Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Right now at my company we are using PPTP Windows VPN for people to connect remotely (dial-in), and we are thinking about maybe using a Cisco solution instead (The kind where you download that cisco client with that yellow lock in the system tray seems to have worked well at places I have been). So I am looking for help with my initial researching of this, particularly keywords, if you can't tell :-)

  • What is this type of VPN called? (most Google results give me the site-site VPNs, which I already know about)
  • Can it authenticate against active directory?
  • Can I run multiple servers, one at each office location?
  • Can my 2800/3800 routers act as the server? If so, In one location, I have a spare 2800, could that act as a dedicated VPN server, would that help me much (Does VPN generate much load per client)? Do I need a particular feature set (IOS version)?
  • Is this going to require additional licenses, if so, for each client, server, how is it based?
  • Anything else I should know, or maybe be thinking about?
share|improve this question
1  
Out of curiosity, why are you considering moving away from the PPTP-based VPN? –  Evan Anderson Nov 4 '09 at 15:10
    
Well it seems slow (not the best testing, but pings indicate added latency, right now we are running it on the Primary Domain Controller which probably doesn't help. A VPN server at each location would be nice, and we have a router at each location, but not always a Windows Server. Of course fixing it could be the way to go too :-) But right now I am just tasked with exploring the Cisco solution. –  Kyle Brandt Nov 4 '09 at 15:20
    
I'm fairly happy with PPTP because the client is built-in to Windows (and easy to push configuraitons out to using the Connection Manager Administration Kit). The VPN server can be Windows, or any other PPTP server. Depending on the culture of your environment and your desire to become familiar, you might find that a Linux-based PPTP server running on commodity hardware could be a nice solution. (There are various HOWTO guides out there about doing this w/ the PoPToP Linux PPTP server implementation...) –  Evan Anderson Nov 4 '09 at 15:28
    
Oh, and unless you've got a Windows NT domain there are no "Primary Domain Controller" computers... >smile< –  Evan Anderson Nov 4 '09 at 15:29
    
Well, the one that acts as the PDC emulator I should say? –  Kyle Brandt Nov 4 '09 at 15:30
show 3 more comments

5 Answers

up vote 2 down vote accepted

1) This is an IPSEC VPN, although a slightly proprietary cisco version. They can be site to site, or user to site.

2) You can use active directory for authentication, as well as many other sources.

3) If by multiple servers you mean multiple vpn servers as different end points then yes.

4) There are vpn modules available for these units, whether you can use them depends on the load you expect, but for less than a 50 simultaneous users you won't experience much of an issue, and in fact the load they can route is probably much higher. So VPN can generate a lot of load, depends on what your users are doing. I don't know what IOS version you would need to run, try to run the latest you can.

5) I believe licensing is done by simultaneous user -- plus additional incurred cost for hardware modules.

6) Cisco can support web vpn.

6) Cisco vpn is a nice standard solution, especially for Windows based remote workers. However there are a number of lower cost alternatives that implement more generic ipsec and may be appropriate like Sonicwall. Also Juniper makes some decent vpn gear. If you want to go the open source route check out openvpn, probably my favorite vpn implementation anywhere but you need to do some digging to get it working for remote workers and it may not be applicable in your situation.

share|improve this answer
    
So a module (Goes in WIC slot?) is required for each location? –  Kyle Brandt Nov 4 '09 at 15:21
    
Yes, I believe this is true for those two models. –  MattyB Nov 4 '09 at 16:03
    
I linked to a performance-related document in my answer. A crypto offload module is built onto the 2800-series routers, but you can put an add-on module in place for increased crypto performance if you desire (not required). The optional crypto offload module goes into an AIM slot. –  Evan Anderson Nov 4 '09 at 16:05
add comment

I don't know that there's a specific "name for" Cisco's Remote Access VPN technology. Their client software goes by various names ("Cisco VPN Client", "AnyConnect", etc). Cisco VPNs have used IPSEC historically, but they're starting to do SSL-based VPNs in the last few years, too.

