EASY VPN NETWORK DIAGRAM

Transcription

1 EASY VPN NETWORK DIAGRAM HQ Router As Easy VPN Server Workgroup Switch HQ_Router Fa0/ Fa0/ IPSEC Tunnel Unsecured Network IPSEC Tunnel ADSL Router Dynamic IP Home Office Remote User Connected to HQ Using Cisco VPN Client File Server Client s PCs FIGURE 2 Telecommuter Cisco VPN Client Notes: From Cisco VPN Reference Guide For Field Engineer

2 Scenario 2 - (configuration is based on Figure 2) 1.1 Configuring Router As Easy VPN Server HQ Router Configuration Objective 1: Enabling AAA New Model And Local Credentials Activating AAA new model from global configuration mode. AAA means Authentication, Authorization and Accounting. The purpose of enabling AAA feature is to add a layer of security by controlling users access to the network and at the same time to log users activity in the network. HQ_Router(config)# aaa new-model Step 2 Define an authentication method. Local user database on the router is used to authenticate remote VPN clients. A login local database name will be created and in this scenario, userlist is configured for the login local database. It can be any name. HQ_Router(config)# aaa authentication login userlist local Step 3 Define an authorization method for network services. Create a group name for remote VPN clients local AAA authorization. In this scenario, grouplist is configured for local AAA authorization. HQ_Router(config)# aaa authorization network grouplist local Step 4 Create a local username and password for telecommuter and home office user as shown at Figure 2. HQ_Router(config)# username nemo password cisco HQ_Router(config)# username shrek password cisco

3 Objective 2: Configuring ISAKMP Policy Enabling ISAKMP command (optional) HQ_Router(config)# crypto isakmp enable Step 2 Define the ISAKMP policy number from (lower number will have higher priority) HQ_Router(config)# crypto isakmp policy 10 Step 3 Define authentication for pre-shared keys HQ_Router(config-isakmp)# authentication pre-share Step 4 Define encryption type DES, 3DES or AES (AES default value is 128. You may adjust it to AES-192 or AES-256 for higher security but it will affect your router CPU performance. DES encryption is not secure and do not use AES-192 as Cisco VPN Client unable to support this encryption. HQ_Router(config-isakmp)# encryption aes Step 5 Define the Diffie-Hellman (DH) group either group 1, 2 or 5. In this scenario, group 2 is used for this isakmp policy. HQ_Router(config-isakmp)# group 2

4 Step 6 Show the details info about this isakmp policy HQ_Router# show crypto isakmp policy Global IKE policy Protection suite of priority 10 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #2 (1024 bit) lifetime: seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method :Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: seconds, no volume limit * The above output shown that the isakmp policy have been successful configured. Objective 3: Configuring Group Policy for Remote VPN Client Define the group VPN policy criteria. A group name will be configured in the router and any group name can be use. In this scenario, a group name MYGROUP will be used. HQ_Router(config)# crypto isakmp client configuration group MYGROUP Step 2 Define the pre-shared key value and it can be alpha numeric. Note that the preshared key value is case sensitive. In this scenario, a pre-shared key value is cisco HQ_Router(config-isakmp-group)# key cisco

5 Step 3 Define a domain name (optional) HQ_Router(config-isakmp-group)# domain anyname.com Step 4 Associate this VPN group to a local IP address pool. Remote VPN client will be assigned an IP address from the local IP address pool configured in the router. In this scenario, a local IP address pool named vpnpool is configured to associate with this VPN group policy. Refer to Objective 9 HQ_Router(config-isakmp-group)# pool vpnpool Step 5 Define the access-list number for split-tunneling. This is to allow only specific network traffic to be encrypted through the tunnel. Network traffic other than the specified access-list will not be encrypted and will be sending over to the internet. Refer to Objective 8 HQ_Router(config-isakmp-group)# acl 101 Step 6 Configure the netmask for the local IP address pool. In this scenario, a subnet of 24 is configured in this VPN group policy. HQ_Router(config-isakmp-group)# netmask

6 Objective 4: Configuring IPSEC Policy with Tranform-Set Define IPSEC with transform set. (You need to create a transform set name for the IPSEC configuration. In this scenario, we will use HQSET as the IPSEC transform set name) HQ_Router(config)# crypto ipsec transform-set HQSET esp-aes esp-shahmac Step 2 Verifying the transform-set configuration HQ_Router# show crypto ipsec transform-set Transform set HQSET: { esp-aes esp-sha-hmac } will negotiate = { Tunnel, }, * The above output shown that the IPSEC transform-set has been successfully configured. Objective 5: Configuring Dynamic Crypto Map Define a dynamic crypto map name and it can be any name. In this scenario, HQDYNMAP is used as the dynamic crypto map name and number 10 as the sequence number. HQ_Router(config)# crypto dynamic-map HQDYNMAP 10 Step 2 Specify the transform-set name defined at objective 4. HQ_Router(config-crypto-map)# set transform-set HQSET

