IPSEC VPN CISCO DRAYTEK ADSL Kurulum Dökümanı

Transcription

1 IPSEC VPN CISCO DRAYTEK ADSL Kurulum Dökümanı Versiyon Değişikliği Yapan Değişiklik Tarih 1.0 Murat Saatçi İlk taslak // 1/10

2 1 Amaç Bu döküman da Türk Telekom ADSL omurgasına bağlı IPSEC sonlandırma yapabilen ADSL router ile ****** omurgasına bağlı cisco router arasında IPSEC VPN kurulumuna ait detaylar bulunmaktadır. 2 KAPSAM Mevcut 1024/256kbit ADSL hat üzerinde çalışan IPSEC destekli draytek vigor 2600v ADSL router ile ***** omurgasına 2mbit leased line bağlı bir cisco router arasında IPSEC VPN tünelinin nasıl kurulabileceği konfigurasyon örnekleriyle anlatılmıştır. 3 Test Ortamı Pre-shared key : Draytek ADSL router : Model : Vigor2600V series annex A Firmware Version : 2.5.2_UK Build Date/Time : Fri Mar 26 14:27: LAN MAC Address : F Draytek e bağlı LAN networku : / 24 Real IP : Cisco router : Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JK9S-M), Version 12.2(27), RELEASE SOFTWARE (fc3) Copyright (c) by cisco Systems, Inc. Compiled Tue 02-Nov-04 23:43 by kellmill Image text-base: 0x C, data-base: 0x815C7B40 ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1) IPSECTEST uptime is 6 days, 2 hours, 2 minutes System returned to ROM by power-on System image file is "flash:c2600-jk9s-mz bin" This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for // 2/10

3 compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: If you require further assistance please contact us by sending to [email protected]. cisco 2610 (MPC860) processor (revision 0x203) with 61440K/4096K bytes of memory. Processor board ID JAD ( ) M860 processor: part number 0, mask 49 Bridging software. X.25 software, Version SuperLAT software (copyright 1990 by Meridian Technology Corp). TN3270 Emulation software. 1 Ethernet/IEEE interface(s) 2 Serial(sync/async) network interface(s) 32K bytes of non-volatile configuration memory K bytes of processor board System flash (Read/Write) Configuration register is 0x2102 Cisco ya Bağlı LAN networku : / 24 Cisco serial bacak real IP : Konfigurasyonlar Draytek Konfigurasyon : Router Web Configurator Setup Main Menu DrayTek Corp. Model : Vigor2600V series annex A Firmware Version : 2.5.2_UK Build Date/Time : Fri Mar 26 14:27: LAN MAC Address : F Basic Setup (Setup First) >> Administrator Password Setup >> LAN TCP/IP and DHCP Setup >> Wireless LAN Setup Advanced Setup >> Dynamic DNS Setup Quick Setup >> Internet Access Setup System Management >> Online Status // 3/10

4 >> Call Schedule Setup >> NAT Setup >> RADIUS Setup >> Static Route Setup >> IP Filter/Firewall Setup >> VPN and Remote Access Setup >> UPNP Service Setup >> VoIP Setup >> VLAN/Rate Control >> VPN Connection Management >> Configuration Backup / Restoration >> SysLog / Mail Alert Setup >> Time Setup >> Management Setup >> Diagnostic Tools >> Reboot System >> Firmware Upgrade (TFTP Server) Copyright (c) 2003, DrayTek Corp. All Rights Reserved. Router Web Configurator > Basic Setup> Ethernet TCP/IP and DHCP Setup <<Main Menu LAN IP Network Configuration For NAT Usage 1st IP Address : st Subnet Mask : For IP Routing Usage : Enable Disable 2nd IP Address : 2nd Subnet Mask : RIP Protocol Control : Disable DHCP Server Configuration Enable Server Disable Server Relay Agent Start IP Address : IP Pool Counts : Gateway IP Address : DHCP Server IP Address for Relay Agent : DNS Server IP Address Primary IP Address : Secondary IP Address : OK Copyright (c) 2003, DrayTek Corp. All Rights Reserved. VPN and Remote Access setup / LAN to LAN profile Setup / 1. vpn Router Web Configurator > Advanced Setup> LAN-to-LAN Profile Setup <<Main Menu // 4/10

5 Profile Index : 1 <<Back Clear 1. Common Settings Call Direction Both Dial-Out Dial- In Profile Name Enable this profile vpn Always on Idle Timeout -1 second(s) Enable PING to keep alive PING to the IP Dial-Out Settings Type of Server I am calling Link Type Disable ISDN PPTP IPSec Tunnel L2TP with IPSec Policy None Username??? Password PPP Authentication PAP/CHAP VJ Compression On Off Server IP/Host Name for VPN. (such as draytek.com or ) IPSec Security Method Medium(AH) 3DES w ith Authentication High(ESP) Scheduler (1-15),,, Callback Function (CBCP) Require Remote to Callback 3. Dial-In Settings Allowed Dial-In Type ISDN PPTP IPSec Tunnel L2TP with IPSec Policy None Provide ISDN Number to Remote Username??? Password VJ Compression On Off IPSec Security Method Specify Remote VPN Gateway Medium (AH) High (ESP) // 5/10

