Remote access VPNs are used to provide secure access to the corporate network by establishing an encrypted tunnel across the Internet. These connections are available any time and can be established using any access technology, for example DSL or cable broadband connections. It is important to eliminate problems with these technologies prior to troubleshooting at the higher layers, unless you are certain that there are no Layer 1 or Layer 2 issues. Some of the more common remote access VPN troubleshooting targets include the following:
- Client authentication issues
- Layer 3 misconfigurations
- Mismatched parameters
- Misconfigured user profiles
- MTU and MSS issues
- VPN client software issues
Client Authentication Issues
Authentication issues are often a result of users providing or inputting incorrect credentials. In some cases, the user account is disabled after a certain number of unsuccessful authentication attempts. When multiple users report authentication failure problems, it is also prudent to check the configuration of the authentication server. For example, the authentication server may be unreachable for any number of reasons, and there is no alternate method of authentication available, in which case, all authentication requests fail.
Layer 3 Misconfigurations
Numerous Layer 3 misconfigurations can result in remote access VPN problems. Some common issues that may affect client connectivity include the following:
- Missing or incorrect NAT configuration
- IP address allocation failure
- Incorrect split-tunneling configuration
In implementations with overlapping address space, NAT is required to allow connectivity between these address ranges. It is important to ensure that NAT is correctly configured. Alternatively, it may be that NAT is implemented as required but has been misconfigured.
When a VPN client connects to the VPN headend, the client is assigned an IP address for the logical tunnel between the client and the headend. In some cases, the client may not receive addressing information because the DHCP server is misconfigured. If addresses are assigned from a local pool, verify that the pool is configured correctly. Additionally, verify the availability of addresses in the pool; that is, that there are available addresses still left in the pool.
Incorrect addressing parameters can also cause additional connectivity issues for VPN clients. For example, if users are unable to connect to any device using the hostname but are able to connect using the IP address, check DNS availability. Such issues can be caused by incorrectly specifying the IP address of the DNS server(s) or omitting it completely from the scope.
Split tunneling is a method that is used to allow remote access VPN clients to send traffic to the Internet (unencrypted) and over the IPsec tunnel to the main office (encrypted) using the same network interface. In most cases, this functionality is disabled, meaning that all packets will traverse the IPsec tunnel destined to the main office. From there, routing protocols are used to ensure that the traffic is sent to its intended destination.
In the event that split tunneling is enabled, misconfigurations can result in a loss of connectivity for VPN clients, or, in some cases, result in intermittent connectivity, whereby these clients can reach some destinations but not others. If you do choose to enable this functionality, ensure that the implemented configuration is correct.
Mismatched Parameters
As is the case with site-to-site VPNs, mismatched IPsec parameters can also prevent users from connecting to the corporate network via VPN. Parameters should be consistent on both the headend and the client devices. It is important to check both to ensure that they do indeed match.
Misconfigured User Profiles
Misconfigured user profiles can result in resource access issues for VPN clients. For example, a user in the finance department might be erroneously assigned to the sales group. Given this, that user may be able to access sales group resources but not finance group resources. This is a common issue with SSL VPNs that allow for customizable access privileges on a per-user basis.
MTU and MSS Issues
As with site-to-site VPNs, MTU and MSS issues may result in remote access users being unable to access the Internet or experiencing slow connections through the tunnel. MTU issues will also affect Remote Desktop Protocol (RDP) and Citrix connections, which are commonly used by enterprise users. The MTU and MSS values should be adjusted accordingly, as described earlier in this chapter. Remember that these adjustments should also be performed on the client side.
VPN Client Software Issues
Client software issues are common causes of remote access VPN connectivity issues, especially when the client machine is running security software, such as firewalls and anti-x software. Anti-x simply refers to software such as anti-virus, anti-spam, and anti-spyware, for example. Verify that this software is not preventing or blocking the VPN connection.
Chapter Summary
The following section is a summary of the major points you should be aware of in this chapter.
