Configuring site-to-site vpn part 1
I have got a router in Bukit Batok and another router in Ayer Rajah, I want my network traffic to route to another remote network in Ayer Rajah. Due to budget I have put off the idea of subscribing a lease line from an ISP and decided to use the existing MOL connection for my routing using site-to-site vpn.
Router in Bukit Batok is R1
Router in Ayer Rajah is R2
R1 is a new router with no specific configuration that meets my personal needs.
Set up hostname to identify my router:
Enter configuration commands, one per line. End with CNTL/Z.
Turn off http server:
R1(config)#no ip http server
Turn on https server:
R1(config)#ip http secure-server
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
*Mar 5 23:50:10.935: %SSH-5-ENABLED: SSH 1.99 has been enabled
*Mar 5 23:50:11.423: %PKI-4-NOAUTOSAVE: Configuration was modified. Issue “write memory” to save n
Set up a local user database in my router, privilege 15 is for account with full access of the router, the password is weak, password should be at least 10 characters long, with mixture of alphanumeric and other characters such as these : @#$%^&*
R1(config)#username cyrus privilege 15 secret 0 cisco
the keyword secret will hash my password using MD5
The digest of my password will look like this:
R1(config)#do sh run | i user
username cyrus privilege 15 secret 5 $1$XXb2$PM7aly7v9v/CY3RnNtrOg0
This is a 128-bit digest, MD5 algorithm is always a 128-bit long no matter which output you put. SHA-1 provides a longer keylength for the digest output which is 160-bit long and SHA is said to be more secured than MD5.
The reason to set https server and a local user database with privilege 15 is for the use of SDM 2.5, SDM 2.5 requires a level 15 username during authentication.
Turn on AAA:
Define a domain name for my router:
R1(config)#ip domain-name cyruslab.com
Generate a 1024-bit RSA for ssh using PuTTY
R1(config)#crypto key generate
The name for the keys will be: R1.cyruslab.com
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus : 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
Create a md5 hashed password for global configuration mode:
R1(config)#enable secret 0 cisco
Create a method list, since I do not have Radius server or TACACS+ servers yet I will use local database as my password, enable password is for redundancy in case local user database has a problem for some reasons.
R1(config)#aaa authentication login LOCAL_LIST local enable
Create authentication methods for ssh telnet:
I have set up my virtual terminal connection idle time to be 15mins.
R1(config)#line vty 0 4
R1(config-line)#login authentication LOCAL_LIST
R1(config-line)#transport input ssh
Go to my console and disable login via console port:
R1(config-line)#line con 0
R1(config-line)#no login authentication
There is no need to set up login for console port as long as my router is secured with locks and cameras, a hacker who has put so much effort to break into my datacentre will seek to destroy my equipments with a baseball bat and console login is for emergency.
Set my console login idle time as 15minutes.
To protect against dictionary attack within 10s if there are more than 3 failures to attempt to ssh telnet the login session will be blocked for 100s.
R1(config)#login block-for 100 attempts 3 within 10
Create a standard access list for a backdoor during quiet mode:
R1(config)#ip access-list standard BACKDOOR
R1(config-std-nacl)#permit host 10.0.0.2 log
R1(config-std-nacl)#permit host 192.168.47.1 log
So that during quiet mode the host which I specified can still ssh login to my router.
R1(config)#login quiet-mode access-class BACKDOOR
Syslog for every 3 failure attempts.
R1(config)#login on-failure log every 3
Assigned my inside interface fa0/0 which is connected to network 10.0.0.0/24 an ip address:
R1(config-if)#ip address 10.0.0.1 255.255.255.0
*Mar 6 00:29:06.419: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Mar 6 00:29:07.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state
I have not set up my syslog server yet that’s why the syslog output keeps appearing fortunately I have turned on logging synchronous so that the syslog message will not “cut” my incomplete command into half.
My outside interface is fa0/1, this interface is connected to my cable modem, MOL is using dynamic ip address hence I cannot configure static ip address
R1(config-if)#ip address dhcp client-id fa0/1
This way fa0/1 is a dhcp client, the client will send dhcp request to my isp’s dhcp server, my cable modem which is connected to fa0/1 will act as a relay to dhcp server. dhcp server will then send back dhcp offer message, and once my dhcp client agrees to take the ip address allocated by dhcp server; my client will send back dhcp request message back to dhcp server; dhcp server will send back dhcp ack message back to my client to confirm that the allocated ip address will be the ip address of the leased time. 80% towards the lease expired my dhcp client will send dhcp request message to dhcp server to request for the renew of the ip address lease time.
R1(config-if)#do sh ip int bri
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 10.0.0.1 YES manual up up
FastEthernet0/1 unassigned YES DHCP up up
fa0/1 has no ip address yet because this interface is not connected to the cable modem yet.
Create a crypto acl for use with isakmp ipsec vpn, traffic from network 10.0.0.0/24 to 192.168.47.0/24 will be protected under isakmp-ipsec tunnel.
