Cisco Broadband Cable Command Reference Guide

crypto ipsec client ezvpn (interface configuration)
5-34
Cisco Broadband Cable Command Reference Guide
Chapter 5 Cable CPE Commands
Usage Guidelines The crypto ipsec client ezvpn command assigns a Cisco Easy VPN Remote configuration to an
interface, enabling the creation of a virtual private network (VPN) connection over that interface to the
specified VPN peer. If the Cisco Easy VPN Remote configuration is configured for the client mode of
operation, this also automatically configures the router for network address translation (NAT)/port
address translation (PAT) and an associated access list.
Cisco IOS Release 12.2(8)YJ enhanced the command to allow you to configure multiple outside and
inside interfaces. To configure multiple outside and inside interfaces, you must use the interface
interface-name command to first define type of interface on the IPSec client router.
In client mode for the Cisco Easy VPN Remote feature, a single security association (SA)
connection is used for encrypting and decrypting the traffic coming from all the inside interfaces. In
network extension mode, one SA connection is established for each inside interface.
When a new inside interface is added or an existing one is removed, all established security
association (SA) connections are deleted and new ones are initiated.
Configuration information for the default inside interface is shown with the crypto ipsec client
ezvpn name inside command. All inside interfaces, whether they belong to a tunnel, are listed in
interface configuration mode, as an inside interface, along with the tunnel name.
The following Cisco IOS Release 12.2(4)YA restrictions apply to the crypto ipsec client ezvpn
command:
In Cisco IOS Release 12.2(4)YA, the Cisco Easy VPN Remote feature supports only one tunnel, so
the crypto ipsec client ezvpn command can be assigned to only one interface. If you attempt to
assign it to more than one interface, an error message is displayed. You must use the no form of this
command to remove the configuration from the first interface before assigning it to the second
interface.
The crypto ipsec client ezvpn command should be assigned to the outside interface of the NAT/PAT
translation. This command cannot be used on the inside NAT/PAT interface. On some platforms, the
inside and outside interfaces are fixed.
For example, on Cisco uBR905 and Cisco uBR925 cable access routers, the outside interface is
always the cable interface. On Cisco 1700 series routers, the Fast Ethernet interface defaults to being
the inside interface, so attempting to use the crypto ipsec client ezvpn command on the Fast
Ethernet interface displays an error message.
Note You must first use the global configuration version of the crypto ipsec client ezvpn command to create
a Cisco Easy VPN Remote configuration before assigning it to an interface.
Examples The following example shows a Cisco Easy VPN Remote configuration named telecommuter-client
being assigned to the cable interface on a Cisco uBR905/uBR925 cable access router:
Router# config t
Router(config)# interface c0
Router(config-if)# crypto ipsec client ezvpn telecommuter-client
Router(config-if)# exit
Router(config)#
The following example first shows an attempt to delete the Cisco Easy VPN Remote configuration
named telecommuter-client, but the configuration cannot be deleted because it is still assigned to an
interface. The configuration is then removed from the interface and then deleted:
Router# config t
Router(config)# no crypto ipsec client ezvpn telecommuter-client
OL-1581-05