7 Step 3 Enabling reverse route injection (RRI). This feature will dynamically inject routes into HQ Router routing table when a remote VPN client has successfully connected to the VPN network. This will allow the remote VPN client to communicate with HQ Router local network. When the remote VPN client has ended the active ISPEC VPN connection, the routing information will be removed automatically. HQ_Router(config-crypto-map)# reverse-route Step 4 Exit from this mode HQ_Router(config-crypto-map)# exit Step 5 Verifying the crypto map configuration HQ_Router# show crypto dynamic-map Crypto Map Template"HQDYNMAP" 10 No matching address list set. Security association lifetime: kilobytes/3600 seconds PFS (Y/N): N Transform sets={ myset, } * The above output shown that the dynamic crypto map has been successfully configured.

8 Objective 6: Configuring Crypto Map Configure the HQ Router to respond to IPSEC VPN configuration request by the remote VPN client. In this scenario, HQMAP is used as the crypto map name. HQ_Router(config)# crypto map HQMAP client configuration address respond Step 2 Configure the HQ Router to respond to IPSEC VPN credentials request by the remote VPN client. HQ_Router(config)# crypto map HQMAP client authentication list userlist Step 3 Configure the HQ Router to respond to IPSEC VPN group policy request by the remote VPN client. HQ_Router(config)# crypto map HQMAP isakmp authorization list grouplist Step 4 Bind the dynamic crypto map with the sequence number 10 to the crypto map. This would allow HQ Router to respond to dynamic IPSEC VPN connection request from any remote IPSEC VPN client HQ_Router(config)# crypto map HQMAP 10 ipsec-isakmp dynamic HQDYNMAP

9 Objective 7: Applying Crypto Map to HQ Router s WAN Interface Access interface configuration mode HQ_Router(config)# interface fastethernet 0/0 Step 2 Assigning crypto map to outside interface (WAN) HQ_Router(config-if)# crypto map HQMAP %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON * The above output shown that the crypto map has been successfully configured on the outside interface Step 3 Verifying the crypto map configuration HQ_Router# show crypto map Crypto Map "HQMAP" 10 ipsec-isakmp Dynamic map template tag: HQDYNMAP Interfaces using crypto map HQMAP: Fastethernet0/0 * The above output shown that the crypto map has been successfully configured and associated to the outside interface

10 Objective 8: Configuring Access-List for Split-tunneling Define the access-list to encrypt traffic from local network to remote local network and an extended access-list must be configured. In this scenario, extended access-list number 101 is configured. HQ_Router(config)# ip access-list extended 101 HQ_Router (config-ext-nacl)# permit ip Objective 9: Configuring Local IP Pool for Remote IPSEC VPN Client Define a local IP pool for remote IPSEC VPN client. This pool of address will be leased out to remote VPN client when IPSEC VPN connection is successfully established. HQ_Router(config)# ip local pool vpnpool

11 Objective 8: Configuring Client PC for Cisco VPN Client Notes: Cisco VPN Client software must be downloaded from Cisco official Website. CCO account is needed in order to download Cisco VPN Client. Run the Cisco VPN client setup file as shown below

12 Step 2 Click next to proceed Step 3 Accept the license agreement and click next

13 Step 4 Confirmed the destination folder and click next Step 5 Click next to proceed

14 Step 6 Allow the system update to run Step 7 The software is installing network components for Cisco VPN client to work

15 Step 8 Click Finish Step 9 The system will prompt user to restart the PC after installation is completed. Click yes to restart Configuring Cisco Easy VP

16 0 Select the Cisco VPN Client folder and start the Cisco VPN Client program 1 Click New to create a new connection

17 2 Insert the info accordingly as configured in the router and click save 3 Key in the username and password. You may use nemo or shrek as configured in the router

18 4 Go to the VPN statistics and under the tunnel details, VPN Client shows that packets are decrypted and encrypted successfully * The above output shown that the encrypted traffic between both sides has been successful. All product names used herein, are trade names, service marks, trademarks, or registered trademarks of their respective owners. and Cisco VPN Reference Guide for Field Engineers are not associated with any product or vendor mentioned, including Cisco Systems. Cisco Routers are registered trademarks of Cisco Systems, Inc. Copyright network-insider.net 2010, All Rights Reserved