Cisco Bridge Interface
interface Vlan1
bridge-group 1
!
bridge 1 protocol ieee
bridge 1 route ip
Cisco IPSEC PFS
Perfect Forward Secrecy (PFS)
—PFS ensures that a given IPsec SA key was not derived from any other secret, like some other keys. In other words, if someone breaks a key, PFS ensures that the attacker is not able to derive any other key. If PFS is not enabled, someone can potentially break the IKE SA secret key, copy all the IPsec protected data, and then use knowledge of the IKE SA secret in order to compromise the IPsec SAs setup by this IKE SA. With PFS, breaking IKE does not give an attacker immediate access to IPsec. The attacker needs to break each IPsec SA individually. The Cisco IOS IPsec implementation uses PFS group 1 (D-H 768 bit) by default.
Cisco Banner MOTD
banner login #
!
** This is the property of Comms Limited. **
You are required to have personal authorisation from the Network Administrator before you use this system. Unauthorised access of a computer constitutes an offence under the Computer Misuse Act 1990.
If you understand this message and have been authorised to use this system please enter your username and password below to continue this session. Otherwise, you must disconnect from this session immediately.
All access to this device is logged #
Route Map Pc-Anywhere
ip nat inside source static tcp 172.16.74.1 5631 1.1.1.1 5631 route-map zonal extendable
ip nat inside source static udp 172.16.74.1 5632 1.1.1.1 5632 route-map zonal extendable
!
route-map zonal permit 10
match ip next-hop 2
!
access-list 2 permit 217.47.38.185
access-list 2 permit 217.47.151.161
Cisco TACACS Configuration
aaa new model
aaa authentication login default group tacacs+ local enable
aaa authorization exec default group tacacs+ local none
aaa authorization commands 0 default group tacacs+ local none
aaa authorization commands 1 default group tacacs+ local none
aaa authorization commands 15 default group tacacs+ local none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
!
tacacs-server host 1.1.1.1
tacacs-server directed-request
tacacs-server key 0 C0mm5
Cisco Named Access-List WAN
ip access-list extended Wan_Traffic_in
remark ISP_DHCP
permit udp any any eq bootpc bootps
remark DENY_Spam_Email_Ip_Addresses
deny ip host 80.237.152.41 any
deny ip host 210.193.7.241 any
deny ip host 194.146.227.72 any
deny ip host 218.107.207.123 any
deny ip host 80.189.90.17 any
deny ip host 58.215.255.74 any
deny ip host 60.191.248.102 any
deny ip host 209.202.164.112 any
deny ip host 68.142.212.70 any
deny ip host 195.95.24.94 any
deny ip host 208.74.44.15 any
deny ip host 62.1.216.170 any
deny ip host 68.180.151.74 any
deny ip host 204.244.135.1 any
deny ip host 12.154.55.204 any
deny ip host 209.237.150.20 any
deny ip host 72.52.206.162 any
deny ip host 59.106.72.230 any
deny ip host 213.92.32.230 any
deny ip host 87.24.42.59 any
deny ip host 82.98.86.172 any
remark DENY_IP_Spoofing_Addresses
deny ip 10.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.0.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 224.0.0.0 0.255.255.255 any
deny ip 240.0.0.0 0.255.255.255 any
remark DENY_Traffic
deny tcp any host 86.17.130.81 eq telnet
deny udp any host 86.17.130.81 eq 135
deny udp any host 86.17.130.81 eq netbios-ns
deny udp any host 86.17.130.81 eq netbios-ss
deny ip host 0.0.0.0 any
remark ICMP
permit icmp any host 86.17.130.81 administratively-prohibited
permit icmp host 80.74.17.9 host 86.17.130.81 echo
permit icmp any host 86.17.130.81 echo-reply
permit icmp any host 86.17.130.81 unreachable
permit icmp any host 86.17.130.81 time-exceeded
permit icmp any host 86.17.130.81 traceroute
remark MTU_Path_Discovery
permit icmp any host 86.17.130.81 packet-too-big
remark IPSEC
permit udp any host 86.17.130.81 eq non500-isakmp
permit udp any host 86.17.130.81 eq isakmp
permit esp any host 86.17.130.81
permit ahp any host 86.17.130.81
permit tcp any host 86.17.130.81 eq 10000
remark VPN_PPTP
permit tcp any host 86.17.130.81 eq 1723
remark GRE
permit gre any host 86.17.130.81
remark RDP
permit tcp any host 86.17.130.81 eq 3390
remark FTP
permit tcp any host 86.17.130.81 eq 121
permit tcp any host 86.17.130.81 eq 47000
permit tcp any host 86.17.130.81 eq 47001
permit tcp any host 86.17.130.81 eq 47002
permit tcp any host 86.17.130.81 eq 47003
permit tcp any host 86.17.130.81 eq 47004
permit tcp any host 86.17.130.81 eq 47005
permit tcp any host 86.17.130.81 eq 47006
permit tcp any host 86.17.130.81 eq 47007
permit tcp any host 86.17.130.81 eq 47008
permit tcp any host 86.17.130.81 eq 47009
permit tcp any host 86.17.130.81 eq 47010
remark SSH
permit tcp any host 86.17.130.81 eq 22
remark NTP
permit udp host 193.201.200.74 host 86.17.130.81 eq ntp
remark UTORRENT_LIMEWIRE
permit tcp any host 86.17.130.81 eq 50518
deny ip any any log
!
