Scribd Logo
Upload

Welcome to Scribd!

  • 38 views

    IPSEC Tunnel Config and Explain

    Uploaded by

    dakodo3166
    IPsec can be used to create secure connections between routers, firewalls, hosts and servers. It uses IKE (Internet Key Exchange) to establish IPsec tunnels in two phases: IKE phase 1 negotiates encryption, authentication and other parameters to set up an ISAKMP security association for managing the connection. IKE phase 2 then uses this to build the actual IPsec tunnel to encrypt and authenticate user data traffic using protocols like ESP (Encapsulating Security Payload). The 8 step process for configuring an IPsec VPN on an ASA firewall includes enabling IKEv1, setting phase 1 policies, creating tunnel groups, transform sets, access lists, crypto maps and applying it to interfaces along with NAT exemption for tunnel traffic.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    IPSEC Tunnel Config and Explain

    Uploaded by

    dakodo3166
    38 views5 pages
    IPsec can be used to create secure connections between routers, firewalls, hosts and servers. It uses IKE (Internet Key Exchange) to establish IPsec tunnels in two phases: IKE phase 1 negotiates encryption, authentication and other parameters to set up an ISAKMP security association for managing the connection. IKE phase 2 then uses this to build the actual IPsec tunnel to encrypt and authenticate user data traffic using protocols like ESP (Encapsulating Security Payload). The 8 step process for configuring an IPsec VPN on an ASA firewall includes enabling IKEv1, setting phase 1 policies, creating tunnel groups, transform sets, access lists, crypto maps and applying it to interfaces along with NAT exemption for tunnel traffic.

    Original Title

    IPSEC tunnel config and explain

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    IPsec can be used to create secure connections between routers, firewalls, hosts and servers. It uses IKE (Internet Key Exchange) to establish IPsec tunnels in two phases: IKE phase 1 negotiates encryption, authentication and other parameters to set up an ISAKMP security association for managing the connection. IKE phase 2 then uses this to build the actual IPsec tunnel to encrypt and authenticate user data traffic using protocols like ESP (Encapsulating Security Payload). The 8 step process for configuring an IPsec VPN on an ASA firewall includes enabling IKEv1, setting phase 1 policies, creating tunnel groups, transform sets, access lists, crypto maps and applying it to interfaces along with NAT exemption for tunnel traffic.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    38 views5 pages

    IPSEC Tunnel Config and Explain

    Uploaded by

    dakodo3166
    IPsec can be used to create secure connections between routers, firewalls, hosts and servers. It uses IKE (Internet Key Exchange) to establish IPsec tunnels in two phases: IKE phase 1 negotiates encryption, authentication and other parameters to set up an ISAKMP security association for managing the connection. IKE phase 2 then uses this to build the actual IPsec tunnel to encrypt and authenticate user data traffic using protocols like ESP (Encapsulating Security Payload). The 8 step process for configuring an IPsec VPN on an ASA firewall includes enabling IKEv1, setting phase 1 policies, creating tunnel groups, transform sets, access lists, crypto maps and applying it to interfaces along with NAT exemption for tunnel traffic.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 5

    IPsec can be used on many different devices, it’s used on routers, firewalls, hosts

    and servers. Here are some examples how you can use it:

    1.Between two routers to create a site-to-site VPN that “bridges” two LANs
    together.
    2.Between a firewall and windows host for remote access VPN.
    3.Between two linux servers to protect an insecure protocol like telnet.

    To establish an IPsec tunnel, we use a protocol called IKE (Internet Key Exchange).

    There are two phases to build an IPsec tunnel:

    1. IKE phase 1 (This is also called the ISAKMP tunnel or IKE phase 1 tunnel)
    2. IKE phase 2 (IKE phase 2 tunnel or IPsec tunnel)

    IKE Phase 1:
    1. In IKE phase 1, two peers will negotiate about the encryption, authentication,
    hashing and other protocols that they want to use and some other parameters that
    are required.
    In this phase, an ISAKMP (Internet Security Association and Key Management
    Protocol) session is established. This is also called the ISAKMP tunnel or IKE
    phase 1 tunnel.

