vpn roadshow optional module 8 sdm

Dual Configuration Mode: Advanced Mode expert and Wizard guided for the novice Monitor Mode provides status of interfaces and VPN tunnels On line Help System How to Assumes Network Engi

Cisco VPN Partner Technical Development

Module 8 : SDM for Routers

APAC Channels Technical Operations

• Security Device Manager Overview

• User Interface Modes

• Describe how easy it is to:

– Configure a Frame Relay interface

– Create a firewall on the router

– Create a site-to-site VPN with a pre-shared key

• Conduct a Security Audit and lock down the

router

Security Device Manager

• Easy to use

Web-based configuration tool that allows you to

configure LAN and WAN interfaces, routing, NAT,

firewalls, VPNs, and other features on your router.

Dual Configuration Mode: Advanced Mode (expert) and Wizard (guided for the novice)

Monitor Mode provides status of interfaces and VPN

tunnels

On line Help System (How to)

Assumes Network Engineer/Admin is CCNA equivalent knowledge

Non-CLI Jockeys

• Resides in Flash on router

Router Platforms Supported in SDM Phase 1

2691 2651XM 2650XM

2621XM 1760

3660 2620XM

1751 837

3745 3640

2611XM 1721

836

3725 3620

2610XM 1710

831

3700 3600

2600 1700

800

SDM will be included in Security Bundles

on each of these platforms

SDM will be included

on all of these platforms

Accessing SDM

• Supported Browsers

Netscape version 4.79

Internet Explorer version 6.0

• You run it from a PC running Microsoft

• Connect PC to the router’s Ethernet 0 or Fast

Ethernet 0 LAN Ethernet port using cross-over cable.

• Defaulted URL to access SDM:

https://10.10.10.1/archive/sdm/sdm/goSDM.shtml

Preview of User Interface

WAN Wizard

1

Each mode provides a

use Case Scenario

diagram based on the

option selected

Point and click options

• Builds IOS commands

for you

Not sure what to do?

• click “How do I”

• Help

Click Create a New

Connection to start

• Only valid WAN interfaces display.

• All pages have commands located

at the lower right.

• Click Next on each page to proceed.

WAN Wizard

Frame Relay Example

• Select the Encapsulation.

WAN Wizard

6

• Select the LMI

• Enter the DLCI

• Select IETF FR Encapsulation button for non-Cisco routers

WAN Wizard

• A summary of the WAN configuration is

displayed

• Examine the summary

• Go Back and make any changes if needed

• Click Finish to complete.

8

Deliver Configuration Changes to

Edit Existing WAN Connection

Advanced Mode – Interface Status

• SDM automatically enables the new interface.

Firewall Wizard

Two Types

• One Step Firewall

One inside and

Firewall Configuration Using Wizard Mode

2 or 3 basic steps you

Firewall Configuration Using Wizard Mode

Firewall Configuration Using Wizard Mode

VPN Wizard for Site-to-Site with

Pre-Shared Key

2

Two Wizard choices

• Quick Setup

Used between two

Cisco routers using

SDM Uses SDM

generated defaults

(you can change)

• Step by Step Wizard

More configuration

flexibility

Quick Setup

VPN Connection Configuration

• Select the existing

interface for this VPN

connection

• Identify the remote

VPN peer

• Both sides must agree

on the Pre-shared key

• Select the source

(inside) interface

• Enter the destination

IP addresses that will

Quick Setup

Summary of Configuration

• Verify the configuration

summary

• IKE Policy and

Transform set are using

SDM defaults

• IPSec Rule is generated

from the Source and

Destination fields from

the previous screen

• Click Finish to deliver to

the router

4

VPN Wizard Configuration Completion

5

6

• The IOS commands delivered are displayed

• Once delivery completes,

the new VPN connection

displays.

Advanced Mode

Viewing or Changing VPN Settings

• Use VPN mode to

view, add, or edit VPN

rules, policies, and

SDM provides a check list

of security faults found

• Other screens may appear prompting for configuration

Security Audit

5

• Review the summary

of changes that will

be delivered to the router.

• Go Back and make any changes before delivering the

configuration.

• Click Finish to begin the configuration delivery to Flash.

Advanced Mode

• Advanced Mode allows the user to jump

to the desired configuration (versus guided)

• A selection of “areas of interest”

display on the left side.

• System Properties is selected in this example

Advanced Mode, VPN – IKE - Edit

Example: To edit an IKE Policy

1 Expand the VPN tab (+)

2 Select the IKE Policies tab

3 Select the policy on the right side

4 Click Edit in the upper right corner

5 Edit window will pop up, allowing the

Monitor Mode

• Overview

Provides router status

including error log entries

• Interface Status

Select the interface to

monitor and the conditions

(packets and errors in/out

• Security Device Manager Overview

• User Interface Modes

– Wizard Mode

– Advanced Mode

– Monitor Mode

• Describe how easy it is to:

– Configure a Frame Relay interface

– Create a firewall on the router

– Create a site-to-site VPN with a pre-shared key

• Conduct a Security Audit and lock down the

router