Configuring Cisco SOHO VPNs

Scenario

In this example we have two SOHO offices.

>        A VPN needs to be created between the two sites so that they can communicate with each other without the fear of eavesdropping.

>        For simplicity, neither site is site wants to invest in a CA certificate service or RSA infrastructure. They prefer to use pre-shared keys.

>        The network administrators at both sites are aware that permanent site � to � site VPNs require fixed Internet IP addresses and have upgraded from their basic DHCP services originally provided by their ISPs.

Site1

o        uses a private network of 192.168.1.0

o        has a router with an external Internet IP address of 97.158.253.25

o        uses a Cisco DSL router with a built in DSL modem like the Cisco 800 series of routers.

 

Site2

o        uses a private network of 192.168.2.0

o        uses a Cisco router with an external DSL modem or a PIX firewall.

o        uses a router (Scenario A) or firewall (Scenario B) with an external Internet IP address of 6.25.232.1

Other Information

The administrator at Site 1 wants to be able to access all the protected servers at site 2 by using their real IP addresses and vice versa. For example; Site 1 will refer to Site 2 servers with their 192.168.2.X IP addresses, not the Internet NAT addresses on the 6.25.232.X network.

 

 

Site 1 – Router VPN Configuration Steps

There are a number of steps that need to be done to create the VPN.

 IKE

Phase 1 of the creation of a VPN tunnel first requires an exchange of the encryption capabilities of the VPN devices at both ends of the tunnel. The second phase involves encrypting the data by either using either:

o        Pre-shared keys known to both VPN devices (This is what we’ll be using in all the examples below) or

o        Keys generated via the RSA methodology or

o        Keys obtained from Certification Authorities (CAs)

Cisco router / firewall devices usually require you to configure each of the various combinations of key encryption capabilities available. The device will then send all of the combinations to the remote VPN as part of the negotiation to decide which one to use.

 

o        Create an IKE key policy. The policy number “9” identifies it from all other IKE policies that may be configured. This policy requires a pre-shared key.

 

 crypto isakmp policy 9

  hash md5

  authentication pre-share

 

I’ve chosen only one combination for the sake of simplicity, but you could add more like this. If your device is licensed appropriately, and you intend to establish a connection with a Linux VPN device, then you should consider a 3DES option which Linux FreeS/WAN prefers. Here is a snippet that includes 3DES and may other policy capabilities.

 

 crypto isakmp policy 1

  encr 3des

  authentication pre-share

 !

 crypto isakmp policy 4

  encr 3des

  authentication pre-share

  group 2

 !

 crypto isakmp policy 5

  encr 3des

  hash md5

  authentication pre-share

  group 2

 !

 crypto isakmp policy 10

  authentication pre-share

  group 2

 !

 crypto isakmp policy 12

  authentication pre-share

 !

 crypto isakmp policy 20

  hash md5

  authentication pre-share

  group 2

 !

 crypto isakmp policy 23

  encr 3des

  hash md5

  authentication pre-share

 

o        You’ll then need to configure a VPN shared key that can be used between this site and the VPN site at 6.25.232.1

 

 crypto isakmp key VPNsecretPASSWORD address 6.25.232.1

 

IPSec

o        Set a lifetime for the IPSec Security Associations. A security association is the equivalent of a site � to � site VPN relationship.

 

 crypto ipsec security-association lifetime seconds 86400

 

o        Configure an access list to define the valid traffic to be directed through the VPN from 192.168.1.0 to 192.168.2.0

  

 access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

 

o        Define which encryption transformations will be used to shield the VPN traffic as it passes over the Internet with the “crypto ipsec transform-set” command. Each “single line” set can be given its own name. In this case we’ve chosen set s1s2trans to use one of the most common combinations, esp-des and esp-md5-hmac.

 

 crypto ipsec transform-set s1s2trans esp-des esp-md5-hmac

 

If the remote site prefers to use the more secure 3DES method, (Linux FreeS/WAN only does 3DES) then you may want to replace the above statement with this one:

  

 crypto ipsec transform-set s1s2trans esp-3des esp-md5-hmac

  

You can create multiple transform sets depending on your security requirements. For example; you could create a transform set named “weak” with regular DES encryption and another named “strong” using the better 3DES method.

 

o        Create a crypto-map to match the valid traffic defined by the ACL with the transform set we want to use with VPN peer router/firewall at the other site. This example is creating a map entry of priority “10”.

 

 crypto map to-site2 10 ipsec-isakmp

  set peer 6.25.232.1

  set transform-set s1s2trans

  match address 101

 

You can add additional map entries to correspond with tunnels to other remote sites with additional priorities. Just remember to create the appropriate access control lists and pre-shared keys. Here is an example of additional map entries using two different transform sets:

 

 crypto map to-site2  150 ipsec-isakmp

  set peer 108.112.44.95

  set transform-set s1s2trans

  match address 101

 crypto map to-site2  153 ipsec-isakmp

  set peer 4.21.116.23

  set transform-set s1s2trans-strong

  match address 102

 crypto map to-site2  158 ipsec-isakmp

  set peer 223.52.37.25

  set transform-set s1s2trans-strong

  set pfs group2

  match address 103

 

 

o        Bind the crypto-map to the external interface of the router.

  

 interface BVI1

 �crypto map to-site2

This example assumes you are using a router with a built in DSL modem. In such a case, the external Internet facing interface would most likely be called BVI1 with a “sister” interface ATM0. Make sure both are configured correctly.

