Download Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD).test-king.300-425.2020-01-09.1e.25q.vcex

Enabling PPPoE in a VPDN Group  
Perform this task to enable PPPoE in a virtual private dial-up network (VPDN) group. 
Restrictions 
This task applies only to releases prior to Cisco IOS Release 12.2(13)T. 
SUMMARY STEPS  
enable  
configure terminal 
vpdn enable 
vpdn-group name 
request-dialin 
protocol pppoe 
DETAILED STEPS 

  

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t2/feature/guide/ftpppoec_support_TSD_Island_of_Content_Chapter.html

To configure the autonomous-system number for an Enhanced Interior Gateway Routing Protocol (EIGRP) routing process to run within a VPN routing and forwarding (VRF) instance, use the autonomous-system command in address-family configuration mode. To remove the autonomous-system for an EIGRP routing process from within a VPN VRF instance, use the no form of this command. 
Autonomous-system autonomous-system-number  
no autonomous-system autonomous-system-number 
Reference: http://www.cisco.com/c/en/us/td/docs/ios/iproute_eigrp/command/reference/ire_book/ire_a1.html#wp1062796

DMVPN Tunnel Flaps Intermittently 
Problem 
DMVPN tunnel flaps intermittently. 
Solution 
When DMVPN tunnels flap, check the neighborship between the routers as issues with neighborship formation between routers may cause the DMVPN tunnel to flap. In order to resolve this problem, make sure the neighborship between the routers is always up. 
Reference: http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/29240-dcmvpn.html#Prblm1

The Cisco AnyConnect VPN Client provides secure SSL connections to the security appliance for remote users. Without a previously installed client, remote users enter the IP address in their browser of an interface configured to accept SSL VPN connections. Unless the security appliance is configured to redirect http:// requests to https://, users must enter the URL in the form https://<address>.
After entering the URL, the browser connects to that interface and displays the login screen. If the user satisfies the login and authentication, and the security appliance identifies the user as requiring the client, it downloads the client that matches the operating system of the remote computer. After downloading, the client installs and configures itself, establishes a secure SSL connection and either remains or uninstalls itself (depending on the security appliance configuration) when the connection terminates. 
Reference: http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100936-asa8x-split-tunnel-anyconnect-config.html

Dynamic Multipoint Virtual Private Network (DMVPN) is a dynamic tunneling form of a virtual private network (VPN) supported on Cisco IOS-based routers and Unix-like Operating Systems based on the standard protocols, GRE, NHRP and Ipsec. This DMVPN provides the capability for creating a dynamic-mesh VPN network without having to pre-configure (static) all possible tunnel end-point peers, including Ipsec (Internet Protocol Security) and ISAKMP (Internet Security Association and Key Management Protocol) peers. DMVPN is initially configured to build out a hub-and-spoke network by statically configuring the hubs (VPN headends) on the spokes, no change in the configuration on the hub is required to accept new spokes. Using this initial hub-and-spoke network, tunnels between spokes can be dynamically built on demand (dynamic-mesh) without additional configuration on the hubs or spokes. This dynamic-mesh capability alleviates the need for any load on the hub to route data between the spoke networks. 
DMVPN is combination of the following technologies:
Multipoint GRE (mGRE) 
Next-Hop Resolution Protocol (NHRP) 
Dynamic Routing Protocol (EIGRP, RIP, OSPF, BGP) 
Dynamic Ipsec encryption 
Cisco Express Forwarding (CEF) 
Reference: http://en.wikipedia.org/wiki/Dynamic_Multipoint_Virtual_Private_Network

Configuring NAT to Allow Internal Users to Access the Internet Using Overloading 

  

Note in the previous second configuration, the NAT pool “ovrld”only has a range of one address. The keyword overload used in the ip nat inside source list 7 pool ovrld overload command allows NAT to translate multiple inside devices to the single address in the pool. 
Reference: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml