Clientless Secure Sockets Layer (SSL) VPN on a Cisco Router

To allow clientless remote access users permission to corporate applications, the security appliance (ISR) acts as a proxy. It converts web and even some non-web applications so that they can be protected by SSL. The Cisco ISR offers the following techniques to provide resource and application access:

* URL and Common Internet File System (CIFS) file access: When the client browser establishes the SSL session and the user is authenticated, the gateway can present a page with resource bookmarks. These allow the user to access pre-configured web pages or file shares. The user can also enter an address of a resource and access it that way if it is within the user's permission.

* Port forwarding: Provide access to TCP-based applications by mapping application-specific ports on the remote computer to application-specific ports on the internal servers. Port forwarding requires that a Java applet be downloaded to the client. This applet listens on ports on the client machine and forwards the connection to the gateway.

Deployment Tasks

The basic deployment tasks for creating a basic Cisco IOS Software SSL VPN with either client-based or clientless solution are as follows:

Task 1: Configure the ISR with basic SSL VPN gateway features to include provisioning a certificate to enable SSL/TLS server authentication.

Task 2: Configure basic user authentication by adding user accounts with passwords and creating an access policy for all remote users.

Task 3: (Optional) Configure full tunneling VPN access to internal resources if the connection requires access that is like being connected to the internal network directly.

Task 4: (Optional) Deploy the Cisco AnyConnect VPN client if full tunneling is required.

Task 5: (Optional) Configure clientless VPN access to internal resources if the connection only requires browser-based access.


In this scenario, I've used my 1841 router with Advance Security IOS as the SSL VPN gateway since this device have enough space on its flash memory to load the Cisco AnyConnect file.

R1#show flash
-#- --length-- -----date/time------ path
1         1821 Nov 19 2007 23:57:00 +00:00 sdmconfig-18xx.cfg
2       861696 Nov 19 2007 23:57:20 +00:00 es.tar
3      1164288 Nov 19 2007 23:57:46 +00:00 common.tar
4         1038 Nov 19 2007 23:58:10 +00:00 home.shtml
5       113152 Nov 19 2007 23:58:30 +00:00 home.tar
6     21846564 Jan 26 2013 10:03:34 +00:00 c1841-advsecurityk9-mz.124-9.T.bin

R1#copy tftp://172.16.1.50/anyconnect-win-2.5.1025-k9.pkg flash
Destination filename [anyconnect-win-2.5.1025-k9.pkg]?
Accessing tftp://172.16.1.50/anyconnect-win-2.5.1025-k9.pkg...
Loading anyconnect-win-2.5.1025-k9.pkg from 172.16.1.50 (via FastEthernet0/1): !!!!!!!!!!!!!!!!!!
[OK - 4436544 bytes]

4436544 bytes copied in 19.988 secs (221960 bytes/sec)

R1#show flash
-#- --length-- -----date/time------ path
1         1821 Nov 19 2007 23:57:00 +00:00 sdmconfig-18xx.cfg
2       861696 Nov 19 2007 23:57:20 +00:00 es.tar
3      1164288 Nov 19 2007 23:57:46 +00:00 common.tar
4         1038 Nov 19 2007 23:58:10 +00:00 home.shtml
5       113152 Nov 19 2007 23:58:30 +00:00 home.tar
6     21846564 Jan 26 2013 10:03:34 +00:00 c1841-advsecurityk9-mz.124-9.T.bin
7      4436544 Jan 27 2013 02:00:54 +00:00 anyconnect-win-2.5.1025-k9.pkg

4718592 bytes available (27197440 bytes used)

R1#configure terminal
R1(config)#aaa ?
  new-model  Enable NEW access control commands and functions.(Disables OLD
             commands.)

R1(config)#aaa new-model
R1(config)#aaa ?
  accounting      Accounting configurations parameters.
  attribute       AAA attribute definitions
  authentication  Authentication configurations parameters.
  authorization   Authorization configurations parameters.
  cache           AAA cache definitions
  configuration   Authorization configuration parameters.
  dnis            Associate certain AAA parameters to a specific DNIS number
  group           AAA group definitions
  local           AAA Local method options
  max-sessions    Adjust initial hash size for estimated max sessions
  nas             NAS specific configuration
  new-model       Enable NEW access control commands and functions.(Disables
                  OLD commands.)
  pod             POD processing
  route           Static route downloading
  session-id      AAA Session ID
  session-mib     AAA session MIB options
  traceback       Traceback recording
  user            AAA user definitions

R1(config)#aaa authentication ?
  arap             Set authentication lists for arap.
  attempts         Set the maximum number of authentication attempts
  banner           Message to use when starting login/authentication.
  dot1x            Set authentication lists for IEEE 802.1x.
  enable           Set authentication list for enable.
  eou              Set authentication lists for EAPoUDP
  fail-message     Message to use for failed login/authentication.
  login            Set authentication lists for logins.
  password-prompt  Text to use when prompting for a password
  ppp              Set authentication lists for ppp.
  sgbp             Set authentication lists for sgbp.
  username-prompt  Text to use when prompting for a username

R1(config)#aaa authentication login ?
  WORD     Named authentication list.
  default  The default authentication list.

