Cisco VPN 3002 - Manual (Page 35)

1-19
VPN 3002 Hardware Client Reference
OL-1893-01
Chapter 1 Using the VPN 3002 Hardware Client Manager
Interactive Hardware Client and Individual User Authentication
Interactive Hardware Client and Individual User Authentication
Interactive hardware client and individual user authentication provide security by requiring manual
entry of usernames and passwords prior to connection. You configure these features on the VPN
Concentrator to which this VPN 3002 connects, and the VPN Concentrator pushes the policies you set
to the VPN 3002. You can use interactive hardware client authentication and individual user
authentication in combination or separately.
For complete configuration information refer to the section on the Hardware Client tab in the User
Management chapter of the VPN 3000 Series Concentrator Reference Volume 1: Configuration.
Interactive Hardware Client Authentication
When you enable interactive hardware client authentication, the VPN 3002 does not use a saved
username and password. Instead, to connect you must manually enter a valid username and password for
the VPN 3002 when prompted. When the VPN 3002 initiates the tunnel, it sends the username and
password to the VPN Concentrator to which it connects. The VPN Concentrator facilitates
authentication, on either the internal or an external server. If the username and password are valid, the
tunnel is established.
Individual User Authentication
Individual user authentication protects the central site from access by unauthorized persons on the same
LAN as the VPN 3002.
When you enable individual user authentication, each user that connects through a VPN 3002 must open
a web browser and manually enter a valid username and password to access the network behind the VPN
Concentrator, even though the tunnel already exists.
• If you direct the browser to a site on the remote network behind the VPN Concentrator, the VPN
3002 directs the browser to the proper pages for login. When you successfully log in, the browser
displays the page you originally entered.
• You can also log in by directing the browser to the private interface of the VPN 3002 html
interface.You do this by entering the IP address of the private interface in the browser Location or
Address field. The browser displays the login screen for the VPN 3002. Click the Connect/ Login
Status button to authenticate.
Note You cannot use the command-line interface to login if user authentication is enabled. You must use
a browser.
Logging In With Interactive Hardware Client and Individual User
Authentication
You access the interactive hardware client authentication and individual user authentication login
screens from the VPN 3002 Hardware Client Manager login screen. The sequence in the login example
that follows assumes that both interactive hardware client authentication and individual user
authentication are required for this VPN 3002 to connect.