Networking-Blog

My WordPress Blog

Categories

ASA Ipsec VPN Object-Group

Create an IPSEC VPN Additional tunnel using Internet Facing Interface with NAT-T enable :

Create Object-Group Network for Source Network :

object-group network MPLS_Host_to_BlueSource
description MPLS Sites-Host-Address
network-object host 172.16.0.95

Create Object-Group Network for Remote Network :

object-group network BLUESource_Network
description Blue Source private IP address
network-object 10.99.0.0 255.255.0.0

Create a Object-Group Service for TCP ports for remote traffic allowed through the IPSEC Tunnel :

object-group service BLUE_SOURCE_PORTS tcp
description Inbound Access
port-object eq 3389
port-object range 9998 9999

Create a Object-Group Service for ICMP traffic :

object-group icmp-type BLUE-SOURCE-ICMP-INBOUND
description Permit necessary inbound ICMP traffic
icmp-object echo
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded

NAT Traversal allows ESP packets to pass through one or more NAT devices.
When you enable NAT-T, the security appliance automatically opens port 4500 on all IPsec enabled interfaces.

isakmp nat-traversal 3600

Create a Rule to Disable NAT :

access-list MPLS_nat0_inbound extended permit ip object-group MPLS_Host_to_BlueSource object-group BLUESource_Network

Assign NAT Rule To Interface :

nat (MPLS) 0 access-list MPLS_nat0_inbound outside

Access-list from MPLS Host to BlueSource Network:

Allow only ICMP Traffic :

INBOUND Rule for traffic leaving the interface  :

access-list MPLS_access_in extended permit tcp object-group MPLS_Host_to_BlueSource object-group BLUESource_Network object-group BLUE-SOURCE-ICMP-INBOUND

Access-list from Blue Source to MPLS Host :

OUTBOUND Rule for traffic coming into interface  :

access-list MPLS_access_out extended permit tcp object-group BLUESource_Network object-group MPLS_Host_to_BlueSource object-group BLUE_SOURCE_PORTS
!
access-list MPLS_access_out extended permit icmp object-group BLUESource_Network object-group MPLS_Host_to_BlueSource object-group BLUE-SOURCE-ICMP-INBOUND
!
object-group BLUESource_Network
access-list MPLS_access_out extended deny ip object-group BLUESource_Network any
!
access-list MPLS_access_out extended permit ip any any

Assign ACL to Outbound of Interface :

access-group MPLS_access_out out interface MPLS

Assign Interface Crypto Map :

crypto map BlueSource_map interface PublicIP
crypto isakmp enable PublicIP

Create Access-List for Source Address to Remote Address :
Keep ACL  naming convention to match Crypto Map sequence no.

access-list BlueSource_cryptomap_390 extended permit ip object-group MPLS_Host_to_BlueSource object-group BLUESource_Network

Create IPSEC Crypto map Statement + Sequence No :

crypto map BlueSource_map 390 match address BlueSource_cryptomap_390
crypto map BlueSource_map 390 set peer 113.112.208.128
crypto map BlueSource_map 390 set transform-set ESP-3DES-SHA
crypto map BlueSource_map 390 set security-association lifetime seconds 28800
crypto map BlueSource_map 390 set security-association lifetime kilobytes 4608000

Create Tunnel-Group for assigned Public Address of Peer and Pre-shared-key :

tunnel-group 113.112.208.128  type ipsec-l2l
tunnel-group 113.112.208.128   ipsec-attributes
pre-shared-key S1u350vd7
exit

Create ISAKMP Phase 1 Policy to match Transform-Set ESP-3DES-SHA

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto isakmp policy 40
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400

Cisco ASA
No comments yet.