If you are using a router with an external DSL / Cable modem, then there will only be one Internet facing interface to configure. This interface would be usually named either Ethernet0 or Ethernet1 depending on the type of router. The Site 2 configuration uses an external DSL / Cable modem.

Site 1 � Configuration Example

 

Site 2 – Router VPN Configuration Steps (Scenario A)

Site 2 � PIX Firewall VPN Config. Steps (Scenario B)

IKE

o        Plan on creating an IPSec policy with a unique identifier number. The PIX will check each set of configured numbered policies for IKE till it achieves success. In this case we’ll only use one policy “20”.

o        Define the type of encryption to be used (DES or 3DES)

 

 isakmp policy 20 encryption des

 

o        Define the hashing method for authentication (SHA or MD5)

 

 isakmp policy 20 hash md5

 

o        Define the overall authentication method (Pre-shared key or rsa-sig). We’ll use the simpler pre-shared method.

 

 isakmp policy 20 authentication pre-share

 

o        Define the shared key to be used.

 

 isakmp key VPNsecretPASSWORD address 97.158.253.25 netmask 255.255.255.255

 

o        Specify how the hosts will identify themselves to one another (By address or hostname). The same method should be used on both ends.

 

 isakmp identity address

 

o        Enable ISAKMP on the external interface of the PIX

 

 isakmp enable outside

IPSec

o        Configure an access list to define the valid traffic to be directed through the VPN from 192.168.2.0 to 192.168.1.0

 

 access-list ipsec permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

 

o        Define which transformations will be used to shield the VPN traffic with the “crypto ipsec transform-set” command. Each set can be given its own name, in this case “s2s1trans”.

 

 crypto ipsec transform-set s2s1trans esp-des esp-md5-hmac

  

If the remote site prefers to use the more secure 3DES method, (Linux FreeS/WAN only does 3DES) then you may want to replace the above statement with this one:

  

 crypto ipsec transform-set s1s2trans esp-3des esp-md5-hmac

 

 

o        Create a crypto map to match the valid traffic, the transform set, the security-association lifetime with the VPN peer router/firewall at the other site.

 

 crypto map s2s1ipsec 10 match address ipsec
crypto map s2s1ipsec 10 set peer 97.158.253.25
crypto map s2s1ipsec 10 set transform-set s2s1trans

 crypto map s2s1ipsec 10 set security-association lifetime seconds 86400

 

In this case the crypto map is named “s2s1ipsec” and each statement has a sequence number or “ranking” of “10”. Statements with lower “sequence numbers” are considered before those with higher values.

Just like the routers, you can add more statements for tunnels to other remote VPN devices. You just have to remember to make sure that:

 

+        the crypto map statements referring to each remote site uses a unique sequence number,

+        that the shared secrets match and

+        that corresponding ACLs are created.

 

o        Bind the crypto-map to the external interface on which VPN traffic will originate

 

 crypto map s2s1ipsec interface outside

 

o        Let the PIX’s ASA always implicitly allow IPSec traffic through

 

 sysopt connection permit-ipsec

Site 2 � Configuration Example (Scenario B)

Here is a sample configuration for Site 2 when using a PIX firewall. There are a number of fully commented sample PIX configurations in the appendix in which each line is explained.

 

 

Troubleshooting Cisco VPNs

Cisco provides a number of commands to test the status of your site � to � site VPN tunnel. If your tunnel fails to be created you’ll need to ensure that all the parameters are set up correctly. The most common failure I’ve seen is having mismatched isakmp transform sets.

Displaying the Key Exchange Status

The “show crypto isakmp sa” command works on both routers and PIX firewalls and is used to determine whether the first phase of the VPN tunnel establishment (isakmp key exchange) was successful. In the example below Site 1 & 2 have a working tunnel with the status output showing the Internet IP addresses of the VPN devices at both ends of the tunnels.

 

soho1# show crypto isakmp sa

Total     : 1

Embryonic : 0

        dst               src      state     pending  � created

�6.25.232.1       97.158.253.25    QM_IDLE         0           0

soho1#

Displaying the IPSec Tunnel Status

The “show crypto ipsec sa” command works on both routers and PIX firewalls and is used to determine whether the second phase of the VPN tunnel establishment (IPSec) was successful. In the example below Site 1 & 2 have a working tunnel with the status output showing the Internet IP addresses of the VPN devices at both ends of the tunnels.

 

soho1# sh crypto ipsec sa

 

 

interface: BVI1

    Crypto map tag: to-site2, local addr. 6.25.232.1

 

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

   current_peer: 97.158.253.25:500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 871118, #pkts encrypt: 871118, #pkts digest 871118

    #pkts decaps: 917581, #pkts decrypt: 917581, #pkts verify 917581

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 99, #recv errors 0

 

     local crypto endpt.: 6.25.232.1, remote crypto endpt.: 97.158.253.25

     path mtu 1500, ipsec overhead 56, media mtu 1500

     current outbound spi: 95992f5

 

     inbound esp sas:

      spi: 0xe43e931d(3829306141)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 6, crypto map: to-site2

        sa timing: remaining key lifetime (k/sec): (4601836/22657)

        IV size: 8 bytes

        replay detection support: Y

 

     …

     …

 

     outbound esp sas:

      spi: 0x95992f5(156865269)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 5, crypto map: to-site2

        sa timing: remaining key lifetime (k/sec): (4605007/22656)

        IV size: 8 bytes

        replay detection support: Y

     …

     …

 

soho1#

Debugging

Cisco has the very useful debug set of commands which you can use to follow the sequence of events that occur during the establishment of the VPN tunnel. Unfortunately the use of the debug command is beyond the scope of this book.