R1(config)#ip access-list extended PROTECT_TRAFFIC
R1(config-ext-nacl)#permit ip 10.0.0.0 0.0.0.255 192.168.47.0 0.0.0.255
Set up IKE phase 1 i.e. ISAKMP tunnel:
R1(config)#crypto isakmp policy 1
R1(config-isakmp)#encryption aes 128
The isakmp policy states the symmetric encryption used for isakmp tunnel is 128-bit AES, using SHA-1 as the hashing algorithm for use with Diffie-Hellman(DH) key exchange, DH group 2 is 1024-bit long asymmetric key to calculate the pre-share key for both routers. The lifetime for the isakmp tunnel is one day.
Create IKE phase 2 i.e. IPsec tunnel transform set:
R1(config)#crypto ipsec transform-set MYSET esp-aes 128 esp-sha-hmac
IPsec vpn can run on transport mode and tunnel mode. I choose tunnel mode, in this mode layer 3 up to layer 7 headers will be encrypted.
Transport mode will only encrypt layer 4 to layer 7, layer 3 information is in clear text. This is when you can use GRE tunnel to hide your actual ip address. GRE will encapsulate the actual ip packet with its own header and trailer hence the actual ip address is hidden.
Create crypto map for used in phase 2:
R1(config)#crypto map MYMAP 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
The note is a notification that the map must be configured to an interface for the tunnel to be set up.
R1(config-crypto-map)#match address PROTECT_TRAFFIC
R1(config-crypto-map)#set transform-set MYSET
R1(config-crypto-map)#set peer 192.168.47.2
NOTE: 192.168.47.2 is a tentative peer ip address this is a wrong address, the peer address is unknown as my isp gives out dynamic ip address, I can identify R2 router by using it’s domain name/host name, I have not set R2 in Ayer Rajah yet.
Apply the map to interface fa0/1 which is the interface that’s connecting the cable modem.
R1(config-if)#crypto map MYMAP
*Mar 6 00:54:25.811: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
Funny why is isakmp on? How can this be? The peer router is turned off!
R1(config)#crypto isakmp key 0 cisco address 192.168.47.2 255.255.255.0
NOTE: the peer address 192.168.47.2 is temporary! The peer ip address is WRONG.
For dynamic ip address use this:
R1(config)#crypto isakmp key 0 cisco hostname <domain name of the peering router>
Configure a static route to the peer router:
R1(config)#ip route 192.168.47.0 255.255.255.0 fa0/1
Set up NAT.
Label fa0/1 as outside and fa0/0 as inside:
R1(config-if)#ip nat outside
R1(config-if)#ip nat inside
Use ACL to define which range of ip addresses will be translated:
R1(config)#access-list 10 permit 10.0.0.0 0.0.0.255
R1(config)#ip nat inside source list 10 interface fa0/1 overload
*VPN TUNNEL WILL NOT WORK BECAUSE THE VPN TRAFFIC IS BEING TRANSLATED, I HAVE TO EXCLUDE VPN TRAFFIC FROM NAT, HERE’S HOW:
R1(config)#no ip access-list standard PTE_IP
R1(config)#ip access-list extended NAT_LIST
R1(config-ext-nacl)#remark Exclude vpn traffic from being translated
R1(config-ext-nacl)#deny ip 10.0.0.0 0.0.0.255 192.168.47.0 0.0.0.255 log
R1(config-ext-nacl)#permit ip 10.0.0.0 0.0.0.255 any
*RESULTS FROM EXTENDED PING AFTER VPN TRAFFIC HAS BEEN EXCLUDED FROM NAT:
Sending 5, 100-byte ICMP Echos to 192.168.47.2, timeout is 5 seconds:
Packet sent with a source address of 10.0.0.1
*Mar 6 10:56:06.719: %SEC-6-IPACCESSLOGDP: list NAT_LIST denied icmp 10.0.0.1 -> 192.168.47.2 (0/0)
, 1 packet .!
*Mar 6 10:56:11.719: %SEC-6-IPACCESSLOGDP: list NAT_LIST denied icmp 10.0.0.1 -> 192.168.47.2 (0/0)
, 1 packet !!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 500/564/652 ms
R1#copy run start
Destination filename [startup-config]?
Ok the vpn configuration for R1 is done. I need to set up R2 in Ayer Rajah, and I must note that the peer address in my crypto map is WRONG. The peer address for the crypto key isakmp is also WRONG.
One thought on “Configuring site-to-site vpn part 1”
Cyrus Lok NAT is not compatible with IPsec vpn, tested the configuration, extended ping drop when it reaches the endpoint.
March 6 at 4:00am · LikeUnlike ·
Cyrus Lok There is a workaround for this, I got the answer from Toor in CCNA sec study group.
March 6 at 9:48am · LikeUnlike ·
* Write a comment…