R1(config)#aaa authentication login SSL_VPN_AUTHENTICATION ?
  enable         Use enable password for authentication.
  group          Use Server-group
  krb5           Use Kerberos 5 authentication.
  krb5-telnet    Allow logins only if already authenticated via Kerberos V
                 Telnet.
  line           Use line password for authentication.
  local          Use local username authentication.
  local-case     Use case-sensitive local username authentication.
  none           NO authentication.
  passwd-expiry  enable the login list to provide password aging support

R1(config)#aaa authentication login SSL_VPN_AUTHENTICATION local
R1(config)#username vpnuser password cisco123
R1(config)#ip http ?
  access-class                   Restrict http server access by access-class
  active-session-modules         Set up active http server session modules
  authentication                 Set http server authentication method
  client                         Set http client parameters
  help-path                      HTML help root URL
  max-connections                Set maximum number of concurrent http server
                                 connections
  path                           Set base path for HTML
  port                           Set http port
  secure-active-session-modules  Set up active http secure server session
                                 modules
  secure-ciphersuite             Set http secure server ciphersuite
  secure-client-auth             Set http secure server with client
                                 authentication
  secure-port                    Set http secure server port number for
                                 listening
  secure-server                  Enable HTTP secure server
  secure-trustpoint              Set http secure server certificate trustpoint
  server                         Enable http server
  session-module-list            Set up a http(s) server session module list
  timeout-policy                 Set http server time-out policy parameters

R1(config)#ip http server
R1(config)#ip http secure-server
Jan 27 02:52:22.947: %PKI-6-AUTOSAVE: Running configuration saved to NVRAM
R1(config)#ip local ?
  policy  Enable policy routing
  pool    IP Local address pool lists

R1(config)#ip local pool ?
  WORD     Create named local address pool
  default  Create default local address pool

R1(config)#ip local pool SSL_VPN_POOL ?
  A.B.C.D     First IP address of range
  cache-size  Number of free entries to search
  group       Create ip local pool group
  <cr>

R1(config)#ip local pool SSL_VPN_POOL 192.168.1.10 ?
  A.B.C.D     Last IP address of range
  cache-size  Number of free entries to search
  group       Create ip local pool group
  <cr>

R1(config)#ip local pool SSL_VPN_POOL 192.168.1.10 192.168.1.150

R1(config)#webvpn ?
  context  Specify webvpn context
  gateway  Virtual Gateway configuration
  install  Install package command

R1(config)#webvpn install ?
  csd  Install a Secure Desktop package
  svc  Install a SSLVPN Client package
  <cr>

R1(config)#webvpn install svc ?
  WORD  Filename of installing package

R1(config)#webvpn install svc anyconnect-win-2.5.1025-k9.pkg
SSLVPN Package SSL-VPN-Client : installed successfully

SSL_VPN_GW(config)#webvpn gateway ?
  WORD  Name of virtual gateway

R1(config)#webvpn gateway SSL_VPN_GW
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R1(config-webvpn-gateway)#
Jan 27 02:44:43.279: %SSH-5-ENABLED: SSH 1.99 has been enabled
Jan 27 02:44:44.827: %PKI-4-NOAUTOSAVE: Configuration was modified.  Issue "write memory" to save new certificate
R1(config-webvpn-gateway)#do write memory
Building configuration...
[OK]
R1(config-webvpn-gateway)#?
SSLVPN Gateway Submode commands:
  exit           Exit from gateway configuration mode
  hostname       Hostname used in URL & Cookie mangling
  http-redirect  enable HTTP redirect feature
  inservice      Enable webvpn gateway
  ip             Virtual Gateway IP config
  no             Negate or set default values of a command
  ssl            SSL configurations for front end client connections

R1(config-webvpn-gateway)#ip ?
  address  Virtual Gateway IPaddr

R1(config-webvpn-gateway)#ip address ?
  A.B.C.D  Gateway IP address

R1(config-webvpn-gateway)#ip address 172.16.1.254 ?
  port       port configuration
  secondary  configure gateway as secondary IP
  <cr>

R1(config-webvpn-gateway)#ip address 172.16.1.254 port ?
  443           Default secure port
  <1025-65535>  Port number

R1(config-webvpn-gateway)#ip address 172.16.1.254 port 443
R1(config-webvpn-gateway)#http-redirect ?
  port  port number to redirect
  <cr>

R1(config-webvpn-gateway)#http-redirect port ?
  80            Default redirect port
  <1025-65535>  Port number

R1(config-webvpn-gateway)#http-redirect port 80
R1(config-webvpn-gateway)#ssl ?
  encryption  SSL transforms
  trustpoint  SSL trustpoint

R1(config-webvpn-gateway)#ssl encryption ?
  3des-sha1  3DES and SHA1
  aes-sha1   AES and SHA1
  rc4-md5    RC4 and MD5

R1(config-webvpn-gateway)#ssl encryption 3des-sha1 ?
  aes-sha1  AES and SHA1
  rc4-md5   RC4 and MD5
  <cr>

R1(config-webvpn-gateway)#ssl encryption 3des-sha1 aes-sha1
R1(config-webvpn-gateway)#inservice
R1(config-webvpn-gateway)#exit
R1(config)#do show webvpn gateway

Gateway Name                       Admin  Operation
------------                       -----  ---------
SSL_VPN_GW                         up     up


R1(config)#webvpn context ?
  WORD  Name of webvpn context

R1(config)#webvpn context SSL_VPN_CONTEXT
R1(config-webvpn-context)#?
SSLVPN Submode commands:
  aaa                   AAA config for context
  csd                   Cisco Secure Desktop config
  default-group-policy  Default group policy
  exit                  Exit from SSLVPN mode
  gateway               Associate gateway to context
  inservice             Bring context to inservice
  login-message         Login messsage to be displayed
  logo                  Logo file to be displayed
  max-users             Maximum users for this context
  nbns-list             NBNS list configuration submode
  no                    Negate or set default values of a command
  policy                Policy configuration
  port-forward          Port-forward list config submode
  secondary-color       Secondary color for the browser
  secondary-text-color  Secondary text color for the browser
  ssl                   SSL configurations for backend server connections
  text-color            Text color for the browser
  title                 Title to be displayed on the browser
  title-color           Title color for the browser
  url-list              URL list configuration submode
  vrf-name              VRF associated to context

