Networking-Blog

My WordPress Blog

Categories

Cisco Ipsec Identity Hostname

The ISAKMP identity is the interface from which the remote router will
send ISAKMP messages to the local peer. If a router supports ISAKMP on
multiple interfaces, then hostnames should be used for ISAKMP identity.

To configure a router to send its hostname in its ISAKMP peer negotiations,
use the global command

<crypto isakmp identity {hostname | address}>.

The default is to use the router’s ISAKMP interface IP address.

If the hostname option is used to identify its ISAKMP negotiations,
the remote peer hosts need to have hostname-to-IP-address mapping,

achieved with <ip host {hostname} {IP address1} {IP Address 2…IP Address 8}>.

A router can also use DNS for hostname resolution, but local hostname
definitions are faster and don’t break if there is a DNS server problem.

Below is a pre-shared key configuration example between two routers. The local router
sends it hostname, and the remote machine sends its IP address.

First is the configuration on the local peer router (both the IP address and hostname
keys have been defined):

The configuration on the local router looks like this :

!
hostname outlan-rt01
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key secretkey address 192.168.10.3
crypto isakmp identity hostname
!
interface FastEthernet0/0
ip address 172.30.80.17 255.255.255.252
!

The configuration on the remote peer router looks like this:

!
hostname inlan-rt01
!
ip host outlan-rt01 172.30.80.17
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key secretkey address outlan-rt01
!
interface FastEthernet1/0
ip address 192.168.10.3 255.255.255.252

Cisco Routers
No comments yet.

Tags: , , ,

by admin

Cisco IPSEC Pre-fragmentation VPN’s

Feature Overview

When a packet is nearly the size of the maximum transmission unit (MTU) of the outbound link of the
encrypting router, and it is encapsulated with IPSec headers, it is likely to exceed the MTU of the
outbound link.
This causes packet fragmentation after encryption, which makes the decrypting router reassemble
in the process path. Pre-fragmentation for IPSec VPNs increases the decrypting router’s performance
by enabling it to operate in the high performance CEF path instead of the process path.

Pre-fragmentation for IPSec VPNs enables an encrypting router to pre-determine the encapsulated
packet size from information available in transform sets, which are configured as part of the
IPSec security association (SA). If it is pre-determined that the packet will exceed the MTU of the
output interface, the packet is fragmented before encryption.

This avoids process level reassembly before decryption and helps improve decryption performance and
overall IPSec traffic throughput.

Benefits

Increased Performance
Delivers encryption throughput at maximum encryption hardware accelerator speeds.
This performance increase is for near MTU sized packets.

Uniform Fragmentation
Packets are fragmented into equally sized units to prevent further downstream fragmentation.

Restrictions

Take the following information into consideration before this feature is configured:

Pre-fragmentation for IPSec VPNs is on by default.
Pre-fragmentation for IPSec VPNs operates in IPSec Tunnel mode and IPSec tunnel mode with GRE,
but not with IPSec transport mode.
Pre-fragmentation for IPSec VPNs configured on the decrypting router in a unidirectional traffic scenario
does not improve the performance or change the behavior of either of the peers.
Pre-fragmentation for IPSec VPNs occurs before the transform is applied if compression is turned
on for outgoing packets.
Pre-fragmentation for IPSec VPNs functionality depends on the egress interface crypto ipsec df-bit
configuration and the incoming packet “do not fragment” (DF) bit state. See Table .

You may want use the clear setting for the DF bit when encapsulating tunnel mode IPSec traffic
so you can send packets larger than the available MTU size or if you do not know what the available
MTU size is.

clear Specifies that the outer IP header will have the DF bit cleared and that the router may fragment the packet to add
the IPSec encapsulation.
set Specifies that the outer IP header will have the DF bit set; however, the router may fragment the packet if the
original packet had the DF bit cleared.
copy Specifies that the router will look in the original packet for the outer DF bit setting.
Table 1 Pre-fragmentation For Ipsec VPNs Dependencies
Enabled crypto ipsec df-bit clear 0 Fragmentation occurs before encryption.
Enabled crypto ipsec df-bit clear 1 Fragmentation occurs before encryption.
Disabled crypto ipsec df-bit clear 0 Fragmentation occurs after encryption and packets are reassembled
before decryption.
Disabled crypto ipsec df-bit clear 1 Fragmentation occurs after encryption and packets are reassembled before decryption.
Enabled crypto ipsec df-bit set 0 Fragmentation occurs before encryption.
Enabled crypto ipsec df-bit set 1 Packets are dropped.
Disabled crypto ipsec df-bit set 0 Fragmentation occurs after encryption and packets are reassembled before decryption.
Disabled crypto ipsec df-bit set 1 Packets are dropped.
Enabled crypto ipsec df-bit copy 0 Fragmentation occurs before encryption.
Enabled crypto ipsec df-bit copy 1 Packets are dropped.
Disabled crypto ipsec df-bit copy 0 Fragmentation occurs after encryption and packets are reassembled before decryption.
Disabled crypto ipsec df-bit copy 1 Packets are dropped.
Cisco Routers
No comments yet.