interface fa0/0
ip access-group Wan_Traffic_in in
Cisco Named Access-List LAN
ip access-list extended Lan_Traffic_Out
deny ip host 192.168.2.4 host 24.199.192.15
deny ip host 192.168.2.4 host 216.27.56.6
deny ip host 192.168.2.4 host 207.38.11.174
remark HTTP
permit tcp host 192.168.2.4 any eq www
remark HTTPS
permit tcp host 192.168.2.4 any eq 443
remark AAA_Radius
permit udp host 192.168.2.4 host 192.168.2.1 range 1645 1646
remark ICMP
permit icmp host 192.168.2.4 any
remark DNS
permit udp host 192.168.2.4 any eq domain
permit tcp host 192.168.2.4 any eq domain
remark SSH
permit tcp host 192.168.2.4 any eq 22
remark TFTP
permit udp host 192.168.2.4 any eq tftp
remark TELNET
permit tcp host 192.168.2.4 any eq telnet
remark NTP
permit udp 192.168.2.0 0.0.0.15 host 192.168.2.1 eq ntp
remark SMTP
permit tcp host 192.168.2.4 any eq smtp
remark MICROSOFT VPN
permit tcp host 192.168.2.4 any eq 1723 log
remark GRE (GENERIC ROUTING ENCAPSULATION)
permit gre host 192.168.2.4 any log
remark RDP
permit tcp host 192.168.2.4 any eq 3389
remark VNC
permit tcp host 192.168.2.4 any eq 5900
remark NETFLOW_ANALYZER
permit udp host 192.168.2.4 host 192.168.2.1 eq 9996
remark SNMP
permit udp host 192.168.2.4 host 192.168.2.1 eq snmp
remark SNMP_TRAPS
permit udp host 192.168.2.4 host 192.168.2.1 eq snmptrap
remark SYSLOG
permit udp host 192.168.2.4 host 192.168.2.1 eq syslog
remark MSN MSSENGER
permit tcp host 192.168.2.4 207.46.106.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 207.46.107.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 207.46.110.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 207.46.124.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 207.46.125.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 64.4.34.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 64.4.36.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 64.4.37.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 64.4.50.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 65.54.171.0 0.0.0.255 eq 1863
permit tcp host 192.168.2.4 65.54.228.0 0.0.0.255 eq 1863
remark SPOTIFY
permit tcp host 192.168.2.4 host 78.31.8.14 eq 4070
permit tcp host 192.168.2.4 host 78.31.8.31 eq 4070
permit tcp host 192.168.2.4 host 78.31.8.16 eq 4070
permit tcp host 192.168.2.4 host 78.31.8.17 eq 4070
permit tcp host 192.168.2.4 host 78.31.8.18 eq 4070
permit tcp host 192.168.2.4 host 78.31.8.19 eq 4070
remark LIMEWIRE
permit tcp host 192.168.2.4 any eq 6346 log
remark UTORRENT
permit tcp host 192.168.2.4 any range 1024 65535
permit udp host 192.168.2.4 any range 1024 65535
remark PRINTER
permit tcp host 192.168.2.4 host 192.168.5.2 eq 9100
remark DENY_TRAFFIC
deny ip any any log
!
interface vlan 1
ip access-group Lan_Traffic_Out in
Cisco IP NaTing Source Outside
ip nat outside source static 172.16.10.20 10.11.254.212
ip nat outside source static 172.16.10.24 10.11.254.213
ip nat outside source static 172.16.10.25 10.11.254.216
ip nat outside source static 172.16.10.75 10.11.254.214
ip nat outside source static 172.16.10.76 10.11.254.215
!
