Cisco 877 - As a VPN termination point only (Something secure like SSL)

DJMK4

DJMK4

DJMK4

Soldato
Joined
1 Dec 2004
Posts
23,082
Location
S.Wales
Hi all,

I have a spare Cisco 877 router which is not being used, the router I am using at home for my FTTC does not have any IPSec Remote Access or Site-to-Site VPN capabilities.

What I was thinking of doing is configuring and placing a Cisco 877 behind the network which will be used to terminate VPN.

Now I know it is possible to do, however, I want it to use something secure (more secure than PPTP)

what I will do is allow my router which is on my WAN connection to allow VPN ports through to the cisco so it can manage the VPN, I know the Cisco defenatly has capabilities of PPTP, IPSec (Site to site)

I just need confirmation to see if it can use anything more secure than PPTP for the RAS VPN, web guides are not confirming, or denying if it does or not

Its using later K9 security enhanced IOS image.

Anyone able to confirm?

EDIT: Just found this, will this allow me to connect to the SSL VPN server running on a Cisco, behind my current router?



http://www.cisco.com/c/en/us/support/docs/security/ssl-vpn-client/70790-svcios.html

"SSL VPN Client (SVC Full Tunnel Mode)—Downloads a small client to the remote workstation and allows full secure access to resources on an internal corporate network. You can download the SVC to a remote workstation permanently, or you can remove the client once the secure session is closed."

Uses a third party client but should be what I need, anyone able to better this? I was going to use a Microsoft VPN connection to it using some sort of secure protocol, but this will give me SSL.
 
Last edited:
Just as a note, I am planning on putting this behind a TPLink router, which is fronting my FTTC connection, I wanted to move my VPN from terminating on an Windows 2008 R2 Virtual Machine to terminating on the Cisco 877.


Is this a plausible option?
 
I can't see any reason why this wouldn't work. If you're going for the Anyconnect method then that's solid. I've only set it up on ASAs but either way it works well. You may need to tweak some routing on the TPLink, depending on how you're intending to have your final topology. If there's anything specific let me know

- GP
 
Thanks,

Well only having 1 Static IP address available, would it be safe to say just forward what ever ports are required by the VPN to the router


TPLink -------Normal Traffic (Port Forward xx ports to IP of the 877) -------Cisco 877
(WAN)

Then hanging off my Cisco 877 I have 3 spare FastEthernet ports populated with links to various server NIC's.

I will obviously have control over what networks the VPN user(s) will have access to.

Will I run in to any problem with the port forwarding part do you think, or the traffic going back out (routing)

I guess from a routing perspective on the 877, I can just set-up a default route out via the default gateway (tp-link)?


On 877

ip route 0.0.0.0 0.0.0.0 192.168.0.1

Will I need any routing on the TPLink? or just port forward VPN ports to the 877?

Many thanks for your reply.
 
Last edited:
In theory what your saying is fine, it depends though on how the TPLink routes. Id have a eparate network between the Cisco and TP with a route inbound to your internal network (outside of the 877), so more like

Internet --- [TPLINK]--192.168.1.0/24--[Cisco]--192.168.2.0/24--servers & PCs

Which would keep NAT on the TPLink

- GP
 
GhostlyPea said:
In theory what your saying is fine, it depends though on how the TPLink routes. Id have a eparate network between the Cisco and TP with a route inbound to your internal network (outside of the 877), so more like

Internet --- [TPLINK]--192.168.1.0/24--[Cisco]--192.168.2.0/24--servers & PCs

Which would keep NAT on the TPLink

- GP
Click to expand...

If I do it this way, I would still network behind the TP link that usabke for devices, so let's say

Internet --tplink with lan and WiFi network 192.168.0.0/24 ---route to Cisco network on tplink---cisco 877 --server network 192.168.1.0/24

Assuming this matches what you are saying.

Will have a play around

Thanks
 
You must log in or register to reply here.
Back
Top Bottom