Altı sonra doldurulacak.
https://theworldsgonemad.net/2021/vti-vpn-asa-to-asr/
https://www.gns3network.com/how-to-setup-ipsec-tunnel-between-palo-alto-and-fortigate-firewall/
Showing posts with label ipsec. Show all posts
Showing posts with label ipsec. Show all posts
11 Jan 2024
11 Dec 2023
IPsec VPN Lab, with stateful failover (SSO, Dual Interface Model)
Lots of stuff going on here.
We have two sites for our company named Central-Office and Branch-33.
The CO is connected to our ISP w/ two edge routers, CE_1 w/ an E3 line and CE_2 w/ a backup E1 line. Our branch33 site is using R4, which will establish the IPSec tunnels, allowing the private networks 10.1.33.0/21 talk to the central office 10.1.8.0/21 networks.
Behing them are the two IPSec Concentrators (R1 and R2, 7200 Cisco routers) which have public IP addresses on their out facing interfaces. Here all 4 routers connected to a switch, but of course in a production network you would have redundant switches there also.
Two first hop redundancy plans are integrated as an HSRP group facing to our internal network and the HSRP group facing to our edge routers, which also provides the IPsec redundandcy.
Crypto maps are setup as SSO stateful failover, R1 acting as the primary IPsec point, with R2 being the standby.
There is an extra flavor as IP SLA and reachability tracking is done where R1 and R2 are checking their next-hop routers to the outside world, CE_1 & CE_2. No routing protocol is run inside our company, for claritys sake. Thus we have two static default routes w/ different AD and the mentioned icmp tracking.
One Note, considering the Stateful Failover: "Each time an active device relinquishes control to become the standby device, the active device will reload. This functionality ensures that the state of the new standby device synchronizes correctly with the new active device." (Ref) So since Dynamips doesnt support reloading, the Router dynamips process will crash and you must shut down and turn on the router again to get it going.
Download Project files for GNS3
Links:
Cisco High Availability Solution: Stateful Failover for IPsec
Fun with IPsec stateful failover @ packetlife
12 Jun 2023
Cisco ASA IPsec setup
Cisco ASA has a different way setting up Phase1/Phase2 parameters for an IPsec tunnel. Where other vendors have specific menu/commands to enter the specific Phase1/Phase2 parameters, here we have groups of commands to accomplish basically the same thing.
PHASE 1
Enter your acceptable Phase1 parameters which will be offered for negotiation with the other ipsec peer.
For IKEv1:
#crypto ikev1 policy 10
encryption 3des
hash sha
group 2
lifetime 28800
encryption 3des
hash sha
group 2
lifetime 28800
#crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 5
lifetime 86400
authentication rsa-sig
encryption aes-256
hash sha
group 5
lifetime 86400
authentication pre-share
or for IKEv2:
#crypto ikev2 policy 2
encryption aes-256
integrity sha
group 14
prf sha
lifetime seconds 86400
Then you setup the "tunnel-group" for attributes and most importantly pre-shared key (or certificate)
#tunnel-group 182.11.104.167 type ipsec-l2l
#tunnel-group 182.11.104.167 general-attributes
default-group-policy Turkcell_GroupPolicy2
#tunnel-group 182.11.104.167 ipsec-attributes
ikev1 pre-shared-key *****
PHASE 2
#crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
#crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
#crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
#crypto ipsec ikev2 ipsec-proposal STRONGPROPOSAL
protocol esp encryption aes-256
protocol esp integrity sha-1
#crypto ipsec ikev2 ipsec-proposal WEAKPROPOSAL
protocol esp encryption 3des
protocol esp integrity sha-1
Here's where we define the interesting traffic and
IKEv1 example cryptomap entry:
crypto map outside_map1 1 match address outside_cryptomap
crypto map outside_map1 1 set pfs group5
crypto map outside_map1 1 set peer 182.11.104.167
crypto map outside_map1 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map1 1 set security-association lifetime seconds 28800
an IKEv2 example cryptomap entry:
crypto map internet_map0 1 match address internet_cryptomap
crypto map internet_map0 1 set peer 182.11.104.167
crypto map internet_map0 1 set ikev2 ipsec-proposal AES256-SHA1
crypto map internet_map0 interface internet
1 Feb 2010
GRE over IPsec in a Hub-Spoke Topology w/ EIGRP (Lab) #2
Ok this is the enhanced version of the previous GRE lab I've posted.
