Cisco OL 10426 01 to instrukcja szybkiego użycia, która zawiera wszystkie informacje potrzebne do konfiguracji i używania produktów firmy Cisco. Instrukcja zawiera kompletne informacje na temat zarządzania produktami Cisco, w tym konfigurowania interfejsów sieciowych, konfigurowania i monitorowania routerów i przełączników, konfigurowania systemów bezpieczeństwa i wykorzystywania protokołów sieciowych, takich jak TCP/IP, IPX i innych. Instrukcja pomaga użytkownikom w szybkim i łatwym skonfigurowaniu i skonfigurowaniu ich produktów Cisco, co zapewnia wygodne i szybkie użycie.
Ostatnia aktualizacja: Instrukcja szybkiego użycia Cisco Ol 10426 01
Streszczenie treści zawartej na stronie nr. 1
Release Notes for VPN Client,
Release 4. 0 through Release 4. 0. 5. D
CCO Date: December 6, 2004
Part Number OL-5450-10
Note You can find the most current documentation for the VPN Client at
http://www. cisco. com or http://cco. com. These electronic documents may
contain updates and changes made after the hard copy documents were printed.
These release notes support VPN Client software Release 4. 0 through
Release 4. D. These release notes describe new features, limitations and
restrictions, c
Streszczenie treści zawartej na stronie nr. 2
Contents Installation Notes, page 5 New Features in Release 4. 0, page 11 Usage Notes, page 14 Open Caveats, page 37 Caveats Resolved in Release 4. D, page 59 Caveats Resolved in Release 4. C, page 60 Caveats Resolved in Release 4. B, page 60 Caveats Resolved in Release 4. A, page 61 Caveats Resolved in Release 4. 5, page 62 Caveats Resolved in Release 4. 4. D, page 63 Caveats Resolved in Release 4. B, page 65 Caveats Resolved in Release 4. 4, page 67 Caveats Resolved in ReleaseStreszczenie treści zawartej na stronie nr. 3
Introduction Documentation Feedback, page 96 Obtaining Technical Assistance, page 96 Obtaining Additional Publications and Information, page 99 Introduction ® ® The VPN Client is an application that runs on a Microsoft Windows -based PC, a Sun ultraSPARC workstations, a Linux desktop, or a Macintosh (Mac) personal computer that meets the system requirements stated in the next section. In this document, the term “PC” applies generically to all these computers, unless specified otherwise. The VPNStreszczenie treści zawartej na stronie nr. 4
System Requirements Computer Operating System Requirements ® ® Computer with a • Microsoft Windows 98 or • Microsoft TCP/IP installed. ® Pentium -class Windows 98 (second edition) (Confirm via Start > Settings > processor or Control Panel > Network > • Windows ME greater Protocols or Configuration. ) ® • Windows NT 4. 0 (with Service • 50 MB hard disk space. Pack 6, or higher) • RAM: • Windows 2000 – 32 MB for Windows 98 • Windows XP – 64 MB for Windows NT and Windows ME – 64 MB for Windows 2000 (Streszczenie treści zawartej na stronie nr. 5
Installation Notes Installation Notes Because of platform differences, the installation instructions for Windows and non-Windows platforms also differ. • Refer to the VPN Client User Guide for Windows, Release 4. 0, Chapter 2, for complete installation instructions for Windows users. • Refer to the Cisco VPN Client user Guide for Mac OS X, Chapter 2, for complete installation information for those platforms. The following notes are important for users who are upgrading to Windows XP and users whoStreszczenie treści zawartej na stronie nr. 6
Installation Notes • jp (Japanese) To force an English only language install, enter the following command: msiexec /i vpnclient_setup. msi To force a Canadian French language installation, enter the following command, all on the same line: msiexec /i vpnclient_setup. msi TRANSFORMS=vpnclient_fc. mst;vpnclient_help_fc. mst To force a Japanese language installation, enter the following command, all on the same line: msiexec /i vpnclient_setup. msi TRANSFORMS=vpnclient_jp. mst;vpnclient_help_jp. mst OverrStreszczenie treści zawartej na stronie nr. 7