Tags: , ,

by admin

Cisco ASA Create Sub-Interface

interface GigabitEthernet0/2
speed 100
duplex full
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/2.15
vlan 15
nameif MPLS
security-level 99
ip address 172.18.192.251 255.255.255.0 standby 172.18.192.250
!
interface GigabitEthernet0/2.19
vlan 19
nameif Xrio
security-level 50
ip address 192.168.10.1 255.255.255.0

Create Static Routes :

route Xrio 10.2.103.0 255.255.255.0 192.168.10.2 1
route Xrio 10.2.180.0 255.255.255.0 192.168.10.2 1
route Xrio 10.2.250.0 255.255.255.0 192.168.10.2 1

Cisco ASA
No comments yet.

Tags: , ,

by admin

Troubleshoot Connections through the PIX and ASA

Make sure logging is enabled. The logging level needs to be set to debug. Logging can be sent to various locations.
This example uses the ASA log buffer. You might need an external logging server in production environments.

ciscoasa(config)#logging enable
ciscoasa(config)#logging buffered debugging

The user pings the inside interface of the ASA (ping 192.168.1.1). This output is displayed.

ciscoasa#show logging

!— Output is suppressed.

%ASA-6-302020: Built ICMP connection for faddr 192.168.1.50/512
gaddr 192.168.1.1/0 laddr 192.168.1.1/0
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.1.50/512
gaddr 192.168.1.1/0 laddr 192.168.1.1/0

!— The user IP address is 192.168.1.50.

ASA Capture Feature

The administrator needs to create an access-list that defines what traffic the ASA needs to capture. After the access-list is defined, the capture command incorporates the access-list and applies it to an interface.

ciscoasa(config)#access-list inside_test permit icmp any host 192.168.1.1
ciscoasa(config)#capture inside_interface access-list inside_test interface inside

The user pings the inside interface of the ASA (ping 192.168.1.1). This output is displayed.

ciscoasa#show capture inside_interface
1: 13:04:06.284897 192.168.1.50 > 192.168.1.1: icmp: echo request

!— The user IP address is 192.168.1.50.

Note: In order to download the capture file to a system such as ethereal, you can do it as this output shows.

!— Open an Internet Explorer and browse with this https link format:

https://[<pix_ip>/<asa_ip>]/capture/<capture name>/pcap

Refer to ASA/PIX: Packet Capturing using CLI and ASDM Configuration Example in order to know more about Packet Capturing in ASA.

Debug

The debug icmp trace command is used to capture the ICMP traffic of the user.

ciscoasa#debug icmp trace

The user pings the inside interface of the ASA (ping 192.168.1.1). This output is displayed on the console.

ciscoasa#

!— Output is suppressed.

ICMP echo request from 192.168.1.50 to 192.168.1.1 ID=512 seq=5120 len=32
ICMP echo reply from 192.168.1.1 to 192.168.1.50 ID=512 seq=5120 len=32

!— The user IP address is 192.168.1.50.

In order to disable debug icmp trace, use one of these commands:

no debug icmp trace
undebug icmp trace
undebug all

Monitor syslog messages.

Search for the source IP address of the user that you located in Step 1. The user initiates application X.
The ASA administrator issues the show logging command and views the output.

ciscoasa#show logging

!— Output is suppressed.

%ASA-7-609001: Built local-host inside:192.168.1.50
%ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.50/1107
to outside:172.22.1.254/1025
%ASA-6-302013: Built outbound TCP connection 90 for outside:172.22.1.1/80
(172.22.1.1/80) to inside:192.168.1.50/1107 (172.22.1.254/1025)

The logs reveal that the destination IP address is 172.22.1.1,
the protocol is TCP, the destination port is HTTP/80, and that traffic is sent to the outside interface.

Modify the capture filters.

The access-list inside_test command was previously used and is used here.

ciscoasa(config)#access-list inside_test permit ip host 192.168.1.50 any

!— This ACL line captures all traffic from 192.168.1.50
!— that goes to or through the ASA.

ciscoasa(config)#access-list inside_test permit ip any host 192.168.1.50 any

!— This ACL line captures all traffic that leaves
!— the ASA and goes to 192.168.1.50.

ciscoasa(config)#no access-list inside_test permit icmp any host 192.168.1.1
ciscoasa(config)#clear capture inside_interface

!— Clears the previously logged data.
!— The no capture inside_interface removes/deletes the capture.