R1(config-webvpn-context)#gateway SSL_VPN_GW
R1(config-webvpn-context)#policy ?
  group  Group Policy configuration

R1(config-webvpn-context)#policy group ?
  WORD  Group Policy name

R1(config-webvpn-context)#policy group SSL_VPN_POLICY
R1(config-webvpn-group)#?
SSLVPN Group Policy Configuration Commands:
  banner        Specify the banner to be used
  citrix        Citrix configuration
  exit          Exit from group-policy configuration mode
  filter        Network ACL
  functions     Configuring VPN features
  hide-url-bar  Disable URL bar on portal page
  nbns-list     NBNS list
  no            Negate a command or set its defaults
  port-forward  Port-forward list
  svc           Tunnel specific configuration
  timeout       WebVPN timeout values
  url-list      URL list

R1(config-webvpn-group)#banner ?
  WORD  Banner string

R1(config-webvpn-group)#banner "Welcome to SSL VPN Lab"
R1(config-webvpn-group)#functions ?
  file-access   Enable File Access
  file-browse   Allow File Browsing
  file-entry    Allow File Entry
  svc-enabled   Enabled to run tunnel-mode
  svc-required  Required to run tunnel-mode

R1(config-webvpn-group)#functions svc-enabled
R1(config-webvpn-group)#svc ?
  address-pool           Assign addresses from the pool to remote users
  default-domain         Specify the default domain
  dns-server             DNS Server
  dpd-interval           WebVPN dpd interval
  homepage               Specify the homepage to be used
  keep-client-installed  Keep tunnel client installed after termination
  msie-proxy             Microsoft Internet Explorer browser proxy settings
  rekey                  SSLVPN Client rekey command
  split                  Split Tunnel configuration commands
  wins-server            WINS Server

R1(config-webvpn-group)#svc keep-client-installed
R1(config-webvpn-group)#svc address-pool ?
  WORD  Address pool name

R1(config-webvpn-group)#svc address-pool SSL_VPN_POOL
R1(config-webvpn-group)#exit
R1(config-webvpn-context)#default-group-policy ?
  WORD  default group policy name

R1(config-webvpn-context)#default-group-policy SSL_VPN_POLICY
R1(config-webvpn-context)#aaa ?
  accounting      accounting parameters
  authentication  authetication parameters

R1(config-webvpn-context)#aaa authentication ?
  domain  domain to be used for authentication
  list    authetication list

R1(config-webvpn-context)#aaa authentication list ?
  WORD  list name

R1(config-webvpn-context)#aaa authentication list SSL_VPN_AUTHENTICATION
R1(config-webvpn-context)#inservice
Jan 27 03:12:21.843: %SSLVPN-5-UPDOWN: sslvpn context : SSL_VPN_CONTEXT changed state to UP
R1(config-webvpn-context)#do show webvpn context

Codes: AS - Admin Status, OS - Operation Status
       VHost - Virtual Host

Context Name        Gateway  Domain/VHost      VRF      AS    OS
------------        -------  ------------      -------  ----  --------
SSL_VPN_CONTEXT     SSL_VPN_ -                 -        up    up


For some reason the SSL VPN connection initially didn't work. So I ran some debugs on R1 and found the error. My Google search has led me that the error is due to an incompatible cipher algorithm. I've changed it to another type and it was loading successfully afterwards.

R1#debug ssl openssl errors
<output truncated>
Jan 27 06:40:00.854: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:00.858: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:02.846: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:02.850: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:02.970: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:02.970: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:02.978: SSLVPN: sslvpn process rcvd context queue event
Jan 27 06:40:02.978: SSLVPN: Entering APPL with Context: 0x64703D58,
          Data buffer(buffer: 0x649035D8, data: 0xE75BD078, len: 1,
          offset: 0, domain: 0)
Jan 27 06:40:02.978: SSLVPN: Fragmented App data - buffered
Jan 27 06:40:02.978: SSLVPN: Entering APPL with Context: 0x64703D58,
          Data buffer(buffer: 0x649035B8, data: 0xE7204718, len: 483,
          offset: 0, domain: 0)
Jan 27 06:40:02.978: SSLVPN: Appl. processing Failed : 2    
Jan 27 06:40:02.978: SSLVPN: server side not ready to send.


SSL_VPN_GW#show run | sec webvpn
webvpn gateway SSL_VPN_GW
 ip address 172.16.1.254 port 443
 http-redirect port 80
 ssl encryption 3des-sha1 aes-sha1 
 ssl trustpoint TP-self-signed-514137430
 inservice
 !
webvpn install svc flash:/webvpn/svc.pkg
 !
webvpn context SSL_VPN_CONTEXT
 ssl authenticate verify all
 !
 !
 policy group SSL_VPN_POLICY
   functions svc-enabled
   banner "Welcom to SSL VPN Lab"
   svc address-pool "SSL_VPN_POOL"
   svc keep-client-installed
 default-group-policy SSL_VPN_POLICY
 aaa authentication list SSL_VPN_AUTHENTICATION
 gateway SSL_VPN_GW
 inservice

SSL_VPN_GW#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SSL_VPN_GW(config)#webvpn gateway SSL_VPN_GW
SSL_VPN_GW(config-webvpn-gateway)#no ssl encryption 3des-sha1 aes-sha1
SSL_VPN_GW(config-webvpn-gateway)#ssl encryption ?
  3des-sha1  3DES and SHA1
  aes-sha1   AES and SHA1
  rc4-md5    RC4 and MD5

SSL_VPN_GW(config-webvpn-gateway)#ssl encryption rc4-md5


SSL_VPN_GW#show webvpn session context all
WebVPN context name: SSL_VPN_CONTEXT
Client_Login_Name  Client_IP_Address  No_of_Connections  Created  Last_Used
vpnuser            172.16.1.50                2         00:01:50  00:01:08