We've decided to encrypt and secure all communications between our HQ and Branches.
As previously noted we needed GRE to run a dynamic routing protocol (EIGRP) between our networks. So here we implement an IPsec GRE tunnel that will encrypt all traffic including the multicast EIGRP messaging.
Download Project files for GNS3.
We've decided to encrypt and secure all communications between our HQ and Branches.
As previously noted we needed GRE to run a dynamic routing protocol (EIGRP) between our networks. So here we implement an IPsec GRE tunnel that will encrypt all traffic including the multicast EIGRP messaging.
Download Project files for GNS3.
24 Jan 2010
GRE Tunnel w/ IPsec protection, (and ISAKMP association using RSA keys)
1. Generate an RSA Public Key for our router.
#crypto key generate rsa general-keys label R1
Here you can see the generated key. Do the above for also R2, and copy paste their public keys to each other in next step.
#sh crypto key mypubkey rsa
% Key pair was generated at: 12:35:34 UTC Jan 24 2010
Key name: R1
Usage: General Purpose Key
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D35594 62FB3925
22EBD28E A64B12A7 2D0D44C1 DD28F9BF 8BA52834 516FC231 F1791352 A90ADEE0
A61E77C7 5F132B9E 11193B08 B338D531 D40EE40D 9699E742 DF020301 0001
% Key pair was generated at: 13:35:36 UTC Jan 24 2010
Key name: R1.server
Usage: Encryption Key
Key is not exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00A4764D E3D85AFD
2E9254C0 DBB88E08 CE86FA63 8D82C08C D11F14DF AF9264C9 2F5C1CBC 7081C66D
DFE73BB3 66E5A354 48B73EF0 3773545B F5BACBA7 CEBA55DA 4D3D52A1 0B62BFFD
BA93A21E 9B65D23F 9A843994 FAAEB67E BF565A6F 38A8DC3A D5020301 0001
2. Create a key chain. Addressed to router R2 with its IP address and copy paste its public key in here.
#crypto key pubkey-chain rsa
addressed-key 10.1.1.6
key-string
Enter a public key as a hexidecimal number ....
(PASTE HERE)
and use quit to finish
Download project files for GNS3
22 Jan 2010
IPsec VPN Lab, (using Dynamic crypto Map)
In this lab we connect the 3 sites of our company using secure IPsec VPN connections.
The ISP network consists of 4 Routers which are running EIGRP between them.
Our headquarters is connected to the ISP with the CE_4 router.
The branch offices, CE_5 being Branch1, and CE_8 Branch2.
Networks are 192.168.0.0/21 behing CE_4, edge router.
In Branch 1 we have 192.168.16.0/20 networks. (Simulated with loopback int)
In Branch 2 there are the 192.168.8.0/21 networks.
This setup demonstrates all the IPsec negotiation and tunnel establishment using a dynamic map on CE_4.. The key point is the create the relationship between the static crypto map and the dynamic one.
Due to our ISAKMP Policy we are using a Pre-Shared key for authentication. Which will be defined as a wildcard, so our VPN peers can connect using whichever address they have.
# crypto isakmp key
Here are the lab files for gns3. Download
Good Reading:
Wildcard Pre-Shared Key Enhancement @cisco
Security Commands: crypto dynamic-map through ctype @cisco
21 Jan 2010
IPSEC VPN session status
IKE SA | IPsec SAs | VPN Tunnel Status |
|---|---|---|
Exists, active | Exists (flow exists) | UP-ACTIVE |
Exists, active | None (flow exists) | UP-IDLE |
Exists, active | None (no flow exists) | UP-IDLE |
Exists, inactive | Exists (flow exists) | UP-NO-IKE |
Exists, inactive | None (flow exists) | DOWN-NEGOTIATING |
Exists, inactive | None (no flow) | DOWN-NEGOTIATING |
None | Exists (flow exists) | UP-NO-IKE |
None | None (flow exists) | DOWN |
None | None (no flow exists) | DOWN |
Subscribe to:
Posts (Atom)