Cisco 837 as VPN Server

Posted on 2004-09-05
Medium Priority
Last Modified: 2011-08-18

I have been running a Cisco 837 router as my internal network gateway for about 6 months now and it is rock solid - unlike the Draytek 2600 I had previously!

Whilst I've been very pleased with the 837 I am new to Cisco so I want to make sure that if I'm recommending the 837 to my clients I understand what is free and what costs money.

I managed to install SDM to replace CWRS and have IOS 12.2 (14.5)T installed. I registered with Cisco's website and have limited access to a few protected resources it would appear.

Specifically, I would like to understand about upgrades to IOS, support for configuration problems etc. Finally, I am using NAT on the existing 837 with VPN passthrough to Windows 2003 Server running RRAS as a VPN endpoint. Some of my clients run Windows workgroups (no server) and so I'd like to know how good the 837 is acting as a VPN endpoint itself. How do VPN clients get authorised without RADIUS? Also, is it necessary to use Cisco's Easy VPN Client software or can I use Windows 2000 / XP Professional as the client?


Question by:WebAdviser
  • 2
  • 2
LVL 79

Expert Comment

ID: 11986440
The 837 can easily act as an endpoint itself, but you will need an upgrade to the IOS to add the IPSEC feature set.
You can use Win2K or XP LT2P/IPSEC policies to connect to the 837 router, but again, you need the (extra cost) IPSEC feature set.

How do VPN clients get authorized without RAIDUS?
Easy enough with a simple group name and pre-shared key.
It is not necessary to use any 3rd party software.

Author Comment

ID: 11987205
Thanks lrmoore.

I understand the group name and pre-shared key concept but what happens when the remote (VPN) user wants to connect to a network resource - say a share? With the setups I've been used to the remote user connects to the VPN server using their Windows login details via RRAS (VPN passthrough on 837) and then obviously once authenticated they have access to all network resources as if they were logged on "locally" (ie on the LAN wthout VPN).

Also, can you shed any light on IOS upgrades and support please?

thnaks again

LVL 79

Accepted Solution

lrmoore earned 2000 total points
ID: 11992779
Unfortunately, because the VPN connection is simply a network access and is not a Microsoft client, you must have another way to authenticate. Traditionally, this is done using the (Cisco) VPN Client functions of "start before logon" and the user then gets authenticated in the domain at logon (assuming their PC has joined the domain at one point).
If using IPSEC policies, the policy would have to be setup to be enabled before a user logs in, and then the user logs into the PC with their domain credentials.
Else, every domain resource will present username/password challenge. User will be prompted for domain username and password to connect to resources.

Author Comment

ID: 11994233
Thanks lrmoore for your detailed comments.

I take your points regarding domain authentication - I'll need to think on these...

A few things spring to mind:

1) Where the remote network (running VPN Server) is on a Windows domain then I guess I would use the CISCO radius client to authenticate against the user account or use VPN passthrough and use RRAS

2) If the remote network is part of a Windows workgroup (rather than domain) then this is where I would like to make the most of the Cisco 837. In a workgroup scenario I obviously logon to the workstation/laptop as a local user (logon locally). Those credentials need to be held in each network resource's own user database (e.g. for a share on another workstation or file server) as there is no central domain controller obviously. Assuming that I can sucessfully open a VPN tunnel using whatever protocol via the remote network's VPN Server then wouldn't the credentials I logged on to the local machine with be used when the challenge/response handshaking is initiated?

3) Taking 2) a stage further then with Windows XP Pro and Windows 2000 Pro there is no need for a domain controller to be available at logon as credentials are cached on the local machine. When a domain controller does become available (for example where a VPN tunnel is established after logon using cached credentials) then again wouldn't those credentials mean be used to access remote network resources and wouldn't this be successful?

Sorry about the lengthy response but this has been going round in my head for a while now and I feel I'm getting somewhere nearer to a full understanding of the situation.

Further comments very welcome!



Featured Post

SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses
Course of the Month5 days, 4 hours left to enroll

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question