SSL_VPN_GW#show webvpn session user vpnuser context all
WebVPN user name = vpnuser ; IP address = 172.16.1.50 ; context = SSL_VPN_CONTEXT
    No of connections: 1
    Created 00:03:03, Last-used 00:02:21
    Client Port: 20512
    User Policy Parameters
      Group name = SSL_VPN_POLICY
    Group Policy Parameters
      banner = "Welcom to SSL VPN Lab"
      idle timeout = 2100 sec
      session timeout = 43200 sec
      functions = svc-enabled
      citrix disabled
      address pool name = "SSL_VPN_POOL"
      default domain = "lab.com"
      dpd client timeout = 300 sec
      dpd gateway timeout = 300 sec
      keep sslvpn client installed = enabled
      rekey interval = 3600 sec
      rekey method =
      lease duration = 43200 sec

Cisco dCloud Free Virtual Labs

Cisco dCloud offers free virtual labs (you can use your CCO login) for doing network simulation and Proof of Concept (POC). With dCloud, you don't have to go through your Cisco account manager and ask for hardware just to test some latest feature and services in your network environment. My first experience using dCloud was doing a POC for ASA with FirePower. Just follow these steps to register and schedule an event with dCloud. It will first ask you to create a profile and select which dCloud server is near your country. There's a cool video introduction and a helpful dCloud manual which will guide you on each step.

You can use a Cisco IOS router as an endpoint device that will establish a VPN session to dCloud network. There's a list of recommended routers but I was able to use a Cisco 2811 router with Advanced Security K9 IOS 15.4 (c2800nm-advsecurityk9-mz.151-4.M10.bin). I've installed this IOS in order to support the ip dns view commands. You can also use a virtual router to connect to dCloud.

There are a few options which dCloud can configure your endpoint router. I chose the Console method so that I have full control on which configurations to apply.

You'll be asked to download a KitWizard, which is a zipped file, and apply it to your router and other LAN devices via console connection. I only applied the EZVPN related config, IP addressing and changed the ports to FastEthernet since I'm using a 2811 router.

You can also test your router connection to gauge its download/upload speed to dCloud.

I see a lot of benefits using dCloud such as there's no need to download evaluation software and license, you don't need to buy a VM server and worry about RAM size and you'll only need a fairly recent Cisco ISR router or a PC with AnyConnect installed. Most of all you don't have to blow up your production network and you could leverage dCloud for studying high level certs such as CCNP Security, CCNP Wireless, CCNP Collaboration or CCNP Service Provider. Below is the wireless lab topology that I've used while studying for my CCNA Wireless (WIFUND) and CWNA, which I integrated to dCloud network.

Go to My Sessions > search for a Content > I chose Cisco ISE2.0 For BYOD and Guest Management v1.1 since it includes Cisco Identity Services Engine (ISE) 2.0 and Cisco Prime Infrastructure (PI) 2.2 which is all I need for my wireless lab. The requested schedule will only be approved by dCloud support during business hours. 

Cisco ISE 2.0 For BYOD and Guest Management v1.1

Components

    Cisco Identity Services Engine (ISE) 2.0
    Cisco Prime Infrastructure 2.2
    Cisco Mobility Services Engine (MSE) 8.0
    Microsoft Active Directory-Windows 2008 R2
    Microsoft Exchange 2010-Windows 2008 R2
    Cisco Virtual Wireless Controller (vWLC) 8.0
    Cisco Virtual Cloud Services Router (CSRv)


Once your content is chosen, click Schedule. I clicked Extend session for longer than 5 days to give me plenty of time to play around. Click Request an Event.
 

An email notification will be sent to your registered email once booking is successful. My initial scheduled event wasn’t successful since I booked it on a weekend and after business hours. I was contacted by dCloud to make sure to schedule an event during business hours on a weekday.

 

You can add your router to your scheduled event by going to My sessions > select the router name under Available routers > click the down arrow > click Update.

You can verify if the router was successfully added under Routers > View Schedule.
 

Once your schedule is active, select View.

There are three main tabs which gives you more details for the selected lab: Details, Servers and Resources.
 

Click on a server and HTTPS to the given public IP address and type the username/password provided.

I was able to test and play around with the features of Cisco ISE and Prime afterwards.

Below are the "minimum" EZVPN configuration that I applied on my Cisco 2811 router to make it work with dCloud.

service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime

hostname kit-7869

logging buffered 5120000 debugging
enable secret cisco

aaa new-model

aaa authentication login default none

ip dhcp excluded-address 10.72.235.193 10.72.235.195
ip dhcp excluded-address 10.74.235.193 10.74.235.195

ip dhcp pool wired-data
   import all
   network 10.72.235.192 255.255.255.240
   default-router 10.72.235.193
   dns-server 10.72.235.193
   domain-name dcloud.cisco.com
   option 186 ip 198.18.133.6

ip dhcp pool wireless-data
   import all
   network 10.74.235.192 255.255.255.240
   default-router 10.74.235.193
   dns-server 10.74.235.193
   domain-name dcloud.cisco.com

username admin secret 5 $1$ByPQ$iCfNIwXDn5aBTKJQ4Dig1.

