How To Establish IPSec VPN Tunnel between Cyberoam and Cisco ASA using Preshared key

Transcription

1 How To Establish IPSec VPN Tunnel between Cyberoam and Cisco ASA using Preshared key How To Establish IPSec VPN Tunnel Between Cyberoam and Cisco ASA using Preshared Key Product: The information in this article is based on Cyberoam Version onwards and Cisco ASA. Applicable to Version: onwards This article describes a detailed configuration example that demonstrates how to set up a Site-to-Site IPSec VPN connection between Cyberoam and Cisco ASA using preshared key to authenticate VPN peers. Throughout the article we will use the default VPN policy provided by Cyberoam and network parameters as shown in the diagram below. This document has 2 sections: Cisco ASA Configuration Cyberoam Configuration

2 Cisco ASA Configuration The entire configuration is to be done from Web Admin Console. Access Web Admin Console with user having Administrator profile. Step 1: Configuration Wizard Go to Configuration VPN VPN Wizard to configure Site-to-Site VPN Tunnels and then click on Launch VPN Wizard. Step 2: Configure VPN Tunnel Type Follow the On-Screen steps after clicking on Launch VPN Wizard. Select the VPN Tunnel Type as Site-to- Site and VPN Tunnel Interface as outside and click Next.

3 Step 3: Configuring Remote Site Peer Parameters Create a Remote Site Peer configuration as shown below and then Click Next. Parameters Value Peer IP Address WAN IP/Public IP address of the Cyberoam Authentication Method Pre-shared Key Pre-shared Key Tunnel Group Name (As per your requirement. Same as configured in the Cyberoam) CR_2_ASA

4 Step 4: Configuring IKE Policy Parameters Configure Internet Key Exchange (IKE) Parameters and then Click Next. Parameters Encryption Authentication Diffie-Hellman Group Value 3DES MD5 2

5 Step 5: Creating IPSec Rule Select the encryption and authentication algorithms and configure Perfect Forwarding Secrecy (PFS) for this IPSec VPN Tunnel and then Click Next. Parameters Encryption Authentication Perfect Forwarding Secrecy (PFS) Diffie-Hellman Group Value 3DES MD5 Enable 2

6 Step 6: Configuring IPSec Parameters Create/Identify hosts and networks to be used in the IPSec Tunnel. Parameters Value Source Settings Type IP Address IP Address LAN of Cisco ASA Netmask Destination Settings Type IP Address IP Address LAN of Cyberoam Netmask

7 Click and a screen will appear as shown in the below screenshot. Then Click on Add button to Add a new Network Object. Create Network Object for Cisco ASA Parameters Value Name CiscoASA_LAN IP Address Netmask

8 Create Network Object for Cyberoam Parameters Value Name CR_LAN IP Address Netmask

9 Select the Network Object for Source and Destination and Click OK. It will be placed in the appropriate field and Then Click Next. Step 6: Summary of VPN Tunnel Created A Site-to-Site VPN Tunnel will be created with the attributes as shown in the below screen:

10 Click Finish and the VPN Tunnel will be created successfully.

11 Cyberoam Configuration The entire configuration is to be done from Web Admin Console. Access Web Admin Console with user having Administrator profile. Step 1: Create IPSec connection Go to VPN IPSec Connection and click on Add button to create Connection with the following values: Parameters General Settings Name Connection Type Policy Action on VPN Restart Value CR_2_ASA Site to Site DefaultHeadOffice Respond Only Authentication Details Authentication Type Preshared Key Confirm Preshared Key Preshared Key Specify the preshared key to be used. Forward this key to the remote peer (SonicWall) as same preshared key should be used by both the peers. At the remote end, client will have to specify this key for authentication. In SonicWall, preshared key is called Shared Secret or Preshared Secret. Specify preshared key again for confirmation Local Network Details

12 Local WAN Port Select WAN port which acts as end-point to the tunnel /24 Local Subnet Select Local LAN Address. Remote Network Details Remote VPN Sever Remote Subnet /24 Click on OK and the IPSec Connection CR_2_ASA will be added successfully.

13 Step 2: Activate Connection Go to VPN IPSec Connection and click under Status against the CR_2_ASA connection to activate the connection. under Status indicates that the connection is successfully activated. Note At a time only one connection can be active if both the types of connection - Digital Certificate and Preshared Key - are created with the same source and destination. In such situation, at the time of activation, you will receive error Unable to activate connection hence you need to deactivate all other connections. Document Version /06/2011 The Corporate and individual names, data and other configuration & network parameters images in this document are for demonstration purposes only and does not reflect the real data.