Switching to Cisco VPN from Windows PPTP

Question

Right now at my company we are using PPTP Windows VPN for people to connect remotely (dial-in), and we are thinking about maybe using a Cisco solution instead (The kind where you download that cisco client with that yellow lock in the system tray seems to have worked well at places I have been). So I am looking for help with my initial researching of this, particularly keywords, if you can't tell :-)

• What is this type of VPN called? (most Google results give me the site-site VPNs, which I already know about)
• Can it authenticate against active directory?
• Can I run multiple servers, one at each office location?
• Can my 2800/3800 routers act as the server? If so, In one location, I have a spare 2800, could that act as a dedicated VPN server, would that help me much (Does VPN generate much load per client)? Do I need a particular feature set (IOS version)?
• Is this going to require additional licenses, if so, for each client, server, how is it based?
• Anything else I should know, or maybe be thinking about?

Answer 1

1) This is an IPSEC VPN, although a slightly proprietary cisco version. They can be site to site, or user to site.

2) You can use active directory for authentication, as well as many other sources.

3) If by multiple servers you mean multiple vpn servers as different end points then yes.

4) There are vpn modules available for these units, whether you can use them depends on the load you expect, but for less than a 50 simultaneous users you won't experience much of an issue, and in fact the load they can route is probably much higher. So VPN can generate a lot of load, depends on what your users are doing. I don't know what IOS version you would need to run, try to run the latest you can.

5) I believe licensing is done by simultaneous user -- plus additional incurred cost for hardware modules.

6) Cisco can support web vpn.

6) Cisco vpn is a nice standard solution, especially for Windows based remote workers. However there are a number of lower cost alternatives that implement more generic ipsec and may be appropriate like Sonicwall. Also Juniper makes some decent vpn gear. If you want to go the open source route check out openvpn, probably my favorite vpn implementation anywhere but you need to do some digging to get it working for remote workers and it may not be applicable in your situation.

Answer 2

My university are switching to Cisco VPN from PPTP, so I can tell, that it is not as good as it may seem.

Cisco is promoting SSL VPN, but its license cost per connection. It is done by AnyConnect client which Cisco develops actively.

IPsec VPN have no license per connection, but can only be done using "Cisco VPN Client", which does not support any Windows 64 bit. system. And in Windows 7 (32 bit.) it needs workarounds to work. Furthermore, there are no current plans to provide 64-bit support for the "Cisco VPN Client".

And, if you are considering ASA appliances, they have awkward and somewhat buggy management.

Answer 3

The client that you're referring to is called the AnyConnect client (which requires additional licensing for the ASA).

You can use IAS (built into Windows Server) as a radius server and authenticate against AD. However, you should also look into a TACACS+ (access control) if you'll have very many people managing your routers or firewalls.

Answer 4

I don't know that there's a specific "name for" Cisco's Remote Access VPN technology. Their client software goes by various names ("Cisco VPN Client", "AnyConnect", etc). Cisco VPNs have used IPSEC historically, but they're starting to do SSL-based VPNs in the last few years, too.

You can use RADIUS (and the built-in Windows RADIUS server, IAS) to back-end authentication to Active Directory fairly easily. Some of the Cisco hardware (their VPN Concentrator series in particular) supported direct back-end authentication to Windows domains, too, but I still tend to use RADIUS on those devices. On a traditional IPSEC VPN this is done using XAUTH. I'm not sure what the feature is called on an SSL VPN, but it's also available.

"Can I run multiple servers ... ?" Multiple VPN end-points for clients to connect to? Sure. You've got to coordinate getting clients to connect to the right one, though. (Did I ready you right on that?)

The SSL VPN functionality is licensed per user. The IPSEC-based VPN functionality is, I believe, limited by a hard-set connection limit in IOS (so, effectively, it's licensed, too-- just in a less flexible manner).

Performance is going to depend on the traffic load. The 2800-series has a built-in crypto offload module (see the "Security" section of Cisco 2800 Series Integrated Services Routers), but there is also a module (AIM) available to do crypto offload that supposedly doubles the performance of the onboard offload module. (That document I linked there shows the IPSEC traffic throughput numbers for various 2800-series routers.)

I terminate most Cisco VPNs on ASA-5505 and PIX devices, so my experience terminating them on routers is limited. Additionally I've stayed away from their SSL-based VPN offering, primarily because the "traditional" IPSEC-based VPN has worked well for my Customers. As such, I have a lack of familiarity with both. Having said that, here are some docs here that might be helpful:

• Remote-Access VPNs: Business Productivity, Deployment, and Security Considerations - More of sales-babble than anyting, but speaks about the differences between their SSL and IPSEC-based VPN offerings.

• Network Security Features on the Cisco Integrated Services Routers - Discussed the features available on IOS routers re: security, including the 2800-series

• Cisco IOS SSL VPN Q&A - Includes details about licensing the SSL VPN functionality.

Answer 5

Here is another alternative... ipUnplugged Mobile VPN from Radio IP Software. This is an IPSec mobile VPN based on Mobile IP standards and is always on. The user doesn't have to start/stop the VPN; it is intellegent enough to know when the user is in the the office and turns off the encryption. www.ipunplugged.com