You can use RADIUS (and the built-in Windows RADIUS server, IAS) to back-end authentication to Active Directory fairly easily. Some of the Cisco hardware (their VPN Concentrator series in particular) supported direct back-end authentication to Windows domains, too, but I still tend to use RADIUS on those devices. On a traditional IPSEC VPN this is done using XAUTH. I'm not sure what the feature is called on an SSL VPN, but it's also available.

"Can I run multiple servers ... ?" Multiple VPN end-points for clients to connect to? Sure. You've got to coordinate getting clients to connect to the right one, though. (Did I ready you right on that?)

The SSL VPN functionality is licensed per user. The IPSEC-based VPN functionality is, I believe, limited by a hard-set connection limit in IOS (so, effectively, it's licensed, too-- just in a less flexible manner).

Performance is going to depend on the traffic load. The 2800-series has a built-in crypto offload module (see the "Security" section of Cisco 2800 Series Integrated Services Routers), but there is also a module (AIM) available to do crypto offload that supposedly doubles the performance of the onboard offload module. (That document I linked there shows the IPSEC traffic throughput numbers for various 2800-series routers.)

I terminate most Cisco VPNs on ASA-5505 and PIX devices, so my experience terminating them on routers is limited. Additionally I've stayed away from their SSL-based VPN offering, primarily because the "traditional" IPSEC-based VPN has worked well for my Customers. As such, I have a lack of familiarity with both. Having said that, here are some docs here that might be helpful:

share|improve this answer
add comment

The client that you're referring to is called the AnyConnect client (which requires additional licensing for the ASA).

You can use IAS (built into Windows Server) as a radius server and authenticate against AD. However, you should also look into a TACACS+ (access control) if you'll have very many people managing your routers or firewalls.

share|improve this answer
add comment

My university are switching to Cisco VPN from PPTP, so I can tell, that it is not as good as it may seem.

Cisco is promoting SSL VPN, but its license cost per connection. It is done by AnyConnect client which Cisco develops actively.

IPsec VPN have no license per connection, but can only be done using "Cisco VPN Client", which does not support any Windows 64 bit. system. And in Windows 7 (32 bit.) it needs workarounds to work. Furthermore, there are no current plans to provide 64-bit support for the "Cisco VPN Client".

And, if you are considering ASA appliances, they have awkward and somewhat buggy management.

share|improve this answer
1  
I completely agree with this poster with respect to SSL vpns. They are really nice and some other companies have much better offerings than Cisco. If you are looking for a new solution versus working with what you have this is what I would look at. Also, the ASA is horrible, maybe the worst single piece of networking hardware I have ver used in my life. –  MattyB Nov 4 '09 at 16:04
    
I haven't found any particular "bugginess" problems with ASA devices, though I have no great love of their expense and the ongoing warranty expense associated with the shiny Cisco name-plate. I've probably installed 15 Cisco ASA-5505 devices and they've worked well for me. –  Evan Anderson Nov 4 '09 at 16:06
    
@MattyB: What are the problems you're seeing with ASA devices? I've got a number of these devices out there, and I've be interested to know if I've got "ticking time bombs" in them... –  Evan Anderson Nov 4 '09 at 16:08
    
They may not be "ticking time bombs", while I have not noticed any problems in its services delivery. Most bugs,that were encountered was in ASDM. –  Kazimieras Aliulis Nov 5 '09 at 9:23
    
You happen have any links for how to configure a cisco router as the end-point for client-to-site VPN using the IPSec VPN? (Think I am getting the vocab down :-) ) When you say it has to be the CISCO client, you can't use a openvpn client or anything like that? –  Kyle Brandt Nov 5 '09 at 14:59
show 2 more comments

Here is another alternative... ipUnplugged Mobile VPN from Radio IP Software. This is an IPSec mobile VPN based on Mobile IP standards and is always on. The user doesn't have to start/stop the VPN; it is intellegent enough to know when the user is in the the office and turns off the encryption. www.ipunplugged.com

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.