Biznet GIO Cloud - Build Site to Site VPNWith Cisco Router. Site to Site VPN with Cisco Router

Transcription

1 Site t Site VPN with Cisc Ruter

2 Intrductin This dcument is intended t guide yu thrugh the necessary steps t build a site-t-site VPN. Please nte a site-t-site VPN can nly be built frm a VPC therefre fr the purpses f this guide. In rder t demnstrate the site-t site VPN we will shw yu hw t build ne VPC and Cisc. Shuld yu wish t build a site-t-site VPN between yur VPC and anther lcatin the build prcess and lgic will be the same. Here is summary step fr cnnecting site-t-site VPN. 1. Determine the VPN parameter (IP address/ Pre share Key/Phase1,2 plicy) 2. Cnfigure VPC 3. Cnfigure tier n VPC 4. Deply Virtual Machine n the tier 5. Cnfigure VPN Custmer Gateway 6. Cnnect VPN frm VPC <Cmpnent Image> 2 f 12

3 Getting Started In rder t build yur VPN between tw sites yu need t knw the public IP Addresses f bth sites and ensure the parameters between the tw sites are the same and the secret key yu devise is als the same. 1. Determine VPN parameter (IP address/ Pre share Key/Phase1,2 plicy ) Please determine VPN parameter (Parameter sheet) Setting Clud - VPC Remte Cisc Ruter IP Address (Glbal IP) B: A: CIDR (Private NW) D: /24 B: /24 Phase 1 Phase 2 Shared Secret AES128, SHA1, mdp1024(2) AES128, SHA1, nne :define sme pre shared key 2. Cnfigure VPC Navigate t the [VPC s] tab. Frm the Hme screen select [Managed Resurces] fllwed by [Clud]. This will bring up all the Managed Resurces tabs yu will need t create yur VPN. Select Add PVC, the cnfiguratin will cme up. Fill in VPC name: name f the VPC Descriptin: t recgnize yur VPC Zne: Zne where the VPC is available. CIDR: CIDR range fr all the tiers within the VPC. Agree terms and Cnditins 3 f 12

4 After cnfiguring VPC, please check Glbal IP address is assigned in VPC. Check Public IP address (hw t check parameter C) We need this IP address fr setting VPN at Cisc C 4 f 12

5 3. Cnfigure Tier n the VPC Adding a Tier: Tiers are distinct lcatins within a VPC that act as islated netwrks, which d nt have access t ther tiers by default. Tiers are set up n different VLANs that can cmmunicate with each ther by using a virtual ruter. Tiers prvide inexpensive, lw latency netwrk cnnectivity t ther tiers within the VPC. 1. Click Add a Tier. 2. Specify the fllwing details: Netwrk name: Name fr the netwrk Netwrk Desc: Descriptin f the netwrk Zne: Zne t which the netwrk will be added Netwrk Offering: Netwrk ffering t use fr the netwrk Gateway: Gateway t be used Netmask: The netmask in use n the subnet Netwrk Dmain: Dmain where the netwrk will be available 3. Select the check bx t accept the terms and cnditins and click OK. 5 f 12

6 6 f 12

7 4.Deply Virtual Machine n the VPC tier Please nte that yu need t make tier netwrk befre deplying VM. When yu subscribe and prvisin VM please select Tier Netwrk is assciate in VPC. 7 f 12

8 5.Cnfigure VPN Custmer Gateway Please nte befre cntinue t further step, VPN Custmer Gateway is yur public IP is assigned in yur Ruter (this example it is Cisc side). Nw that yu have cnfirmed the IP Addresses and nted them dwn yu need t build the VPN gateway. As we are building ur VPN t VPC s we will nly need t cnfigure the gateway in yur VPC nce as well as cnfiguring the remte site. Open the [VPN Custmer Gateway] tab. Select [Add New]. A cnfiguratin bx will ppup as per the example belw. Yu will need t cmplete these details based n yur design, guidance is prvided when yu select each entry. A A A B Name yur VPN Gateway. Yur name shuld be unique and memrable as yu may create multiple VPN Gateways in yur Accunt and yu need t knw which ne is which. Gateway IP - enter the Remte IP Address fr the target site. (In this example yu need t write the IP f Cisc ).A Netwrks- enter the netwrk subnet fr the target IP Address (In this example input IP address f LAN side : /24) IPSec Preshared Key - this is the secret key yu will need t enter int bth side, yur VPC s and the target Ruter. Standard IPSec key rules apply. Greater than 6 characters. Alpha r numeric characters. Case sensitive. ]. 8 f 12

9 6.Cnnect VPN frm VPCs Once yu have created the VPN Custmer Gateway yu nw need t create the VPN Cnnectin. Navigate back t the VPC. Frm the left hand navigatin select the VPC where yu have created yur VPN Custmer Gateway. Select [VPN Cnnectins] Select [Add VPN Cnnectin]. This will pen a new ppup called Add VPN Cnnectin. Using the drpdwn menu select the apprpriate VPN Gateway. When we created ur VPN Gateway we named it the same as the VPC t make it easier t identify. Accept the Terms & Cnditins. Select [Cnfirm]. The VPN will nw try and cnnect hwever it will fail. This is an expected result as yu have nt yet created the cnnectin at the destinatin site. 9 f 12

10 Yu will nte that the Gateway and Netwrk addresses have nw been ppulated but yu will see the errr as the destinatin site is nt ready. Again unless yu have dne this in quick successin, this will be in an Errr state as the first cnnectin will have timed ut waiting fr the ther end t respnd. T re-establish the cnnectin yu must reset bth ends f the VPN, t d this use the [Reset] ptins 10 f 12

11 Change ACL Reference Cisc cnfiguratin If yu need t check the cnnectivity, please change the ACL n the tier. Select VPCs>Tiers Define Access Cntrl List (ACL) n the VPC virtual ruter t cntrl incming (ingress) and utging (egress) traffic between the VPC tiers, and the tiers and Internet. By default, all incming and utging traffic t the guest netwrks is blcked. T pen the prts, yu must create a new netwrk ACL. 11 f 12

12 Cnfiguratin reference fr CISCO ruter: crypt isakmp plicy 1 encr 3des hash md5 authenticatin pre-share grup 5 crypt isakmp key address <-----Parameter C!! crypt ipsec transfrm-set prpsal4 esp-3des esp-md5-hmac! crypt map cmap 2 ipsec-isakmp set peer <-----Parameter C set transfrm-set prpsal4 match address 165 ip nat inside surce list 185 interface GigabitEthernet0 verlad interface GigabitEthernet0 ip address ip access-grup 102 in duplex aut speed aut fair-queue crypt map cmap access-list 102 permit ip any any access-list 165 permit ip <- We allw tw subnets 12 f 12