The following scenario is used to demonstrate the configuration.
I'm using two Cisco ASA 5505 firewalls with ASA 8.4 (ASA01) and 8.2 (ASA02) software versions. Because of this, the commands are going to be slightly different on each device. Cisco 1841 router is emulating the Internet cloud.
The Configuration
Essentially, the configuration consists of two parts: defining the IKE Phase 1 and IKE Phase 2 specific negotiation parameters for IKE/ISAKMP SA and IPsec SA, respectively. The IKE SA parameters are advertised inside an IKE/ISAKMP policy. The policy includes the following definitions:- encryption algorithm
- authentication type
- hashing method
- Diffie-Hellman group
- (optional) lifetime of seconds or kilobytes (86400 seconds by default)
The IPsec SA parameters are configured inside a crypto map. The crypto map contains the following information:
- peer details (Who is the tunnel endpoint?)
- proxy IDs (What traffic is encrypted?)
- transform-set (How is the traffic encrypted?)
So let's look at the configuration step by step.
0. Verify IP connectivity.
Before an administrator can even consider configuring an IPsec VPN tunnel, there must be full IP reachability. Without going into the details, below is a briefing of a working configuration.
--- ASA01 ---
interface Vlan1
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.0.2.1 255.255.255.0
!
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
!
route outside 0.0.0.0 0.0.0.0 192.0.2.254
--- ASA02 ---
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 198.51.100.1 255.255.255.0
!
global (outside) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0
!
route outside 0.0.0.0 0.0.0.0 198.51.100.254
ASA01# ping 198.51.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.51.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Hurray for successful pings!
1. Define the IKE/ISAKMP policy.
ASA01#
crypto ikev1 policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
ASA02#
crypto isakmp policy 15
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
Note that the policy number is only locally significant, and does not have match between the peers. A device can have more than one policy configured, and they are sequentially processed. The number signifies the priority, or the preference order (1 highest, 65535 lowest).
Another observation, I did not enter the command lifetime 86400 under the policy configuration. The ASA automatically added it as a default value.
2. Enable IKE/ISAKMP on the interface.
ASA01#
crypto ikev1 enable outside
ASA02#
isakmp enable outside
3. Configure the transform-set.
ASA01#
crypto ipsec ikev1 transform-set ESP-AES192-MD5 esp-aes-192 esp-md5-hmac
ASA02#
crypto ipsec transform-set TRANSET esp-aes-192 esp-md5-hmac
I like to choose a descriptive name for the transform-set that, in itself, indicates the encryption and hashing methods used.
4. Set the proxy IDs.
The ACLs define the "interesting traffic", which is to be encrypted. The proxy IDs must be mirrored between the peers (the name is locally significant).
ASA01#
access-list L2L extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
ASA02#
access-list VPN-TRAFFIC extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
5. Combine everything in the crypto map.
ASA01#
crypto map DEMOVPN 10 match address L2L
crypto map DEMOVPN 10 set peer 198.51.100.1
crypto map DEMOVPN 10 set ikev1 transform-set ESP-AES192-MD5
ASA02#
crypto map VPN-CRYPTOMAP 10 match address VPN-TRAFFIC
crypto map VPN-CRYPTOMAP 10 set peer 192.0.2.1
crypto map VPN-CRYPTOMAP 10 set transform-set TRANSET
Again, the names are locally significant, but they must refer to the correct components on that device.
6. Configure tunnel-groups.
ASA uses tunnel-groups to set values for VPN connections. Tunnel-groups contain a small number of attributes that pertain to creating the tunnel itself. Tunnel-groups are a concept to simplify system management.
ASA01#
tunnel-group 198.51.100.1 type ipsec-l2l
tunnel-group 198.51.100.1 ipsec-attributes
ikev1 pre-shared-key Sw0rdOfAzer0th
ASA02#
tunnel-group 192.0.2.1 type ipsec-l2l
tunnel-group 192.0.2.1 ipsec-attributes
pre-shared-key Sw0rdOfAzer0th
7. Apply the crypto map on the interface.
ASA01#
crypto map DEMOVPN interface outside
ASA02#
crypto map VPN-CRYPTOMAP interface outside
8. NAT exemption.
As a final step, the traffic between the LANs must be exempted from NAT translation. According to the order of operations, NAT occurs before any crypto operations. Hence, if the NAT exemption rule is not created, the IP addresses are translated, and will not match the crypto map, never triggering the encryption process.
ASA01#
object network INSIDE-NET
subnet 10.1.1.0 255.255.255.0
object network L2L-VPN-NET
subnet 192.168.1.0 255.255.255.0
!
nat (inside,outside) source static INSIDE-NET INSIDE-NET destination static L2L-VPN-NET L2L-VPN-NET
ASA02#
nat (inside) 0 access-list VPN-TRAFFIC
** Full Configuration **
ASA01#
crypto ikev1 policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
!
crypto ikev1 enable outside
!
crypto ipsec ikev1 transform-set ESP-AES192-MD5 esp-aes-192 esp-md5-hmac
!
access-list L2L extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
!
crypto map DEMOVPN 10 match address L2L
crypto map DEMOVPN 10 set peer 198.51.100.1
crypto map DEMOVPN 10 set ikev1 transform-set ESP-AES192-MD5
!
crypto map DEMOVPN interface outside
!
tunnel-group 198.51.100.1 type ipsec-l2l
tunnel-group 198.51.100.1 ipsec-attributes
ikev1 pre-shared-key Sw0rdOfAzer0th
!
