etc.) for added network protection. These devices include Cisco PIX® security appliances, large Cisco IOS Software-based routers, Checkpoint firewalls, etc. A hotel providing private address space to guests could fall under this category, or the first.

• Non-NAT Firewall (Packet Filtering or Stateful). This scenario is common at companies that wish to use routable address space on their internal networks. Often in this environment, only particular TCP applications will function, but UDP outbound is not permitted because it is considered to be a potential corporate security hole. Our customers are sometimes consultants or employees located at these networks, trying to tunnel back into another corporation from behind an existing firewall. These devices include Cisco IOS routers and Cisco PIX firewalls, either operating as a stateful firewall or a stateless packet filter.

• Proxy server. If a proxy server is smart enough to look at each packet to confirm that the activity occurring is the defined activity, our solution may not work. However, for proxy servers that simply proxy TCP service ports (such as Borderware firewalls) our solution should work in this situation.

Solution

Network Setup

Components Used

• Cisco 2821 Router with Cisco IOS Software Release 12.4(9)T as EasyVPN Server

• Cisco 871w Router with Cisco IOS Software Release 12.5(1st)T as EasyVPN Remote

• Cisco VPN Client Version 4.0.5

• Cisco 1811 Router as firewall

Figure 1. Network Setup

• The client initiates a cTCP connection using a random, unused (unused at the time of selecting the port) TCP port number as the source port. Any application that later uses that port may not work.

• Session setup and teardown: cTCP session initiation follows a fixed number of retransmissions (that is not configurable) before declaring failure. Just like the server, the client does not react to a TCP RST received on the source port (for the same reasons of anyone being able to generate such a packet). It will close the session only when the VPN session on top of the cTCP session is closed, and will then send a TCP RST (that the server ignores).

• Keepalive: cTCP client needs to send periodic keepalives to keep NAT/firewall sessions alive. To this end, cTCP client sends a TCP ACK ack'ing the last sequence number received from the hub. The keepalive interval defaults to 5 seconds; however, it can be configured.

Configure cTCP on Cisco Easy VPN

Server

• Configure a typical EasyVPN server tunnel setup, using either crypto map or DVTI.

• Enable ctcp option on the server. Configure up to 10 ports on the server to listen to. (e.g., crypto ctcp port <port number1> ... <port number10>)

Remote

• Configure ezvpn profile on the remote router (e.g., crypto ipsec client ezvpn easy)

• Enable ctcp option under the ezvpn profile on the remote router (e.g., ctcp enable <port number>)

• Configure the interface on remote that is connected to host-1, as Easyvpn `inside interface'.

• Configure the interface on remote that is connected to firewall, as Easyvpn `outside interface'.

NAT/Firewall

• Configure ip inspect rule on the middle router that acts as firewall (e.g., ip inspect name <name> tcp). Apply this rule on the interface that is connected to ctcp-client to inspect the incoming tcp requests (e.g., ip inspect <name> in).

• Configure the access-list policy on the firewall (e.g., ip access-list extended <name>). Apply this policy on the interface that is connected to server (e.g., ip access-group <name> in).

Sample Configuration and Troubleshooting Output

Server Configuration Using Virtual Tunnel Interface

Spoke Router with DVTI Configuration

Server Configuration Using Crypto Map

Remote Configured with Crypto Map

Firewall Configuration

Cisco VPN Client

• Transport tab: Choose IPsec over TCP.

• TCP port: 10000 (or any port configured on the EasyVPN server)

Figure 2. cTCP Configuration on Cisco VPN Client

Troubleshooting

Verify Server

Sample Output on Server Configured with DVTI

Verify Remote

Interoperability

Cisco VPN 3000

Figure 3. cTCP on Cisco VPN 3000 Concentrator

Figure 4. cTCP on VPN 3002 Hardware Client

Cisco ASA Appliance