!
ip route 0.0.0.0 0.0.0.0 1.1.1.1 (Wan Interface)
ip route 10.11.0.0 255.255.0.0 10.11.254.254 (Local LAN Gateway)
ip route 10.11.254.212 255.255.255.255 1.1.1.1
ip route 10.11.254.213 255.255.255.255 1.1.1.1
ip route 10.11.254.214 255.255.255.255 1.1.1.1
ip route 10.11.254.215 255.255.255.255 1.1.1.1
ip route 10.11.254.216 255.255.255.255 1.1.1.1
Cisco Ipsec Vpn Multiple Crypto Maps
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key commstest address 1.1.1.1
crypto isakmp key commstest address 2.2.2.2
!
!
crypto ipsec transform-set securegz esp-3des esp-md5-hmac comp-lzs
crypto ipsec transform-set secure esp-3des esp-md5-hmac
crypto ipsec transform-set minimalgz esp-null esp-md5-hmac comp-lzs
crypto ipsec transform-set minimal esp-null esp-md5-hmac
!
crypto map comms 1 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 102
crypto map comms 2 ipsec-isakmp
set peer 2.2.2.2
set transform-set secure
match address 103
crypto map comms 3 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 104
crypto map comms 4 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 105
crypto map comms 5 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 106
crypto map comms 6 ipsec-isakmp
set peer 1.1.1.1
set peer 2.2.2.2
set transform-set secure
match address 107
!
ip nat inside source list 101 interface FastEthernet0/0 overload
!
ip route 0.0.0.0 0.0.0.0 213.122.172.145
ip route 10.11.3.0 255.255.255.0 10.11.1.1
ip route 10.11.9.0 255.255.255.0 10.11.1.1
ip route 10.11.22.0 255.255.255.0 10.11.1.1
!
access-list 101 deny ip 10.11.1.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 101 deny ip 10.11.2.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 101 permit ip 10.11.1.0 0.0.0.255 any
access-list 101 permit ip 10.11.2.0 0.0.0.255 any
access-list 102 permit ip 10.11.1.0 0.0.0.255 10.11.20.0 0.0.0.255
access-list 102 permit ip 10.11.2.0 0.0.0.255 10.11.20.0 0.0.0.255
access-list 103 permit ip 10.11.1.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 103 deny ip 10.11.1.0 0.0.0.255 any
access-list 104 permit ip 10.11.2.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 104 deny ip 10.11.1.0 0.0.0.255 any
access-list 105 permit ip 10.11.22.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 105 deny ip 10.11.1.0 0.0.0.255 any
access-list 106 permit ip 10.11.3.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 106 deny ip 10.11.1.0 0.0.0.255 any
access-list 107 permit ip 10.11.9.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 107 deny ip 10.11.1.0 0.0.0.255 any
!
int fa0/0
crypto map comms
Cisco Ipsec Vpn Tweaks
Cisco Ipsec Tweaks :
crypto isakmp keepalive 15 10
!
crypto map securewan 1 ipsec-isakmp
set security-association lifetime kilobytes 18432000
set security-association lifetime seconds 86400
set security-association idle-time 7200
!
If your replay window size has not been set to a number that is high enough for the number of packets received, you will receive a system message such as the following:
*Nov 17 19:27:32.279: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1
The above message is generated when a received packet is judged to be outside the anti-replay window.
Additional Notes:
If there’s no interruption of service, it could just be a normal and temporary condition, especially if the SAs (IPSEC tunnels) are still being established.
Otherwise, I suggest setting the anti-replay window to, say, 1024.
crypto ipsec security-association replay window-size 1024
Additional Notes:
set security-association idle-time
IPsec SA idle timer allows SAs associated with inactive peers to be deleted after given time expires, thus allowing more resources will be available to create new SAs as required.
When a router running the Cisco IOS software creates an IPsec security association (SA) for a peer, resources must be allocated to maintain the SA. The SA requires both memory and several managed timers. For idle peers, these resources are wasted. If enough resources are wasted by idle peers, the router could be prevented from creating new SAs with other peers. The IPsec Security Association Idle Timers feature introduces a configurable idle timer to monitor SAs for activity, allowing SAs for idle peers to be deleted. Benefits of this feature include:
•
Increased availability of resources
•Improved scalability of Cisco IOS IPsec deployments
set security-association idle-time 7200
The IPsec SA idle timers are different from the global lifetimes for IPsec SAs. The expiration of the global lifetime is independent of peer activity. The IPsec SA idle timer allows SAs associated with inactive peers to be deleted before the global lifetime has expired.
If the IPsec SA idle timers are not configured, only the global lifetimes for IPsec SAs are applied. SAs are maintained until the global timers expire, regardless of peer activity.