!
!
object network INSIDE-NET
subnet 10.1.1.0 255.255.255.0
object network L2L-VPN-NET
subnet 192.168.1.0 255.255.255.0
!
nat (inside,outside) source static INSIDE-NET INSIDE-NET destination static L2L-VPN-NET L2L-VPN-NET
ASA02#
crypto isakmp policy 15
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
!
isakmp enable outside
!
access-list VPN-TRAFFIC extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
!
crypto ipsec transform-set TRANSET esp-aes-192 esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
!
crypto map VPN-CRYPTOMAP 10 match address VPN-TRAFFIC
crypto map VPN-CRYPTOMAP 10 set peer 192.0.2.1
crypto map VPN-CRYPTOMAP 10 set transform-set TRANSET
!
crypto map VPN-CRYPTOMAP interface outside
!
tunnel-group 192.0.2.1 type ipsec-l2l
tunnel-group 192.0.2.1 ipsec-attributes
pre-shared-key Sw0rdOfAzer0th
!
!
!
global (outside) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0
!
nat (inside) 0 access-list VPN-TRAFFIC
Verification
Let's look at show and debug command output to verify that the tunnels have successfully established. Note that these are noisy commands, and could overwhelm the device, if used incorrectly. I would recommend forwarding the output into the logging buffer, instead of the console.The debug crypto ikev1/isakmp and debug crypto ipsec output tells us that both Phase 1 and Phase 2 completed successfully, and inbound/outbound IPsec SAs were created. Pay special attention to the SPIs (the hexadecimal numbers). SPI stands for Security Parameter Index, and it is used to identify different traffic streams that may use different encryption rules and algorithms.
%ASA-7-713906: IP = 198.51.100.1, Connection landed on tunnel_group 198.51.100.1
%ASA-7-713906: Group = 198.51.100.1, IP = 198.51.100.1, Generating keys for Initiator...
%ASA-5-713119: Group = 198.51.100.1, IP = 198.51.100.1, PHASE 1 COMPLETED
%ASA-5-713120: Group = 198.51.100.1, IP = 198.51.100.1, PHASE 2 COMPLETED (msgid=9e76630b)
%ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x66B29CF6) between 192.0.2.1 and 198.51.100.1 (user= 198.51.100.1) has been created.
%ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0x4FB207F5) between 192.0.2.1 and 198.51.100.1 (user= 198.51.100.1) has been created.
%ASA-5-752016: IKEv1 was successful at setting up a tunnel. Map Tag = DEMOVPN. Map Sequence Number = 10.
The crypto ikev1/isakmp sa command provides brief information about the current IKE SAs.
ASA01# show crypto ikev1 sa
IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 198.51.100.1
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
ASA02# show crypto isakmp sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 192.0.2.1
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
The show crypto ipsec sa command displays detailed information about the current IPsec SAs status. The output shows that on ASA01 only 4 packets encapsulated/0 packets decapsulated, and vice versa on ASA02. Why? This is because I actually have a PC only in the 10.1.1.0/24 network (the other side is an empty LAN). However, pinging any IP address in the 192.168.1.0/24 network still triggers the encryption process, and the packets are routed normally towards the assumed destination. But there will be no reply from non-existent devices.
ASA01# show crypto ipsec sa
interface: outside
Crypto map tag: DEMOVPN, seq num: 10, local addr: 192.0.2.1
access-list L2L extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 198.51.100.1
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 4, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 192.0.2.1/0, remote crypto endpt.: 198.51.100.1/0
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 66B29CF6
current inbound spi : 4FB207F5
inbound esp sas:
spi: 0x4FB207F5 (1337067509)
transform: esp-aes-192 esp-md5-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 24576, crypto-map: DEMOVPN
sa timing: remaining key lifetime (kB/sec): (3915000/28060)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0x66B29CF6 (1722981622)
transform: esp-aes-192 esp-md5-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 24576, crypto-map: DEMOVPN
sa timing: remaining key lifetime (kB/sec): (3915000/28060)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
ASA02# show crypto ipsec sa
interface: outside
Crypto map tag: VPN-CRYPTOMAP, seq num: 10, local addr: 198.51.100.1
access-list VPN-TRAFFIC extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
current_peer: 192.0.2.1
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 198.51.100.1, remote crypto endpt.: 192.0.2.1
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 4FB207F5
current inbound spi : 66B29CF6
inbound esp sas:
spi: 0x66B29CF6 (1722981622)
transform: esp-aes-192 esp-md5-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 24576, crypto-map: VPN-CRYPTOMAP
sa timing: remaining key lifetime (kB/sec): (4374000/28025)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0x4FB207F5 (1337067509)
transform: esp-aes-192 esp-md5-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 24576, crypto-map: VPN-CRYPTOMAP
sa timing: remaining key lifetime (kB/sec): (4374000/28025)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
That's a lot to chew. I know. Write your questions in the comments section.
No comments:
Post a Comment