ip access-list extended acl-vpn-initiate
 remark traffic that will initiate the VPN session
 permit ip 10.64.0.0 0.63.255.255 198.18.0.0 0.1.255.255
ip access-list extended acl-nontunnel-traffic
 remark nat only non-tunnel-traffic
 remark no-nat to vpod networks
 deny   ip 10.64.0.0 0.63.255.255 198.18.0.0 0.1.255.255
 remark no-nat to other kits
 deny   ip 10.64.0.0 0.63.255.255 10.64.0.0 0.63.255.255
 remark no-nat to device VPNs
 deny   ip 10.64.0.0 0.63.255.255 10.16.0.0 0.1.255.255
 remark nat all other traffic
 permit ip 10.64.0.0 0.63.255.255 any

crypto isakmp keepalive 10 periodic

crypto ipsec client ezvpn ToDemo
 connect acl acl-vpn-initiate
 ctcp port 443
 group dcloud-ipsec key Sup6pSup6p
 local-address FastEthernet0/0
 mode network-extension
 peer dcloud-rtp-ipsec.cisco.com
 peer dcloud-emear-ipsec.cisco.com
 peer dcloud-apjc-ipsec.cisco.com
 peer dcloud-chi-ipsec.cisco.com

username endpoint-kit-7869 password jetq0tXcgIQWsuoZqnzF

xauth userid mode local

ip dns server
ip dns name-list 1 permit .*.DCLOUD.CISCO.COM
ip dns view vpod-dns
 domain name-server  198.18.133.1
 dns forwarder 198.18.133.1
 dns forwarding source-interface FastEthernet0/1.10
ip dns view-list splitdns
 view vpod-dns 10
  restrict name-group 1
 view default 20

ip domain lookup source-interface FastEthernet0/1.10

interface FastEthernet0/0
 description dCloud Kit outside Interface for EZVPN
 no ip dhcp client request tftp-server-address
 ip address dhcp client-id FastEthernet0/0
 ip flow ingress
 ip nat outside
 duplex auto
 speed auto
 no cdp enable
 crypto ipsec client ezvpn ToDemo
 no shutdown

interface FastEthernet0/1
 description Connection to dCloud Kit LAN
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 duplex auto
 speed auto
 no shutdown

interface FastEthernet0/1.10
 description : dCloud Kit Wired Data
 encapsulation dot1Q 10
 ip address 10.72.235.193 255.255.255.240
 ip dns view-group splitdns
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
 no shutdown

 interface FastEthernet0/1.11
 description VLAN11 : dCloud Kit Wireless Data
 encapsulation dot1Q 11
 ip address 10.74.235.193 255.255.255.240
 ip dns view-group splitdns
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
 no shutdown

interface Loopback 0
 description Used for telnet access to the router
 ip address 10.0.1.1 255.255.255.255
 no shutdown

ip nat inside source list acl-nontunnel-traffic interface FastEthernet0/0 overload

line con 0
 password cisco
 login
 logging synchronous

line vty 0 15
 password cisco
 login
 logging synchronous


Below is the full router running config.

kit-7869#show run
Building configuration...

Current configuration : 4430 bytes
!
! Last configuration change at 15:24:51 UTC Thu Sep 1 2016
! NVRAM config last updated at 15:30:08 UTC Thu Sep 1 2016
! NVRAM config last updated at 15:30:08 UTC Thu Sep 1 2016
version 15.1
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service sequence-numbers
!
hostname kit-7869
!
boot-start-marker
boot-end-marker
!
!
logging buffered 5120000
enable password 7 01100F175804
!
aaa new-model
!
!
aaa authentication login default none
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.74.235.193 10.74.235.195
ip dhcp excluded-address 10.72.235.193 10.72.235.196
!
ip dhcp pool wired-data
 import all
 network 10.72.235.192 255.255.255.240
 default-router 10.72.235.193
 dns-server 10.72.235.193
 domain-name dcloud.cisco.com
 option 186 ip 198.18.133.6
!
ip dhcp pool wireless-data
 import all
 network 10.74.235.192 255.255.255.240
 default-router 10.74.235.193
 dns-server 10.74.235.193
 domain-name dcloud.cisco.com
!
!
!
ip domain lookup source-interface FastEthernet0/1.10
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2811 sn FHK1308F18L
username admin privilege 15 secret 5 $1$ByPQ$iCfNIwXDn5aBTKJQ4Dig1.
!
redundancy
!
!
!
crypto isakmp key Sup6pSup6p hostname dcloud-apjc-ipsec.cisco.com
crypto isakmp keepalive 10 periodic
!
!
!
!
!
crypto ipsec client ezvpn ToDemo
 connect acl acl-vpn-initiate
 ctcp port 443
 group dcloud-ipsec key Sup6pSup6p
 local-address FastEthernet0/0
 mode network-extension
 peer dcloud-rtp-ipsec.cisco.com
 peer dcloud-emear-ipsec.cisco.com
 peer dcloud-apjc-ipsec.cisco.com
 peer dcloud-chi-ipsec.cisco.com
 username endpoint-kit-7869 password jetq0tXcgIQWsuoZqnzF
 xauth userid mode local
!
!
!
!
!
!
interface FastEthernet0/0
 description dCloud Kit outside Interface for EZVPN
 no ip dhcp client request tftp-server-address
 ip address dhcp client-id FastEthernet0/0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
 crypto ipsec client ezvpn ToDemo
!
interface FastEthernet0/1
 description Connection to dCloud Kit LAN
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface FastEthernet0/1.10
 description : dCloud Kit Wired Data
 encapsulation dot1Q 10
 ip address 10.72.235.193 255.255.255.240
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
!
ip forward-protocol nd
ip http server
no ip http secure-server
!
!
ip dns view vpod-dns
 domain name-server  198.18.133.1
 dns forwarder 198.18.133.1
 dns forwarding source-interface FastEthernet0/1.10
ip dns view-list splitdns
 view vpod-dns 10
  restrict name-group 1
 view default 20
ip dns name-list 1 permit .*.DCLOUD.CISCO.COM
ip dns server
ip nat inside source list acl-nontunnel-traffic interface FastEthernet0/0 overlo
ad
!
ip access-list standard acl-telnet
 remark allowed networks for telnet access to endpoint kit
 permit 10.72.235.192 0.7.0.15
 permit 198.18.0.0 0.1.255.255
!
ip access-list extended acl-deny-dhcp
 remark deny DHCP packets from clients on the outside/dirty network
 deny   udp any any eq bootps
 permit ip any any
ip access-list extended acl-nontunnel-traffic
 remark nat only non-tunnel-traffic
 remark no-nat to vpod networks
 deny   ip 10.64.0.0 0.63.255.255 198.18.0.0 0.1.255.255
 remark no-nat to other kits
 deny   ip 10.64.0.0 0.63.255.255 10.64.0.0 0.63.255.255
 remark no-nat to device VPNs
 deny   ip 10.64.0.0 0.63.255.255 10.16.0.0 0.1.255.255
 remark nat all other traffic
 permit ip 10.64.0.0 0.63.255.255 any
ip access-list extended acl-vpn-initiate
 remark traffic that will initiate the VPN session
 permit ip 10.64.0.0 0.63.255.255 198.18.0.0 0.1.255.255
!
access-list 10 permit 192.168.1.0 0.0.0.255
!
!
!
!
!
!
!
control-plane
!
!
!
line con 0
 password 7 110A1016141D
 logging synchronous
line aux 0
line vty 0 4
 password 7 121A0C041104
 logging synchronous
 transport input all
!
scheduler allocate 20000 1000
ntp master
end


