Cisco VPN 3002 - Manual (Page 121)

11-3
VPN 3002 Hardware Client Reference
OL-1893-01
Chapter 11 Policy Management
Network Extension Mode
Network Extension Mode with Split Tunneling
You always assign the VPN 3002 to a client group on the central-site VPN Concentrator. If you enable
split tunneling for that group, IPSec operates on all traffic that travels through the VPN 3002 to networks
within the network list for that group behind the central-site VPN Concentrator. PAT does not apply.
Traffic from the VPN 3002 to any other destination than those within the network list on the central-site
VPN Concentrator travels in the clear without applying IPSec. NAT translates the network addresses of
the devices on the VPN 3002 private network to the address of the VPN 3002 public interface. Thus the
network and addresses on the private side of the VPN 3002 are accessible over the tunnel, but are
protected from the Internet, that is, they cannot be accessed directly.
VPN 3000 Series Concentrator Settings Required for Network Extension Mode
For the VPN 3002 to use Network Extension mode, these are the requirements for the central-site VPN
Concentrator.
1. The VPN Concentrator at the central site must be running Software version 3.0 or later.
2. Configure a group to which you assign this VPN 3002. This includes assigning a group name and
password. See Chapter 14, User Management, in the VPN 3000 Series Concentrator Reference
Volume I.
3. Configure one or more users for the group, including usernames and passwords.
4. Configure either a default gateway or a static route to the VPN 3002 private network. See
Chapter 8, “IP Routing” in the VPN 3000 Series Concentrator Reference Volume I.
5. If you want the VPN 3002 to be able to reach devices on other networks that connect to this VPN
Concentrator, review your Network Lists. See Chapter 15, “Policy Management” in the VPN 3000
Series Concentrator Reference Volume I.