Installation Notes Installation Notes - Windows Platforms In addition to the installation considerations for Release 4. 3, Release 4. x includes the following installation considerations for Windows users: Installing the VPN Client Software Using InstallShield Installing the VPN Client software on Windows NT, Windows 2000, or Windows XP with InstallShield requires Administrator privileges. If you do not have Administrator privileges, you must have someone who has Administrator privileges instaStreszczenie treści zawartej na stronie nr. 8
Installation Notes “Cannot find the file instmsiw. exe (or one of its components). Make sure the path and filename are correct and that all the required libraries are available. ” -then- “Cannot find the file MSIEXEC (or one of its components). ” The Windows Installer (MSI) can be installed only on NT SP6, so the error messages you see using earlier service packs are due to an MSI incompatibility (CSCdy05Streszczenie treści zawartej na stronie nr. 9
New Features in Release 4. 5 Using the VPN Client • To use the VPN Client, you need: – Direct network connection (cable or DSL modem and network adapter/interface card), or – Internal or external modem, and • To connect using a digital certificate for authentication, you need a digital certificate signed by one of the following Certificate Authorities (CAs) installed on your PC: – Baltimore Technologies (www. baltimoretechnologies. com) – Entrust Technologies (www. entrust. com) – Netscape (www. netStreszczenie treści zawartej na stronie nr. 10
New Features in Release 4. 5 Group Authentication is a method that uses pre-shared keys for mutual authentication. In this method, the VPN Client and the VPN central-site device use a group name and password to validate the connection. This is a symmetrical form of authentication since both sides use the same authentication method during their negotiations. Mutual group authentication is asymmetrical in that each side uses a different method to authenticate the other while establishing a secureStreszczenie treści zawartej na stronie nr. 11
New Features in Release 4. 0 3. Configure a VPN Group to use the new IPSec SA from step 2. The VPN Clients under test for Mutual Group Authentication will be connecting to this group. New Features in Release 4. 0 Release 4. 0 of the VPN Client software includes the following new features. Virtual Adapter A virtual adapter is a software-only driver that acts as a valid interface in the system. Its purpose is to solve protocol incompatibility problems. The virtual adapter appears in the network propeStreszczenie treści zawartej na stronie nr. 12
New Features in Release 4. 0 Common Graphical Interface for Windows and Mac VPN Clients In Release 4. 0, the VPN Client provides a consistent graphical user interface across all supported Windows operating systems and Mac OS X, recognizing that the Windows and Mac operating systems follow different conventions, and that the Windows version has additional features. The VPN Client documentation is based on this new user interface. Alerts (Delete With Reason) In Release 4. 0, the VPN Client can displaStreszczenie treści zawartej na stronie nr. 13
New Features in Release 4. 0 Personal Firewall Enhancements In Release 4. 0, the VPN Client supports Sygate Personal Firewall and Sygate Personal Firewall Pro, Version 5. 0, Build 1175 and higher. Other supported features new with this release include: • The ability to enable or disable stateful firewalls from the command line. • Configurable ICMP permissions. Coexistence with Third-Party VPN Vendors In Release 4. 0, the VPN Client is compatible with VPN clients from Microsoft, Nortel, Checkpoint, IStreszczenie treści zawartej na stronie nr. 14
Usage Notes Enhancements to GINA Release 4. 2 includes an improved application launch verification mechanism employed by the Graphical Identification and Authentication (GINA) dynamic-link library (DLL). This affects only the Windows NT4, Windows 2000, and Windows XP platforms (CSCeb12179). Usage Notes This section lists issues to consider before installing Release 4. x of the VPN Client software. In addition, you should be aware of the open caveats regarding this release. Refer to “Open CaveaStreszczenie treści zawartej na stronie nr. 15
Usage Notes Windows NT Users running Windows NT 4. 0 with Service Pack 4 require a hot fix from Microsoft for proper operation. This fix is available on the Microsoft GetHostByName API Returns Unbindable Address page: http://support. microsoft. com/support/kb/articles/Q217/0/01. ASP. Importing a Microsoft Certificate Using Windows NT SP3 The following problem has occurred on some Windows NT SP3 systems (CSCdt11315). When using the Client with digital certificates stored in the Microsoft certificateStreszczenie treści zawartej na stronie nr. 16
Usage Notes Wait a minute. If the PC is still not responding, press the reset button. When the PC reboots, it should not run through ScanDisk, indicating the shutdown was successful in closing all open files. This problem may occur on some PCs and not on others, and we are looking for a solution. Windows 98 shutdown has numerous issues, as can be seen the following Microsoft Knowledge Base Article: “Q238096 - How to Troubleshoot Windows 98 Second Edition Shutdown Problems” (CSCdt00729). WindowsStreszczenie treści zawartej na stronie nr. 17
Usage Notes To work around this problem, do one of the following: • Be sure to disconnect the VPN Client before shutting down. If you are having problems, check your network properties and remove the WINS entries if they are not correct for your network. • Alternatively, enable “Disconnect VPN connection when logging off”. Go to Options > Windows Logon Properties, check Disconnect VPN connection when logging off (CSCdv65165). VPN Client May Falsely Trigger Auto Initiation Connection Event thoughStreszczenie treści zawartej na stronie nr. 18
Usage Notes Network ICE BlackICE Defender Configuration Network ICE's BlackICE Defender is a traffic monitoring security product. If you properly configure it, BlackICE Defender can work with the VPN Client. You must configure BlackICE Defender for Trusting, Nervous, or Cautious mode. If you use Nervous or Cautious mode, add the public IP address of the VPN Concentrator to the list of trusted addresses. You can now configure the VPN Client to work with BlackICE Defender configured for Paranoid mStreszczenie treści zawartej na stronie nr. 19
Usage Notes Adjusting the Maximum Transmission Unit (MTU) Value - Windows Only VPN Encapsulation adds to the overall message length. To avoid refragmentation of packets, the VPN Client must reduce the MTU settings. The default MTU adjusted value is 1300 for all adapters. If the default adjustments are not sufficient, you may experience problems sending and receiving data. To avoid fragmented packets, you can change the MTU size, usually to a lower value than the default. To change the MTU size,Streszczenie treści zawartej na stronie nr. 20
Usage Notes Connection Type Procedure Physical Use the SetMTU utility supplied with the Cisco VPN Client. Adapters Dial-up Use the SetMTU utility supplied with the Cisco VPN Client. PPPoE - All Windows XP only Vendors Use SetMTU PPPoE - Windows 98 EnterNet • On the main desktop, right click on My Network Places and go to Properties. The Network window opens. • Double-click the Network TeleSystems PPPoE Adapter. • On the Network TeleSystems window, click the Advanced tab, and then click MaxFrameSStreszczenie treści zawartej na stronie nr. 1
APPENDIX A
Sample Configlets
This appendix provides sample configlets for L2VPN and Metro Ethernet service provisioning in ISC.
It contains the following sections:
• Overview, page A-1
� ERS (Point-to-Point), page A-3
� ERS (Point-to-Point) with UNI Port Security, page A-4
� EWS (Point-to-Point), page A-6
� EWS (Point-to-Point) with UNI Port Security, BPDU Tunneling, page A-7
� EWS Hybrid, page A-9
� VPLS (Multipoint) ERS, page A-12
� VPLS (Multipoint) EWS with BPDU Tunneling, page A-13
� ERS
Streszczenie treści zawartej na stronie nr. 2
Appendix A Sample Configlets Overview Note The configlets generated by ISC are only the delta between what needs to be provisioned and what currently exists on the device. This means that if a relevant CLI is already on the device, it does not show up in the associated configlet. Note The CLIs shown in bold are the most relevant commands. Note All examples in this appendix assume an MPLS core. Cisco IP Solution Center Metro Ethernet and L2VPN User Guide, 4. 2 A-2 OL-10729-01Streszczenie treści zawartej na stronie nr. 3
