Lab Configure a Secure VPN Using IPSec between a PIX and a VPN Client using PDM

Transcription

1 Lab Configure a Secure VPN Using IPSec between a PIX and a VPN Client using PDM Objective Scenario Topology Estimated Time: 30 minutes Number of Team Members: Two teams with four students per team In this lab exercise, students will complete the following tasks: Configure the PIX Easy VPN Server feature using the VPN Wizard. Install and configure the Cisco VPN Client on the Student PC. Verify and Test the Cisco VPN Client remote access connection A network administrator needs secure management access to the PIX and other critical devices on the internal network. In a small company, the budget may not allow for a dedicated VPN Concentrator. Fortunately, the PIX can be configured as an Easy VPN Remote server, allowing a Cisco VPN software client to connect. Once connected, the remote user can access internal IP based resources. Easy VPN Server can be configured using the VPN Wizard within PDM. This figure illustrates the lab network environment: 1-15 Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

2 Preparation Begin with the standard lab topology and verify the starting configuration on pod PIX Security Appliance. Access the PIX Security Appliance console port using the terminal emulator on the Student PC. If desired, save the PIX Security Appliance configuration to a text file for later analysis. The Cisco VPN 4.0 client software is required for this lab. This software can be obtained through the instructor or can be downloaded at Tools and Resources In order to complete the lab, the following is required: Standard Client-to-PIX Security Appliance lab topology Console cable HyperTerminal Additional Materials Cisco VPN Client v4.0 Student can use the following link for more information on the objectives covered in this lab: me.html Step 1 Configure the PIX Security Appliance Use the VPN Wizard as directed: a. Log into PDM. Choose Wizards>VPN Wizards. The VPN Wizard window will launch. b. Check the Remote Access VPN radio button. c. Select the outside interface in the drop down list 2-15 Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

3 d. Click the Next button. The Remote Access Client Window appears. e. Verify the Cisco VPN Client, Release 3.x or higher is chosen. Click Next. The VPN Client Group window opens. f. Enter a Group Name of REMOTEVPN with a password of remote Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

4 g. Click Next. The Extended Client Authentication Window appears. h. Verify that the Enable Extended Client Authentication checkbox is checked. i. Choose LOCAL in the AAA Server Group drop down menu. j. Click Next. The User Accounts window opens. k. Add a user admin with the password of admin123. Set the privilege level to Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

5 l. Add a second user of sales with a password of sales123. Set the privilege level to 3. m. Click the Next button. The Address Pool window opens. n. Create a pool called REMOTEVPNPOOL with a range of 11.0.P P.63 o. Click the Next button. The Attributes Pushed to Client window appears. p. Click the Next button. The IKE Policy window appears 5-15 Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

6 q. Configure DES, MD5, DH Group 2.. r. Click the Next button. The Transform Set window appears. s. Choose DES, MD5 t. Click the Next button. The Address Translation window appears 6-15 Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

7 u. Click on the browse button and choose the 10.0.P.0 network. Add this to the Selected list. v. Click the Finish button. The Preview CLI commands window will appear Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

8 w. Click the Send button. x. Navigate to the Configuration>System Properties>Administration>Management Access. y. Choose the inside interface in the drop down menu. Click Apply. Click Send if prompted. Step 2 Configure the Student PC Networking Parameters Certain networking parameters must be configured before the student PC will operate in the lab environment. Complete the following steps to configure the student PC networking parameters. a. Move the Student PC connection to the outside network on VLAN 1 b. Change the IP address and default gateway of the student PC. Obtain a DHCP address from RBB or use the following configuration parameters: IP address P (where P = pod number) Subnet mask Default gateway b. Ping the backbone router s IP address. The ping should be successful. C:\> ping Pinging with 32 bytes of data: Reply from : bytes=32 time<10ms TTL=128 Reply from : bytes=32 time<10ms TTL=128 Step 3 Install the VPN Client In this lab exercise, the source files for the VPN Client should already reside on the hard disk drive of the student PC. If the file is not available, or running a Linux or Mac OS, ask the instructor for the install file or download the VPN client from CCO Software Center. Note If the VPN client is already installed, proceed to Step Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