Tags: , , ,

by admin

Cisco Ipsec Vpn Multiple Crypto Maps

crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key commstest address 1.1.1.1
crypto isakmp key commstest address 2.2.2.2
!
!
crypto ipsec transform-set securegz esp-3des esp-md5-hmac comp-lzs
crypto ipsec transform-set secure esp-3des esp-md5-hmac
crypto ipsec transform-set minimalgz esp-null esp-md5-hmac comp-lzs
crypto ipsec transform-set minimal esp-null esp-md5-hmac
!
crypto map comms 1 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 102
crypto map comms 2 ipsec-isakmp
set peer 2.2.2.2
set transform-set secure
match address 103
crypto map comms 3 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 104
crypto map comms 4 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 105
crypto map comms 5 ipsec-isakmp
set peer 1.1.1.1
set transform-set secure
match address 106
crypto map comms 6 ipsec-isakmp
set peer 1.1.1.1
set peer 2.2.2.2
set transform-set secure
match address 107
!
ip nat inside source list 101 interface FastEthernet0/0 overload
!
ip route 0.0.0.0 0.0.0.0 213.122.172.145
ip route 10.11.3.0 255.255.255.0 10.11.1.1
ip route 10.11.9.0 255.255.255.0 10.11.1.1
ip route 10.11.22.0 255.255.255.0 10.11.1.1
!
access-list 101 deny ip 10.11.1.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 101 deny ip 10.11.2.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 101 permit ip 10.11.1.0 0.0.0.255 any
access-list 101 permit ip 10.11.2.0 0.0.0.255 any
access-list 102 permit ip 10.11.1.0 0.0.0.255 10.11.20.0 0.0.0.255
access-list 102 permit ip 10.11.2.0 0.0.0.255 10.11.20.0 0.0.0.255
access-list 103 permit ip 10.11.1.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 103 deny ip 10.11.1.0 0.0.0.255 any
access-list 104 permit ip 10.11.2.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 104 deny ip 10.11.1.0 0.0.0.255 any
access-list 105 permit ip 10.11.22.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 105 deny ip 10.11.1.0 0.0.0.255 any
access-list 106 permit ip 10.11.3.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 106 deny ip 10.11.1.0 0.0.0.255 any
access-list 107 permit ip 10.11.9.0 0.0.0.255 10.11.0.0 0.0.255.255
access-list 107 deny ip 10.11.1.0 0.0.0.255 any
!
int fa0/0
crypto map comms

Cisco Routers
No comments yet.

Tags: , ,

by admin

Cisco Ipsec Site-Site VPN

Cisco Ipsec Site-Site VPN Configuration :

Local Site :

crypto isakmp policy 1
 encr aes
 hash sha
 authentication pre-share
 group 2
crypto isakmp key test address 1.1.1.1
!
crypto ipsec transform-set comms esp-aes esp-sha-hmac
!
crypto map comms 1 ipsec-isakmp
 set peer 2.2.2.2
 set transform-set comms
 match address 102
!
access-list 102 permit ip 10.10.10.0 0.0.0.255 172.0.0.0 0.31.255.255
                              (Lan Ip)             (Remote Subnet)
!
!
access-list 101 deny ip 10.10.10.0 0.0.0.255 172.0.0.0 0.31.255.255
       (Deny Traffic to be NaTed over the VPN Link)
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
       (Permit Local Traffic to be NaTed)
!
!
ip nat inside source list 101 interface Dialer0 overload
!
interface FA0/0
 description Connectioon_to_WAN
 ip address 1.1.1.1 255.255.255.0
 ip access-group INTERNET in
 ip nat outside
 crypto map comms
!
interface FA0/1
 description Connection_to_LAN
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
!
ip access-list extended INTERNET
permit esp host 2.2.2.2 any
permit udp host 2.2.2.2 any eq isakmp
!
end

Remote Site :

crypto isakmp policy 1
 encr aes
 hash sha
 authentication pre-share
 group 2
crypto isakmp key test address 2.2.2.2
!
crypto ipsec transform-set comms esp-aes esp-sha-hmac
!
crypto map comms 1 ipsec-isakmp
 set peer 1.1.1.1
 set transform-set comms
 match address 102
!
access-list 102 permit ip 172.0.0.0 0.31.255.255 10.10.10.0 0.0.0.255
                               (Lan Ip)             (Remote Subnet)
!
!
access-list 101 deny ip 172.0.0.0 0.31.255.255 10.10.10.0 0.0.0.255
      (Deny Traffic to be NaTed over the VPN Link)
access-list 101 permit ip 172.0.0.0 0.31.255.255 any
      (Permit Local Traffic to be NaTed)
!
!
ip nat inside source list 101 interface Dialer0 overload
!
interface FA0/0
description Connectioon_to_WAN
ip address 2.2.2.2 255.255.255.0
ip access-group INTERNET in
ip nat outside
crypto map comms
!
interface FA0/1
description Connection_to_LAN
ip address 172.16.1.1 255.255.255.0
ip nat inside
!
ip access-list extended INTERNET
permit esp host 1.1.1.1 any
permit udp host 1.1.1.1 any eq isakmp
!
end

VPN Tweaks :

config terminal

crypto isakmp keepalive 15 10
!
crypto map comms securewan 1 ipsec-isakmp
set security-association lifetime kilobytes 18432000
set security-association lifetime seconds 86400
set security-association idle-time 7200

2 Types of VPN Encryption :

crypto ipsec transform-set esp-aes esp-md5-hmac
crypto ipsec transform-set esp-aes esp-sha-hmac
!
crypto isakmp policy 1
 hash md5
 hash sha
Cisco Routers
No comments yet.

Tags: , , , ,

by admin