6 Peer VPN Server IP DES 3DES AES or Peer ID 4. TCP/IP Network Settings My WAN IP Remote Gateway IP Remote Network IP Remote Network Mask RIP Direction TX/RX Both RIP Version Ver. 2 For NAT operation, treat remote sub-net as Private IP Change default route to this VPN tunnel OK Copyright (c) 2003, DrayTek Corp. All Rights Reserved. IKE advance settings IKE phase 1 mode Main mode Aggressive mode IKE phase 1 proposal DES_MD5_G1/DES_SHA1_G1/3DES_MD5_G1/3DES_MD5 IKE phase 1 key lifetime IKE phase 2 key lifetime (900 ~ 86400) (600 ~ 86400) Perfect Foward Secret Local ID Disable Enable Router Web Configurator > System Management > VPN Connection Management <<Main Menu Dial-out Tool Refresh Seconds : 10 ( vpn ) VPN Connection Status // 6/10

7 VPN Type Remote IP Virtual Network Tx Pkts Tx Rate Rx Pkts Rx Rate UpTime 1 ( vpn ) IPSec Tunnel 3DES-MD5 Auth / : 1 : 3 xxxxxxxx : Data is encrypted. xxxxxxxx : Data isn't encrypted. Copyright (c) 2003, DrayTek Corp. All Rights Reserved. Cisco Router Konfigurasyon: IPSECTEST#sh run Building configuration... Current configuration : 1383 bytes version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption hostname IPSECTEST enable secret 5 $1$uHQ8$HqBzX4o3OxN52xteeciZU1 username test password 0 test ip subnet-zero ip name-server ip name-server ip name-server crypto isakmp policy 1 hash md5 authentication pre-share crypto isakmp key address no-xauth crypto ipsec transform-set aaaa esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map cm-cryptomap local-address Serial0/0 crypto map cm-cryptomap 1 ipsec-isakmp set peer set transform-set ESP-3DES-MD5 ESP-3DES-SHA // 7/10

8 match address 100 crypto map cm-cryptopmap 1 ipsec-isakmp Incomplete call rsvp-sync interface Ethernet0/0 ip address half-duplex interface Serial0/0 ip address clockrate crypto map cm-cryptomap interface Serial0/1 no ip address shutdown ip classless ip route Serial0/0 ip http server access-list 100 permit ip dial-peer cor custom line con 0 line aux 0 line vty 0 4 password test login end // 8/10

9 5 Sonuçlar IPSEC VPN üzerinden icmp test sonuçları: IPSECTEST-2600#ping Protocol [ip]: Target IP address: ( Draytek e bağlı bir PC ) Repeat count [5]: 1000 Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: ( 2600 Ethernet IP si ) Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 1000, 100-byte ICMP Echos to , timeout is 2 seconds: Packet sent with a source address of Success rate is 100 percent (1000/1000), round-trip min/avg/max = 24/84/192 ms IPSECTEST#sh crypto ipsec sa interface: Serial0/0 Crypto map tag: cm-cryptomap, local addr local ident (addr/mask/prot/port): ( / /0/0) remote ident (addr/mask/prot/port): ( / /0/0) current_peer: PERMIT, flags={origin_is_acl,} #pkts encaps: 626, #pkts encrypt: 626, #pkts digest 626 #pkts decaps: 1443, #pkts decrypt: 1443, #pkts verify 1443 #pkts compressed: 0, #pkts decompressed: 0 // 9/10

10 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 795 local crypto endpt.: , remote crypto endpt.: path mtu 1500, ip mtu 1500, ip mtu interface Serial0/0 current outbound spi: 264D9B3A inbound esp sas: spi: 0x62C52F24( ) transform: esp-3des esp-md5-hmac, in use settings ={Tunnel, } slot: 0, conn id: 2000, flow_id: 1, crypto map: cm-cryptomap sa timing: remaining key lifetime (k/sec): ( /3003) IV size: 8 bytes replay detection support: Y inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x264D9B3A( ) transform: esp-3des esp-md5-hmac, in use settings ={Tunnel, } slot: 0, conn id: 2001, flow_id: 2, crypto map: cm-cryptomap sa timing: remaining key lifetime (k/sec): ( /3003) IV size: 8 bytes replay detection support: Y outbound ah sas: outbound pcp sas: // 10/10