Below are some helpful show commands for troubleshooting EZVPN client connection to Cisco's dCloud. If your connection got stuck, just bounce the router's WAN port.

kit-7869#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
64.100.12.21    22.165.96.17  MM_NO_STATE       1003 ACTIVE (deleted)
173.38.218.8    22.165.96.17  MM_NO_STATE       1005 ACTIVE (deleted)
173.38.218.8    22.165.96.17  MM_NO_STATE       1004 ACTIVE (deleted)

IPv6 Crypto ISAKMP SA

kit-7869#show crypto ipsec client ezvpn
Easy VPN Remote Phase: 8

Tunnel name : ToDemo
Inside interface list: FastEthernet0/1.10
Outside interface: FastEthernet0/0
Easy VPN connect ACL checking active
Connect : ACL based with access-list acl-vpn-initiate
Current State: CONNECT_REQUIRED
Last Event: CONN_DOWN
Save Password: Allowed
Current EzVPN Peer: dcloud-emear-ipsec.cisco.com (cTCP encapsulated)

kit-7869#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
kit-7869(config)#interface f0/0
kit-7869(config-if)#shut
kit-7869(config-if)#no shut
kit-7869(config-if)#end
000031: Sep  2 23:03:56.663: %SYS-5-CONFIG_I: Configured from console by vty1 (10.72.235.198)
000032: Sep  2 23:03:57.475: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
000033: Sep  2 23:03:58.475: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

kit-7869#show ip interface brief
Interface                  IP-Address      OK? Method Status                Prot
ocol
FastEthernet0/0            unassigned      YES DHCP   up                    up

FastEthernet0/1            unassigned      YES NVRAM  up                    up

FastEthernet0/1.10         10.72.235.193   YES NVRAM  up                    up

NVI0                       unassigned      YES unset  administratively down down

kit-7869#
000034: Sep  2 23:04:04.583: %DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/0 a
ssigned DHCP address 22.165.96.17, mask 255.255.248.0, hostname kit-7869

kit-7869#show crypto isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status

IPv6 Crypto ISAKMP SA

kit-7869#
000035: Sep  2 23:04:41.755: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client)  User=  Group=dcloud-ipsec  Client_public_addr=22.165.96.17  Server_public_addr=173.38.218.8
kit-7869#
000036: Sep  2 23:04:47.019: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client)  User=  Group=dcloud-ipsec  Client_public_addr=22.165.96.17  Server_public_addr=173.38.218.8
kit-7869#
000037: Sep  2 23:04:48.699: %CRYPTO-6-EZVPN_CONNECTION_UP: (Client)  User=endpoint-kit-7869  Group=dcloud-ipsec  Client_public_addr=22.165.96.17  Server_publ
ic_addr=173.39.116.8  NEM_Remote_Subnets=10.72.235.192/255.255.255.240


kit-7869#show ip interface brief
Interface                  IP-Address      OK? Method Status                Prot
ocol
FastEthernet0/0            22.165.96.17  YES DHCP   up                    up

FastEthernet0/1            unassigned      YES NVRAM  up                    up

FastEthernet0/1.10         10.72.235.193   YES NVRAM  up                    up

NVI0                       unassigned      YES unset  administratively down down

kit-7869#show crypto isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
173.38.218.8    22.165.96.17  MM_NO_STATE       1006 ACTIVE (deleted)
173.39.116.8    22.165.96.17  QM_IDLE           1007 ACTIVE

IPv6 Crypto ISAKMP SA


kit-7869#show crypto ipsec client ezvpn
Easy VPN Remote Phase: 8

Tunnel name : ToDemo
Inside interface list: FastEthernet0/1.10
Outside interface: FastEthernet0/0
Connect : ACL based with access-list acl-vpn-initiate
Current State: IPSEC_ACTIVE
Last Event: MTU_CHANGED
Save Password: Allowed
Split Tunnel List: 1
       Address    : 198.18.0.0
       Mask       : 255.254.0.0
       Protocol   : 0x0
       Source Port: 0
       Dest Port  : 0
Split Tunnel List: 2
       Address    : 10.16.0.0
       Mask       : 255.254.0.0
       Protocol   : 0x0
       Source Port: 0
       Dest Port  : 0
Split Tunnel List: 3
       Address    : 10.64.0.0
       Mask       : 255.192.0.0
       Protocol   : 0x0
       Source Port: 0
       Dest Port  : 0
Current EzVPN Peer: dcloud-apjc-ipsec.cisco.com (cTCP encapsulated)


kit-7869#ping 198.18.133.27 source 10.72.235.193   // PING TO CISCO ISE SOURCED FROM LAN IP
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.18.133.27, timeout is 2 seconds:
Packet sent with a source address of 10.72.235.193
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms


Below is the full KitWizard config file generated by dCloud.