    2. The collection of parameters that the two devices will use is called a SA
    (Security Association).

    3. The IKE phase 1 tunnel is only used for management traffic. We use this tunnel
    as a secure method to establish the second tunnel called the IKE phase 2 tunnel or
    IPsec tunnel and
    for management traffic like keepalives.

    IKE phase 2:
    1. IKE phase 2 tunnel (or IPsec tunnel) that we can use to protect our user data.
    This user data will be sent through the IKE phase 2 tunnel:

    2. IKE builds the tunnels for us but it doesn’t authenticate or encrypt user data.
    We use two other protocols for this:
    A. AH (Authentication Header)
    B. ESP (Encapsulating Security Payload)

    3. AH and ESP both offer authentication and integrity but only ESP supports
    encryption. Because of this, ESP is the most popular choice nowadays.

    4. Both protocols support two different modes:


    A. Transport mode
    B. Tunnel mode
    5. The main difference between the two is that with transport mode we will use the
    original IP header while in tunnel mode, we use a new IP header.
    6. Transport mode is often between two devices that want to protect some insecure
    traffic (example: telnet traffic).
    Tunnel mode is typically used for site-to-site VPNs where we need to encapsulate
    the original IP packet since these are mostly private IP addresses and can’t be
    routed on the Internet.
    I will explain these two modes in detail later in this lesson.

    IPSEC TUNEEL CONFIG:


    8 steps to Config IPSec VPN:

    1. Enable iKEv1 on outside interfac

    Command: crypto ikev1 enable OUTSIDE

    2. Configure Phase-1 parameters

    A. Create an IKEv1 policy that defines the algorithms/methods to be used for


    hashing, authentication, DH group, lifetime, and encryption.
    B. Please note that these policies should match on both sides. If you already have
    a policy then you don't need to create them.
    C. You can check whether there are any policies by running "show run crypto ikev1"
    command.

    Commands:
    crypto ikev1 policy 5
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 3600

    3. Create Tunnel Group and pre-share

    Create a tunnel-group and configure the peer IP address alongside the tunnel pre-
    shared key (PSK). Please note that the PSKs should match on both sides

    Commands:
    tunnel-group 201.85.10.1 (peer outside interface ip) type ipsec-l2l
    tunnel-group 201.85.10.1 ipsec-attributes
    ikev1 pre-shared-key Cisco123

    4. Create IPSec Transform Set


    Configure the Transform Set which is a combination of security protocols and
    algorithms that define the way the VPN peers protect data.

    Command:
    crypto ipsec ikev1 transform-set AES-HMAC esp-aes-256 esp-sha-hmac

    5. Create an extended ACL.

    Commands:
    access-list BRANCH-TO-HO extended permit tcp object user-subnet object ho-server-
    subnet

    6. Create Crypto Map

    A. Configure a Crypto Map and apply it to the outside interface. A crypto map
    defines an IPSec policy that includes an ACL to identify the interesting traffic,
    peer IP and IKEv1 transform-set that we created in the previous step.
    B. If there is already a crypto map applied on the ASA, you only need to add a new
    entry with the same crypto map name and increment the number instead of creating a
    new crypto map.

    crypto map VPN-MAP 1 match address BRANCH-TO-HO


    crypto map VPN-MAP 1 set peer 201.85.10.1
    crypto map VPN-MAP 1 set ikev1 transform-set AES-HMAC
    crypto map VPN-MAP 1 set security-association lifetime seconds 3600

    7. Apply Crypto Map to Exit interface (Outside interface)

    Commands:
    crypto map VPN-MAP interface OUTSIDE.

    8. NAT exemption.

    A. As we discussed before, any traffic that is initiated from the user subnet going
    out to the Internet is NATed to the outside interface's public IP.
    B. However, we want the traffic from the branch office to the headquarters to be
    exempted from the dynamic PAT.
    C. So, we need to tell the ASA that if the traffic is initiated from 10.10.60.0/24
    and is going out to 192.168.10.0/24, the IP address shouldn't be NAted.
    The following command just does that.