Appendix A Sample Configlets ERS (Point-to-Point) ERS (Point-to-Point) Configuration � Service: L2VPN/Metro Ethernet � Feature: ERS (point-to-point) � Device configuration: – The N-PE is a CISCO7600 with IOS 12. 2(18)SXF, Sup720-3BXL – The U-PE is a CISCO3750ME with 12. 2(25)EY1, no port security – L2VPN point-to-point. – C3750ME (FA1/0/4 – FA1/0/23) <–> C7600 (FA8/17) Configlets UP-E N-PE vlan 772 vlan 772 exit exit!! interface FastEthernet1/0/23 interface FastEthernet8/17 switchport trStreszczenie treści zawartej na stronie nr. 4
Appendix A Sample Configlets ERS (Point-to-Point) with UNI Port Security ERS (Point-to-Point) with UNI Port Security Configuration � Service: L2VPN/Metro Ethernet � Feature: ERS (point-to-point) with UNI port security � Device configuration: – The N-PE is a CISCO7600 with IOS 12. 2(18)SXF, OSM – The U-PE is a CISCO3550 with IOS 12. 2(25)SEC2. Port security is enabled. – L2VPN point-to-point – C3550ME (FA3/31– FA3/23) <–> C7600 (FA2/18) Configlets UP-E N-PE vlan 788 vlan 788 exit exit!! inStreszczenie treści zawartej na stronie nr. 5
Appendix A Sample Configlets ERS (Point-to-Point) with UNI Port Security � A user-defined PACL entry is added to the default PACL. 2 OL-10729-01 A-5Streszczenie treści zawartej na stronie nr. 6
Appendix A Sample Configlets EWS (Point-to-Point) EWS (Point-to-Point) Configuration � Service: L2VPN/Metro Ethernet � Feature: EWS (point-to-point) � Device configuration: – The N-PE is a CISCO7600 with IOS 12. 2(18)SXF, Sup720-3BXL – The U-PE is a CISCO3750ME with IOS 12. 2(25)EY1. No port security, no tunneling. – L2VPN point-to-point – QinQ UNI – C3750ME (FA1/0/20 – FA1/0/23) <–> C7600 (FA8/17) Configlets UP-E N-PE system mtu 1522 vlan 774! exit vlan 774! exit interface FastEthernet8/Streszczenie treści zawartej na stronie nr. 7
Appendix A Sample Configlets EWS (Point-to-Point) with UNI Port Security, BPDU Tunneling EWS (Point-to-Point) with UNI Port Security, BPDU Tunneling Configuration � Service: L2VPN/Metro Ethernet � Feature: EWS (point-to-point) with Port security, BPDU tunneling � Device configuration: – The N-PE is a CISCO7600 with IOS 12. No port security, with tunneling. – L2VPN point-to-point – QinQ UNI Cisco IP Solution Center MetrStreszczenie treści zawartej na stronie nr. 8
Appendix A Sample Configlets EWS (Point-to-Point) with UNI Port Security, BPDU Tunneling Configlets UP-E N-PE system mtu 1522 vlan 775! exit vlan 775! exit interface FastEthernet8/17! switchport trunk allowed vlan system mtu 1522 1, 451, 653, 659, 766-768, 772, 773-775, 878!! vlan 775 interface Vlan775 exit no ip address! description L2VPN EWS interface FastEthernet1/0/19 xconnect 99. 99. 8. 99 89029 encapsulation no cdp enable mpls no keepalive no shutdown switchport switchport access vlanStreszczenie treści zawartej na stronie nr. 9
Appendix A Sample Configlets EWS Hybrid EWS Hybrid Configuration � Service: L2VPN/Metro Ethernet � Feature: EWS hybrid. One side is EWS UNI; the other side is ERS NNI � Device configuration: – The N-PE is a CISCO7600 with 12. – L2VPN point-to-point – QinQ UNI – C3750ME (FA1/0/20 – FA1/0/23) <–> C7600 (FA8/17) Note The first configlet example is the EWS side (UNI). The second configlet is tStreszczenie treści zawartej na stronie nr. 10
Appendix A Sample Configlets EWS Hybrid Configlets (EWS) UP-E N-PE system mtu 1522 vlan 775! exit vlan 775! exit interface FastEthernet8/17! switchport trunk allowed vlan system mtu 1522 1, 451, 653, 659, 766-768, 772, 773-775, 878!! vlan 775 interface Vlan775 exit no ip address! description L2VPN EWS interface FastEthernet1/0/19 xconnect 99. 99 89029 encapsulation no cdp enable mpls no keepalive no shutdown switchport switchport access vlan 775 switchport mode dot1q-tunnel switchporStreszczenie treści zawartej na stronie nr. 11
Appendix A Sample Configlets EWS Hybrid Configlets (ERS) UP-E N-PE system mtu 1522 vlan 775 exit vlan 775! exit interface FastEthernet8/17 switchport trunk allowed vlan interface FastEthernet1/17 1, 451, 653, 659, 766-768, 772, 773-775, 878 switchport trunk allowed vlan! 1, 451, 653, 659, 766-768, 772, 773-775, 878 interface Vlan775 no ip address interface FastEthernet1/10 description L2VPN EWS switchport trunk allowed vlan xconnect 99. 99 89029 encapsulation 1, 451, 653, 659, 766-768, 772, 773-775, 8Streszczenie treści zawartej na stronie nr. 12