**************************************************************************************************
!   
!
!           ___ _                     _   ___ _                 _
!          / __(_)___  ___ ___     __| | / __\ | ___  _   _  __| |
!         / /  | / __|/ __/ _ \   / _` |/ /  | |/ _ \| | | |/ _` |
!        / /___| \__ \ (_| (_) | | (_| / /___| | (_) | |_| | (_| |
!        \____/|_|___/\___\___/   \__,_\____/|_|\___/ \__,_|\__,_|
!                                                                                   
!       
!       
! For information on how to configure your device please refer to the url -
! https://dcloud-cms.cisco.com/help/configure-router-for-cisco-dcloud
!
!
!**************************************************************************************************
!
!
! dCloud_2911_config_version: 1.0
! Built for Kit John on Sat Aug 27 00:13:48 UTC 2016
!
! This Config is for the Router.
!
!
!**************************************************************************************************
!
!
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service sequence-numbers
no service config
!
hostname kit-7869
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 5120000 debugging
enable secret 5 $1$GwQZ$BDkrd.2SO/0s/IDy8FSdc0
!
aaa new-model
!
!
aaa authentication login default none
!
!
!
!
aaa session-id common
!
crypto pki token default removal timeout 0
!
!
Vlan 10
name dcloud-wired-data
!
Vlan 100
name dcloud-wired-voice
!
Vlan 11
name dcloud-wireless-data
!
Vlan 101
name dcloud-wireless-voice
!
no ip source-route
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.72.235.193 10.72.235.195
ip dhcp excluded-address 10.74.235.193 10.74.235.195
!
ip dhcp pool wired-data
   import all
   network 10.72.235.192 255.255.255.240
   default-router 10.72.235.193
   dns-server 10.72.235.193
   domain-name dcloud.cisco.com
   option 186 ip 198.18.133.6
!
ip dhcp pool wireless-data
   import all
   network 10.74.235.192 255.255.255.240
   default-router 10.74.235.193
   dns-server 10.74.235.193
   domain-name dcloud.cisco.com
!
ip tcp synwait-time 10
ip cef
no ip bootp server
!
no ipv6 cef
!
!
voice-card 0
 voice-service dsp-reservation 50
!
!
voice service voip
 no ip address trusted authenticate
 address-hiding
 mode border-element
 media forking
 allow-connections h323 to h323
 allow-connections h323 to sip
 allow-connections sip to h323
 allow-connections sip to sip
 fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
 sip
  bind control source-interface BVI100
  bind media source-interface BVI100
  registrar server
  asymmetric payload full
  video screening
!
voice class codec 1
 codec preference 1 aacld
 codec preference 2 g722-64
 codec preference 3 g711ulaw
 codec preference 4 g729r8
 video codec h264
!
!
voice register global
system message dCloud Service Interruption
max-pool 5
!
voice register pool  1
translation-profile incoming PLUS
id network 0.0.0.0 mask 0.0.0.0
!
!
!
voice translation-rule 1
rule 1 /^6\(...\)$/ /+14085556\1/
rule 2 /^911$/ /+14085556018/
!
voice translation-rule 101
 rule 1 /^89/ //
!
voice translation-profile Forking101
 translate called 101
!
voice translation-profile PLUS
translate called 1
!
media class 1
 recorder parameter
  media-recording 101
!
username admin secret 5 $1$ByPQ$iCfNIwXDn5aBTKJQ4Dig1.
!
ip access-list standard acl-telnet
 remark allowed networks for telnet access to endpoint kit
 permit 10.72.235.192 0.7.0.15
 permit 198.18.0.0 0.1.255.255
!
ip access-list extended acl-deny-dhcp
 remark deny DHCP packets from clients on the outside/dirty network
 deny   udp any any eq bootps
 permit ip any any
ip access-list extended acl-vpn-initiate
 remark traffic that will initiate the VPN session
 permit ip 10.64.0.0 0.63.255.255 198.18.0.0 0.1.255.255
ip access-list extended acl-nontunnel-traffic
 remark nat only non-tunnel-traffic
 remark no-nat to vpod networks
 deny   ip 10.64.0.0 0.63.255.255 198.18.0.0 0.1.255.255
 remark no-nat to other kits
 deny   ip 10.64.0.0 0.63.255.255 10.64.0.0 0.63.255.255
 remark no-nat to device VPNs
 deny   ip 10.64.0.0 0.63.255.255 10.16.0.0 0.1.255.255
 remark nat all other traffic
 permit ip 10.64.0.0 0.63.255.255 any
!
!
crypto isakmp keepalive 10 periodic
!
!
!
crypto ipsec client ezvpn ToDemo
 connect acl acl-vpn-initiate
 ctcp port 443
 group dcloud-ipsec key Sup6pSup6p
 local-address GigabitEthernet0/0
 mode network-extension
 peer dcloud-rtp-ipsec.cisco.com
 peer dcloud-emear-ipsec.cisco.com
 peer dcloud-apjc-ipsec.cisco.com
 peer dcloud-chi-ipsec.cisco.com