    Command:

    nat (USERS,OUTSIDE) source static user-subnet user-subnet destination static ho-


    server-subnet ho-server-subnet

    Last step is, Generate the traffic from any allowed machine to build an Tunnel.
    otherwise tuneel won't generate.

    Key Points:

    1. The name of the transform set or the crypto map name doesn't need to match on
    both peers. Only the protocols and methods within them should match.
    2. Use " show crypto isakmp sa "to verify the currently active phase - 1 tunnels.
    As you can see below, branch office ASA initiated the tunnel. Role: initiator using
    IKEv1.
    3. use " show crypto ipsec sa " command to check the status of the phase - 2 IPSec
    tunnels
    4. In the Above output, #pkts encrypt and #pkts decrypt are a very good indicator
    if you run into any issues.
    5. If you see the number of packets encrypted increasing but the number of packets
    decrypted stays the same then the issue is with receiving the packets,
    more likely an issue on the other side.
    6. If you see the 'number of packets encrypted' stays the same then our side of the
    ASA is not sending any traffic through the tunnel.
    7. IKEv2 has many new features that make it more reliable and secure but there are
    many companies that still use IKEv1. One of the benefits of IKEv2 is that it
    exchanges fewer messages to establish a tunnel compare to IKEv1.
    IKEv2 uses four messages whereas IKEv1 uses either nine messages (in the main
    mode) or six messages (in aggressive mode).

    IKEv2 requires less bandwidth than IKEv1.


    IKEv2 supports EAP authentication (next to pre-shared keys and digital
    certificates).
    IKEv2 has built-in support for NAT traversal (required when your IPsec peer is
    behind a NAT router).
    IKEv2 has a built-in keepalive mechanism for tunnels.
    8. Phase 1 tuneel bulding process:

    Step 1: Negotiation
    Hashing: we use a hashing algorithm to verify the integrity, we use MD5 or SHA
    for this.
    Authentication: each peer has to prove who he is. Two commonly used options are
    a pre-shared key or digital certificates.
    DH (Diffie Hellman) group: the DH group determines the strength of the key that
    is used in the key exchange process. The higher group numbers are more secure but
    take longer to compute.
    Lifetime: how long does the IKE phase 1 tunnel stand up? the shorter the
    lifetime, the more secure it is because rebuilding it means we will also use new
    keying material.
    Each vendor uses a different lifetime, a common default value is 86400 seconds
    (1 day).
    Encryption: what algorithm do we use for encryption? For example, DES, 3DES or
    AES.

    Step2: DH Key Exchange


    Once the negotiation has succeeded, the two peers will know what policy to use.
    They will now use the DH group that they negotiated to exchange keying material.
    The end result will be that both peers will have a shared key.

    Step 3: Authentication

    The last step is that the two peers will authenticate each other using the
    authentication method that they agreed upon on in the negotiation.
    When the authentication is successful, we have completed IKE phase 1.

    9. The three steps above can be completed using two different modes:

    Main mode
    Aggressive mode
    Main mode uses six messages while aggressive mode only uses three messages. Main
    mode is considered more secure.
    10. Phase 2 Tuneel process:

    The IKE phase 2 tunnel (IPsec tunnel) will be actually used to protect user
    data. There is only one mode to build the IKE phase 2 tunnel which is called quick
    mode.

    Just like in IKE phase 1, our peers will negotiate about a number of items:

    IPsec Protocol: do we use AH or ESP?


    Encapsulation Mode: transport or tunnel mode?
    Encryption: what encryption algorithm do we use? DES, 3DES or AES?
    Authentication: what authentication algorithm do we use? MD5 or SHA?
    Lifetime: how long is the IKE phase 2 tunnel valid? When the tunnel is about to
    expire, we will refresh the keying material.
    (Optional) DH exchange: used for PFS (Perfect Forward Secrecy).

    You might also like