9 Complete the following steps to install the Cisco VPN Client on the Windows Platform. a. Open the Cisco VPN Client folder found on the student PC desktop. b. Double-click the setup.exe file in the Cisco VPN Client folder. The Cisco Systems VPN Client Setup window opens. c. Click Next. The License Agreement window opens. d. Read the license agreement and click Yes then choose a destination location. e. Accept the default destination folder by clicking Next. The Select Program Folder window opens. f. Accept the defaults by clicking Next. The Start Copying Files window opens. g. The files are copied to the hard disk drive of the student PC, and the InstallShield Wizard Complete window opens. h. Select Yes, I want to restart my computer now and click Finish. The student PC restarts. i. Log into the student PC. Step 4 Configure the Networking Parameters of the VPN Client Use the following procedure to configure the networking parameters of the VPN Client. This procedure assumes Windows 2000 is already running. a. Choose Start>Programs>Cisco Systems VPN Client>VPN Client. The Cisco Systems VPN Client window opens. b. Click New. The New Connection Entry wizard opens. c. Enter PixP as the name in the Connection Entry field. Enter the PIX Security Appliance s public interface IP address, P.2, as the IP address of the server. b. Enter the following group information in the Authentication tab. Enter a group name: REMOTEVPN Enter and Confirm a group password: remote Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

10 c. In the Transport tab, Enable Transparent Tunneling d. Click Save Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

11 Step 5 Launch the VPN Client on the Student PC Complete the following steps to launch the VPN Client on the student PC: a. Choose Start>Programs>Cisco Systems VPN Client>VPN Dialer. b. Verify that the Connection Entry is PixP. c. Verify that the IP address of the remote server is set to the PIX Security Appliance s public interface IP address, P.2. d. Click Connect. The Connection History window opens, and several messages flash by quickly. Complete the following sub-steps: When prompted for a username, enter admin. When prompted to enter a password, enter admin123. e. The window closes and a VPN (lock) icon appears in the system tray. This indicates the VPN tunnel has been successfully created. Step 6 Verify the VPN Connection Complete the following steps to verify the IPSec connection: a. Open a web browser on the VPN Client PC. b. Use the web browser to access the inside web server by entering c. The web server s home page should display. d. On the Student PC, use the browser to connect to PDM. This connection to PDM should fail. e. Right-click the VPN Dialer icon in the system tray, then left click on Statistics and observe the IP address that was assigned to the student PC. Keep this window open. Note the number of encrypted packets shown on the window Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

12 f. Console to the PIX. Add the Client IP Address pool to the list of permitted http locations. Pix1(config)# http 11.0.P inside g. On the Student PC, use the browser to connect to PDM. This connection to PDM should be successful. h. Return the VPN Client Statistics window tab and view the information provided. Notice the number of packets encrypted and decrypted have increased. Return to PDM and click on the Refresh button. Observe the packet counts increase. i. In the Home page of PDM, notice the VPN Status shows 1 IPSec Tunnel. j. Navigate to Monitoring>VPN Statistics. Click on IKE SAs to view the IKE connection information. k. Click on the IPSec VPNs to view the IPSec connection information. l. Click on the View Details button Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

13 m. Click Close. n. Left click on the VPN lock in the system tray VPN dialer icon and right click on Disconnect. o. Verify the running configuration with the end configuration for this lab. Step 7 Modify the Tunnel Policy Complete the following steps to increase the level of the tunnel security by using a stronger encryption and authentication scheme: a. Navigate to Configuration>VPN tab. b. In the Categories pane, click on IPSec>Tunnel Policy. c. Double click on the policy entry or highlight and click the Edit button. d. Select ESP-AES-256-SHA e. Click the OK button, returning to the Tunnel Policy main window. f. Click the Apply button. Click the Send button if prompted, noting the CLI commands. g. Double click on the policy entry or highlight and click the Edit button Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

14 h. Click on the Select Multiple.. button. i. Add ESP-3DES-SHA followed by ESP-DES-MD5 j. Click the OK button returning to the Tunnel Policy window. k. Click the OK button returning to the Tunnel Policy main window. l. Click the Apply button. Click the Send button if prompted, noting the order of the IPSec proposals. m. In the Categories pane, click on IKE>Policies. n. Make the following changes: Encryption: aes-256, the Hash: sha, and the D-H Group: 2 o. Click OK, returning to the IKE Policies main window. p. Click the Apply button. Click the Send button if prompted, noting IKE policy changes. q. From the Student PC, re-connect to the PIX using the VPN Client. r. Open up the VPN client statistics window and view the new Crypto values Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.

15 s. Disconnect the VPN Session and Exit PDM Fundamentals of Network Security v Lab Copyright 2004, Cisco Systems, Inc.