 username endpoint-kit-7869 password jetq0tXcgIQWsuoZqnzF
 xauth userid mode local
!
!
bridge irb
bridge 10 protocol ieee
bridge 10 route ip
bridge 11 protocol ieee
bridge 11 route ip
bridge 100 protocol ieee
bridge 100 route ip
bridge 101 protocol ieee
bridge 101 route ip
!
interface BVI10
!
ip dns server
ip dns name-list 1 permit .*.DCLOUD.CISCO.COM
ip dns view vpod-dns
 domain name-server  198.18.133.1
 dns forwarder 198.18.133.1
 dns forwarding source-interface BVI10
ip dns view-list splitdns
 view vpod-dns 10
  restrict name-group 1
 view default 20
!
ip domain lookup source-interface BVI10
!
interface GigabitEthernet0/0
 description dCloud Kit outside Interface for EZVPN
 no ip dhcp client request tftp-server-address
 ip address dhcp client-id GigabitEthernet0/0
 ip access-group acl-deny-dhcp in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
 crypto ipsec client ezvpn ToDemo
 no shut
!
interface GigabitEthernet0/1
 description Connection to 3560 Switch Gi0/10
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 no shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.10
 description : dCloud Kit Wired Data
 encapsulation dot1Q 10
 bridge-group 10
 !
 interface GigabitEthernet0/1.11
 description VLAN11 : dCloud Kit Wireless Data
 encapsulation dot1Q 11
 bridge-group 11
 !
 interface GigabitEthernet0/1.100
 description VLAN100 : dCloud Kit Wired Voice
 encapsulation dot1Q 100
 bridge-group 100
 !
 interface GigabitEthernet0/1.101
 description dCloud Kit Wireless Voice
 encapsulation dot1Q 101
 bridge-group 101
 !
interface GigabitEthernet0/1/0
 description Connection for AP 1142
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/1
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/2
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/3
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/4
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/5
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/6
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
interface GigabitEthernet0/1/7
 switchport access vlan 10
 switchport trunk native vlan 10
 switchport voice vlan 100
 spanning-tree portfast
 switchport mode trunk
 no shut
!
!
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 description VLAN10 : dCloud Kit Wired Data
 no ip address
 bridge-group 10
 no shut
!
interface Vlan11
 description VLAN11 : dCloud Kit Wireless Data
 no ip address
 bridge-group 11
 no shut
!
interface Vlan100
 description VLAN100 : dCloud Kit Wired Voice
 no ip address
 bridge-group 100
 no shut
!
interface Vlan101
 description VLAN101 : dCloud Kit Wireless Voice
 no ip address
 bridge-group 101
 no shut
!
interface Loopback 0
 description Used for telnet access to the router
 ip address 10.0.1.1 255.255.255.255
 no shutdown
!
interface BVI10
 description BVI10 : dCloud Kit Wired Data
 ip address 10.72.235.193 255.255.255.240
 ip dns view-group splitdns
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
 no shut
!
interface BVI11
 description BVI11 : dCloud Kit Wireless Data
 ip address 10.74.235.193 255.255.255.240
 ip dns view-group splitdns
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
 no shut
 !
interface BVI100
 description BVI100 : dCloud Kit Wired Voice
 ip address 10.73.235.193 255.255.255.240
 ip helper-address 198.19.255.21
 ip helper-address 198.19.255.22
 ip dns view-group splitdns
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
 no shut
!
interface BVI101
 description BVI101 : dCloud Kit Wireless Voice
 ip address 10.75.235.193 255.255.255.240
 ip helper-address 198.19.255.21
 ip helper-address 198.19.255.22
 ip dns view-group splitdns
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1000
 crypto ipsec client ezvpn ToDemo inside
 no shut
!
ip forward-protocol nd
no ip http server
!
ip nat inside source list acl-nontunnel-traffic interface GigabitEthernet0/0 overload
!
logging trap debugging
!
radius-server vsa send accounting
!
!
control-plane
!
!
mgcp profile default
!
sccp local BVI100
sccp ccm 198.18.133.3 identifier 1 version 7.0
sccp
!
sccp ccm group 1
 associate ccm 1 priority 1
 associate profile 1 register dCloud-remvid
!
dspfarm profile 1 conference video homogeneous 
 codec g722-64
 codec g711ulaw
 codec g711alaw
 codec g729ar8
 codec g729abr8
 codec g729r8
 codec g729br8
 codec h264 w360p frame-rate 30 bitrate 1mbps
 maximum sessions 1
 associate application SCCP
 no shutdown
!
dial-peer voice 1 voip
 description Default incoming dial-peer for all calls
 incoming called-number .T
 voice-class codec 1 
 dtmf-relay rtp-nte
 no vad
!
dial-peer voice 5 voip
 description Recording Inbound Dial-Peer
 translation-profile incoming Forking101
 incoming called-number 89.T
 voice-class codec 1 
 media-class 1
 dtmf-relay rtp-nte
 no vad
!
dial-peer voice 10 voip
 description outbound Recording dial peer
 preference 1
 destination-pattern .T
 session protocol sipv2
 session target ipv4:198.18.133.3
 session transport tcp
 voice-class codec 1 
 dtmf-relay rtp-nte
 no vad
!
dial-peer voice 101 voip
 description Forking Dial-Peer to MediaSense
 destination-pattern 3083
 signaling forward none
 session protocol sipv2
 session target ipv4:198.18.133.186
 session transport tcp
 voice-class codec 1 
!
!
!
!
gatekeeper
 shutdown
!
!
call-manager-fallback
secondary-dialtone 9
max-conferences 8 gain -6
transfer-system full-consult
ip source-address 10.72.235.193 port 2000
max-ephones 25
max-dn 50 octo-line
application default
system message primary dCloud Service Interruption
keepalive 10
voicemail 3050
translation-profile incoming PLUS
call-forward busy 3050
call-forward noan 3050 timeout 15
!
!
!
line con 0
 exec-timeout 240 0
 privilege level 15
 transport output telnet
line aux 0
 transport output telnet
line vty 0 15
 access-class acl-telnet in
 privilege level 15
 transport input telnet
!
end