The user initiates application X. The ASA administrator then issues the show capture inside_interface command and views the output.

ciscoasa(config)#show capture inside_interface
1: 15:59:42.749152 192.168.1.50.1107 > 172.22.1.1.80:
S 3820777746:3820777746(0) win 65535 <mss 1460,nop,nop,sackOK>
2: 15:59:45.659145 192.168.1.50.1107 > 172.22.1.1.80:
S 3820777746:3820777746(0) win 65535 <mss 1460,nop,nop,sackOK>
3: 15:59:51.668742 192.168.1.50.1107 > 172.22.1.1.80:
S 3820777746:3820777746(0) win 65535 <mss 1460,nop,nop,sackOK>

Cisco ASA
No comments yet.

Tags: ,

by admin

Cisco PIX Port forward

BTNET router is Internet facing and have a Cisco Pix connected to the inside Lan.
Need to port forward LDAP traffic to a Server sitting behind the Pix on the inside interface.

btnet:

ip nat inside source static udp 195.99.246.3 389 interface Serial1/0:0.1 389
ip nat inside source static tcp 195.99.246.3 389 interface Serial1/0:0.1 389
!
Extended IP access list 101
4 permit udp any any eq 389
5 permit udp any any eq 389
!

pix:

Interface ip Addresses:

ip address outside 195.99.246.3 255.255.255.240
ip address inside 172.16.2.253 255.255.255.0
!

name 172.16.2.50 MailServer
!
access-list outside_access_in permit udp any interface outside eq 389
access-list outside_access_in permit tcp any interface outside eq ldap
!

Static Port Forward:

static (inside,outside) tcp interface 389 MailServer 389 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 389 MailServer 389 netmask 255.255.255.255 0 0
!

Diagnostics testing:

from external source internet:
!
telnet 195.99.246.3 389

On Pix:

show access-list outside_access_in
!
access-list outside_access_in line 14 permit udp any interface outside eq 389 (hitcnt=0)
access-list outside_access_in line 15 permit tcp any interface outside eq ldap (hitcnt=6)

B00m…counter hits…(hitcnt=6)

Cisco ASA
No comments yet.

Tags: ,

by admin

Cisco: Stop Site-to-Site VPN Drop

By default, site-to-site VPNs timeout after 30 minutes of idle time. This is a pain for me when I first try to access a site and have the first few packets of my Remote Desktop session or ping or whatever drop. (Yes – those 3 seconds of my life are EXTREMELY valuable). Here’s the secret, straight from Cisco:
PIX/ASA 7.x and later

Enter the vpn-idle-timeout command in group-policy configuration mode or in username configuration mode in order to configure the user timeout period:

hostname(config)#group-policy DfltGrpPolicy attributes
hostname(config-group-policy)#vpn-idle-timeout none

Configure a maximum amount of time for VPN connections with the vpn-session-timeout command in group-policy configuration mode or in username configuration mode:

hostname(config)#group-policy DfltGrpPolicy attributes
hostname(config-group-policy)#vpn-session-timeout none

Cisco IOS Router

Use the crypto ipsec security-association idle-time command in global configuration mode or crypto map configuration mode in order to configure the IPsec SA idle timer. By default IPsec SA idle timers are disabled.

crypto ipsec security-association idle-time 
seconds

Time is in seconds, which the idle timer allows an inactive peer to maintain an SA. Valid values for the seconds argument range from 60 to 86400.

Cisco ASA, Cisco Routers
No comments yet.

Tags: , , , ,

by admin

Cisco Traversing a NAT device

 

Using NAT Traversal

Network Address Translation (NAT) and Port Address Translation (PAT) are implemented in many networks where IPSec is also used, but the number of incompatibilities that prevent IPSec packets from successfully traversing a NAT device.

