asked on

Cisco 837 as VPN Server

Hi

I have been running a Cisco 837 router as my internal network gateway for about 6 months now and it is rock solid - unlike the Draytek 2600 I had previously!

Whilst I've been very pleased with the 837 I am new to Cisco so I want to make sure that if I'm recommending the 837 to my clients I understand what is free and what costs money.

I managed to install SDM to replace CWRS and have IOS 12.2 (14.5)T installed. I registered with Cisco's website and have limited access to a few protected resources it would appear.

Specifically, I would like to understand about upgrades to IOS, support for configuration problems etc. Finally, I am using NAT on the existing 837 with VPN passthrough to Windows 2003 Server running RRAS as a VPN endpoint. Some of my clients run Windows workgroups (no server) and so I'd like to know how good the 837 is acting as a VPN endpoint itself. How do VPN clients get authorised without RADIUS? Also, is it necessary to use Cisco's Easy VPN Client software or can I use Windows 2000 / XP Professional as the client?

thanks

Rob

Les Moore

The 837 can easily act as an endpoint itself, but you will need an upgrade to the IOS to add the IPSEC feature set.
You can use Win2K or XP LT2P/IPSEC policies to connect to the 837 router, but again, you need the (extra cost) IPSEC feature set.

How do VPN clients get authorized without RAIDUS?
Easy enough with a simple group name and pre-shared key.
It is not necessary to use any 3rd party software.

WebAdviser

ASKER

Thanks lrmoore.

I understand the group name and pre-shared key concept but what happens when the remote (VPN) user wants to connect to a network resource - say a share? With the setups I've been used to the remote user connects to the VPN server using their Windows login details via RRAS (VPN passthrough on 837) and then obviously once authenticated they have access to all network resources as if they were logged on "locally" (ie on the LAN wthout VPN).

Also, can you shed any light on IOS upgrades and support please?

thnaks again

Rob

ASKER CERTIFIED SOLUTION

Les Moore

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

WebAdviser

ASKER

Thanks lrmoore for your detailed comments.

I take your points regarding domain authentication - I'll need to think on these...

A few things spring to mind:

1) Where the remote network (running VPN Server) is on a Windows domain then I guess I would use the CISCO radius client to authenticate against the user account or use VPN passthrough and use RRAS

2) If the remote network is part of a Windows workgroup (rather than domain) then this is where I would like to make the most of the Cisco 837. In a workgroup scenario I obviously logon to the workstation/laptop as a local user (logon locally). Those credentials need to be held in each network resource's own user database (e.g. for a share on another workstation or file server) as there is no central domain controller obviously. Assuming that I can sucessfully open a VPN tunnel using whatever protocol via the remote network's VPN Server then wouldn't the credentials I logged on to the local machine with be used when the challenge/response handshaking is initiated?

3) Taking 2) a stage further then with Windows XP Pro and Windows 2000 Pro there is no need for a domain controller to be available at logon as credentials are cached on the local machine. When a domain controller does become available (for example where a VPN tunnel is established after logon using cached credentials) then again wouldn't those credentials mean be used to access remote network resources and wouldn't this be successful?

Sorry about the lengthy response but this has been going round in my head for a while now and I feel I'm getting somewhere nearer to a full understanding of the situation.

Further comments very welcome!

regards

Rob