Cable and DSL Broadband Access Technologies
- Broadband access technologies provide high-speed, always-on communication services
- Broadband access technologies support data, voice, and video
- Cable modems operate at Layer 1 and Layer 2 of the OSI reference model
- On the network side, cable modems support Ethernet and on the cable side, DOCSIS
- Cable companies use HFC networks to provide fiber and coaxial connections to the customer
- The HFC network is comprised of several components, which are as follows:
- Cable Modems
- Cable Modem Termination Systems
- Local Headend
- CMs communicate with routers (CMTS) over the HFC plant using the DOCSIS standard
- Cable modems are considered Customer Premise Equipment (CPE)
- The function of the cable modem is twofold:
- It modulates the digital data into an RF signal that is sent over the coaxial connection
- It demodulates the RF signal back into digital data
- The CMTS is a piece of equipment commonly located in a cable company’s Local Headend
- The CMTS provides high-speed data to cable subscribers
- The CMTS performs the following two functions:
- The modulation of digital data signals from the Internet into an RF signal
- The demodulation of RF signals back into digital data
- The LE is the cable operator facility where signals are processed, formatted, and distributed
- The LE is responsible for the following two actions:
- It receives television signals from sources such as satellite dishes and antennas
- It distributes these received television signals to subscribers
- DSL technologies use a wider frequency band for communicating data over twisted pair
- DSL types can be divided into two broad categories, which are SDSL and ADSL
- SDSL provides equal capacity for data traveling both upstream and downstream
- ADSL is the most common type of DSL service
- Asymmetric DSL provides different downstream and upstream speeds
- Cisco IOS software supports the following methods for connecting to DSL�
- Cisco Long Range Ethernet (LRE) Solution
- Routed Bridged Encapsulation
- Multiprotocol Encapsulation over Asynchronous Transfer Mode (ATM)
- Service Selection Gateway
- PPP over ATM (PPPoA)
- PPP over Ethernet (PPPoE)
- Important points to remember regarding PPPoE implementation include the following:
- You must install PPPoE client software on all hosts that connect to the Ethernet segment
- Based on RFC 2516, the MTU of PPPoE interfaces must be set to 1492 bytes
- PPPoE requires the configuration of a username and password pair for authentication
- PPPoE allows you to have multiple PPPoE sessions per PVC
- PPPoE is susceptible to broadcast storms and possible denial-of-service attacks
- PPPoE runs on top of AAL5 SNAP; however, it supports AAL5 MUX
- Important points to remember regarding PPPoA implementation include the following:
- PPPoA requires the configuration of a username and password pair for authentication
- PPPoA allows for IP address conservation at the CPE using NAT or PAT
- The username and password are provisioned on the CPE
- Only one IP address conservation per CPE on one VC can be used due to the single username and password pair
- The CPE username and password means only the provider can make changes
Site-to-Site VPN Technologies
- Site-to-site VPNs are VPNs that are established between dedicated VPN devices
- Site-to-site VPN solutions do not require VPN client software
- Cisco IOS software supports several site-to-site VPN solutions, including the following:
- Traditional IPsec (IP Security) VPN
- Cisco Easy VPN
- DMVPN
- Group Encrypted Transport VPN
- IPsec is a core site-to-site VPN technology. IPsec offers the following security services:
- Peer authentication
- Data confidentiality
- Data integrity
- Data origin authentication
- Replay detection
- Access control
- Traffic flow onfidentiality
- IPsec uses security association (SA) to provide security to a given IP connection
- IPsec SAs are unidirectional
- IKE is used for secure key exchange in IPsec
- IKE derives authenticated keying material and negotiates SAs for the ESP and AH protocols
- IKE uses UDP port 500
- IKE is a two-phase, multimode protocol
- IKE offers the following three methods of authenticating a remote peer:
- Public key encryption
- Pre-shared key
- Public key signature
- IKE phase 1 verifies the identity of a peer and establishes a secure communications channel
- IKE phase 1 is primarily concerned with the protection suite for IKE messages
- IKE phase 1 operations are required infrequently and can use main or aggressive mode
- IKE phase 2 is used to protect the data and establish SA for IPsec
- IKE phase 2 negotiates the protection suite, algorithms, and the traffic to be encrypted
- Unlike IKE phase 1, IKE phase 2 has one mode, which is quick mode
- IPsec can use two different modes to secure data communications using one of two modes
- The two modes are transport mode and tunnel mode
- ESP is used to provide confidentiality, integrity, and authenticity of data
- AH is used to protect the integrity and authenticity of data
Remote Access VPN Technologies
- Cisco IOS software supports both IPsec remote access VPNs and SSL remote access VPNs
- IPsec VPN solutions are the most widely used and implemented remote access VPNs
- A remote access IPsec VPN solution requires VPN client software
- SSL remote access VPNs provide secure access from any device that has a Web browser
- SSL VPNs provide two different types of access: full network access and clientless access
- Clientless access is the most flexible SSL remote access VPN solution
Troubleshooting Broadband Technologies
- Common cable access troubleshooting targets include the following:
- Dynamic Host Configuration Protocol
- Network Address Translation
- Static Route Misconfigurations
- From a troubleshooting perspective, DSL problems are due to Layer 1, 2, or 3 problems
- Some common Layer 1 (Physical Layer) issues that affect DSL service include the following:
- Cabling and interface configuration issues
- The DSL operating mode
- Circuit provisioning and local loop technologies
- Some common Layer 2 (Data Link Layer) issues that affect DSL service include the following :
- ATM PVC misconfigurations
- PPP negotiation failures
- Some common Layer 3 (Network Layer) issues that affect DSL service include the following:
- MTU and MSS issues
- Routing issues
- Address allocations
Troubleshooting Site-to-Site VPNs
- Common site-to-site VPN troubleshooting targets include the following:
- Overlapping IP address space
- GRE and IPsec configurations
- MTU size
- Routing problems
- Device resource utilization
- Some common remote access VPN troubleshooting targets include the following:
- Client authentication issues
- Layer 3 misconfigurations
- Mismatched parameters
- Misconfigured user profiles
- MTU and MSS issues
- VPN Client software issues