PIX Firewall Version 6.3 provides a feature called “Nat Traversal,” as described by Version 2 and Version 3 of the draft IETF standard, UDP Encapsulation of IPsec Packets,” which is available at the following URL:

http://www.ietf.org/html.charters/ipsec-charter.html

NAT Traversal allows ESP packets to pass through one or more NAT devices. This feature is disabled by default.

Note NAT Traversal is supported for both dynamic and static crypto maps.

To enable NAT traversal, enter the following command:

isakmp nat-traversal [natkeepalive]
isakmp nat-traversal 20

Valid values for natkeepalive are 10 to 3600 seconds; the default is 20 seconds.

 

Enabling IPsec over NAT-T

NAT-T lets IPsec peers establish a connection through a NAT device. It does this by encapsulating IPsec traffic in UDP datagrams, using port 4500, thereby providing NAT devices with port information. NAT-T auto-detects any NAT devices, and only encapsulates IPsec traffic when necessary. This feature is disabled by default.

• The security appliance can simultaneously support standard IPsec, IPsec over TCP, NAT-T, and IPsec over UDP, depending on the client with which it is exchanging data.

• When both NAT-T and IPsec over UDP are enabled, NAT-T takes precedence.
• When enabled, IPsec over TCP takes precedence over all other connection methods.
• When you enable NAT-T, the security appliance automatically opens port 4500 on all IPsec enabled interfaces.

The security appliance supports multiple IPsec peers behind a single NAT/PAT device operating in one of the following networks, but not both:

• LAN-to-LAN
• Remote access

In a mixed environment, the remote access tunnels fail the negotiation because all peers appear to be coming from the same public IP address, that of the NAT device. Also, remote access tunnels fail in a mixed environment because they often use the same name as the LAN-to-LAN tunnel group (that is, the IP address of the NAT device).
This match can cause negotiation failures among multiple peers in a mixed LAN-to-LAN and remote access network of peers behind the NAT device.

Cisco ASA, Cisco Routers
No comments yet.

Tags: , , ,

by admin

ASA 5505 Clear Configuration

• To erase the startup configuration, enter the following command:

hostname(config)# write erase

• To erase the running configuration, enter the following command:

hostname(config)# clear configure all

This command clears all the current configuration for the specified configuration command. If you only want to clear the configuration for a specific version of the command, you can enter a value for level2configurationcommand.

For example, to clear the configuration for all aaa commands, enter the following command:

hostname(config)# clear configure aaa

To clear the configuration for only aaa authentication commands, enter the following command:

hostname(config)# clear configure aaa authentication

Cisco ASA
No comments yet.

Tags: , ,

by admin

Cisco/PIX/ASA ISAKMP States

Details on the various connection states shown in the output from commands show isakmp sa or show crypto isakmp sa executed on a Cisco PIX or ASA firewall appliance.

MM_SA_SETUP

Policy parameters have been successfully negotiated

MM_NO_STATE

Phase 1 has failed, policy parameters have not been successfully negotiated.

  • Check there is a matching crypto policy configured on both peers
  • Check you have applied and activated the relevant crypto map/policy on both peers, on the correct interface

AG_NO_STATE

As above but displayed for agressive mode connections

MM_KEY_EXCH

Peers are authenticating. If phase 1 fails here, authentication of a peer device has failed

  • Check the pre-shared key matches at both ends
  • Check the time on each peer is reasonably close to the others
  • If using certificates, confirm they are valid and have not been revoked

AG_INIT_EXCH

As above but displayed for agressive mode connections

MM_KEY_AUTH

Authentication of the peer devices has been successful, expect the state to transition to QM_IDLE or MM_ACTIVE shortly

AG_AUTH

As above but displayed for agressive mode connections

QM_IDLE

Phase 1 completed successfully



Cisco ASA
No comments yet.

Tags: , ,

by admin