Appendix A Sample Configlets VPLS (Multipoint) ERS VPLS (Multipoint) ERS Configuration � Service: L2VPN/Metro Ethernet � Feature: VPLS (multipoint) ERS � Device configuration: – The N-PE is a CISCO7600 with IOS 12. – VPLS Multipoint VPN with VLAN 767 – C3750ME (FA1/0/21 – FA1/0/23) <–> C7600 (FA2/18) Configlets UP-E N-PE vlan 767 l2 vfi vpls_ers_1-0 manual exit vpn id 89017! neighbor 9Streszczenie treści zawartej na stronie nr. 13
Appendix A Sample Configlets VPLS (Multipoint) EWS with BPDU Tunneling VPLS (Multipoint) EWS with BPDU Tunneling Configuration � Service: L2VPN/Metro Ethernet � Feature: VPLS (multipoint) EWS with BPDU tunneling � Device configuration: – The N-PE is a CISCO7600 with IOS 12. – VPLS Multipoint VPN, with VLAN 767 – QinQ UNI – C3750ME (FA1/0/12 – FA1/0/23) <–> C7600 (FA2/18) Configlets UP-EStreszczenie treści zawartej na stronie nr. 14
Appendix A Sample Configlets ERS with 1:1 VLAN Translation ERS with 1:1 VLAN Translation Configuration � Service: L2VPN/Metro Ethernet � Feature: ERS with 1:1 VLAN translation � Device configuration: – The N-PE is a CISCO7600 with IOS 12. VLAN translation on the NNI port (uplink). – L2VPN point-to-point. – C3750ME (FA1/0/8 – GI1/1/1) <–> C7600 (FA8/34) Configlets UP-E N-PE! vlan 778 vlan 123 exit exit!! interfaceStreszczenie treści zawartej na stronie nr. 15
Appendix A Sample Configlets ERS with 2:1 VLAN Translation ERS with 2:1 VLAN Translation Configuration � Service: L2VPN/Metro Ethernet � Feature: ERS with VLAN 2:1 translation � Device configuration: – The N-PE is a CISCO7600 with IOS 12. – C3750ME (FA1/0/5 – GI1/1/1) <–> C7600 (FA8/34) Configlets UP-E N-PE vlan 567 vlan 779 exit exit!! interface FaStreszczenie treści zawartej na stronie nr. 16
Appendix A Sample Configlets ATM over MPLS (VC Mode) ATM over MPLS (VC Mode) Configuration � Service: L2VPN � Feature: ATM over MPLS (ATMoMPLS, a type of AToM) in VC mode � Device configuration: – The N-PE is a CISCO7200 with IOS 12. 0(28)S – No CE – No U-PE – L2VPN point-to-point (ATMoMPLS) – C7200 (ATM2/0) Configlets UP-E N-PE (None) interface ATM2/0. 34234 point-to-point pvc 213/423 l2transport encapsulation aal5 xconnect 99. 4. 99 89025 encapsulation mpls Comments � The N-PE is any MPStreszczenie treści zawartej na stronie nr. 17
Appendix A Sample Configlets ATM over MPLS (VP Mode) ATM over MPLS (VP Mode) Configuration � Service: L2VPN � Feature: ATM over MPLS (ATMoMPLS, a type of AToM) in VP mode � Device configuration: – The N-PE is a CISCO7200 with IOS 12. 0(28)S – No CE – No U-PE – L2VPN point-to-point (ATMoMPLS) – C7200 (ATM2/0) Configlets UP-E N-PE (None) pseudowire-class ISC-pw-tunnel-123 encapsulation mpls preferred-path interface tunnel123 disable-fallback! interface ATM2/0 atm pvp 131 l2transport xconneStreszczenie treści zawartej na stronie nr. 18
Appendix A Sample Configlets Frame Relay over MPLS Frame Relay over MPLS Configuration � Service: L2VPN � Feature: Frame Relay over MPLS (FRoMPLS, a type of AToM) � Device configuration: – The N-PE is a CISCO7200 with IOS 12. 0(28)S – No CE – No U-PE – L2VPN point-to-point (ATMoMPLS) – C7200 (ATM2/0) Configlets UP-E N-PE (None) interface Serial1/1 exit! connect C1_89001 Serial1/1 135 l2transport xconnect 99. 99 89001 encapsulation mpls Comments � The N-PE is any MPLS-enabled router.Streszczenie treści zawartej na stronie nr. 19
Appendix A Sample Configlets Frame Relay (DLCI Mode) Frame Relay (DLCI Mode) Configuration � Service: L2VPN over a L2TPv3 core � Feature: FR in DLCI mode � Device configuration: – The N-PE is a CISCO7200 with IOS 12. 0(28)S – No CE – No U-PE – L2VPN point-to-point (ATMoMPLS) – C7200 (ATM2/0) Configlets UP-E N-PE (None) pseudowire-class ISC-pw-dynamic-default encapsulation l2tpv3 ip local interface Loopback10 ip dfbit set! interface Serial3/2 encapsulation frame-relay exit! connect ISC_10Streszczenie treści zawartej na stronie nr. 20
Appendix A Sample Configlets Frame Relay (DLCI Mode) Cisco IP Solution Center Metro Ethernet and L2VPN User Guide, 4. 2 A-20 OL-10729-01Kod produktu i numer produktu (PNC) znajdują się na tabliczce znamionowej urządzenia.
1. Model, np. EWF1204W
2. Kod produktu (PNC), np, 914520402
3. Kod ML, np. 05
4. Numer seryjny
