Cisco 2901 User Manual

133
Cisco 3900 Series, Cisco 2900 Series, and Cisco 1900 Series Integrated Services Routers Generation 2 Software Configuration Guide
Chapter Configuring Security Features
Configuring VPN
Note The Cisco Easy VPN client feature supports configuration of only one destination peer. If your
application requires creation of multiple VPN tunnels, you must manually configure the IPSec VPN and
Network Address Translation/Peer Address Translation (NAT/PAT) parameters on both the client and the
server.
Cisco 3900 series, 2900 series, and 1900 series ISRs can be also configured to act as Cisco Easy VPN
servers, letting authorized Cisco Easy VPN clients establish dynamic VPN tunnels to the connected
network. For information on configuring Cisco Easy VPN servers, see the Easy VPN Server feature at:
http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ftunity.html.
Site-to-Site VPN Example
The configuration of a site-to-site VPN uses IPSec and the generic routing encapsulation (GRE) protocol
to secure the connection between the branch office and the corporate network. Figure 2 shows a typical
deployment scenario.
Figure 2 Site-to-Site VPN Using an IPSec Tunnel and GRE
For more information about IPSec and GRE configuration, see the Configuring Security for VPNs with
IPSec” chapter of Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4T at:
http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/12_4t/
sec_secure_connectivity_12_4t_book.html.
Configuration Examples
Each example configures a VPN over an IPSec tunnel, using the procedure given in the “Configure a
VPN over an IPSec Tunnel” section on page 134. Then, the specific procedure for a remote access
configuration is given, followed by the specific procedure for a site-to-site configuration.
1 Branch office containing multiple LANs and VLANs
2 Fast Ethernet LAN interface—With address 192.165.0.0/16 (also the inside interface for NAT)
3 VPN client—Cisco 3900 series, 2900 series, or 1900 series ISR
4 Fast Ethernet or ATM interface—With address 200.1.1.1 (also the outside interface for NAT)
5 LAN interface—Connects to the Internet; with outside interface address of 210.110.101.1
6 VPN client—Another router, which controls access to the corporate network
7 LAN interface—Connects to the corporate network; with inside interface address of 10.1.1.1
8 Corporate office network
9 IPSec tunnel with GRE
121783
Internet
3
1
2 4 5 7
6
8
9

Cisco 2901 Specifications

General

Operating altitude	0 - 3000 m
Non-operating altitude	0 - 4570 m
Storage temperature (T-T)	-40 - 70 °C
Operating temperature (T-T)	0 - 40 °C
Storage relative humidity (H-H)	5 - 95 %
Operating relative humidity (H-H)	10 - 85 %
Ethernet LAN	Yes
Cabling technology	10/100/1000BASE-T(X)
Networking standards	IEEE 802.1Q, IEEE 802.1ag, IEEE 802.3, IEEE 802.3ab, IEEE 802.3af, IEEE 802.3ah
Ethernet LAN data rates	10, 100, 1000 Mbit/s
Ethernet interface type	Gigabit Ethernet
DHCP client	-
Routing protocols	BGP, EIGRP, OSPF
Supported protocols	IPv4, IPv6, IS-IS, IGMPv3, PIM SM, SSM, DVMRP, IPSec, GRE, BVD, MPLS, L2TPv3, PPP, MLPPP, MLFR, HDLC, RS-232, RS-449, X.21, V.35, EIA-530, PPPoE, ATM
USB version	2.0
RS-232 ports	1
Expansion slots	4 x EHWIC 2 x DSP 1 x ISM
Ethernet LAN (RJ-45) ports	2
Firewall security	Cisco IOS
Input current	1.5 A
AC input voltage	100 - 240 V
Power source type	AC
AC input frequency	47 - 63 Hz
Power consumption (typical)	40 W
Product color	Black
Rack capacity	1U
Safety	UL 60950-1, CAN/CSA C22.2 No. 60950-1, EN 60950-1, AS/NZS 60950-1, IEC 60950-1
Flash memory	256 MB
Internal memory	512 MB
Electromagnetic compatibility	47 CFR, ICES-003, EN55022, CISPR22, AS/NZS 3548, VCCI V-3, EN 300-386, EN 61000, EN 55024, CISPR 24EN50082-1

Weight and Dimensions

Depth	439.4 mm
Width	438.2 mm
Height	44.5 mm
Weight	6100 g