Wednesday 30 September 2009

PIX/ASA Remote Access VPN with L2L VPN and Failover - How to

This is the practical for this lab:
here

There are a few things that we have already covered in other labs, Lan to Lan (or site to site) VPNs, NAT etc. However the main reason for this lab is three fold.

1) Setting up Active/Standby Failover
2) Setting up remote access IPSec VPN (in combination with L2L VPN)
3) Allowing the Remote User access to the Spoke Via Split Tunneling


When setting up failover, you should setup the first "unit" with a basic configuration, then use the LAN failover interface to sync the two up.


So here the basic config on FW1 (Primary unit):

Setting up the Interfaces:

interface Ethernet0
nameif Outside
security-level 0
ip address 10.0.0.1 255.255.255.0 standby 10.0.0.2
!
interface Ethernet1
nameif Inside
security-level 100
ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
!
interface Ethernet2
description trunk for failovers
!
interface Ethernet2.200
description LAN Failover Interface
vlan 200
!
interface Ethernet2.300
description STATE Failover Interface
vlan 300
!


Note: The failover interfaces cannot be on a shared interface.

Diagnostic ACL for pings etc:

access-list WAN_IN extended permit icmp any any


NAT

global (Outside) 1 interface
nat (Inside) 1 0.0.0.0 0.0.0.0


Default Gateway:

route Outside 0.0.0.0 0.0.0.0 10.0.0.4



Failover Config (Primary):

failover lan unit primary
failover lan interface lan-fo Ethernet2.200
failover polltime unit msec 200 holdtime msec 800
failover key letmeinfo
failover link state-fo Ethernet2.300
failover interface ip lan-fo 192.168.20.1 255.255.255.0 standby 192.168.20.2
failover interface ip state-fo 192.168.30.1 255.255.255.0 standby 192.168.30.2
failover lan enable
failover


Failover Config (Secondary):
This unit up until now had a blank configuration.

interface Ethernet2
description trunk for failovers
!
interface Ethernet2.200
description LAN Failover Interface
vlan 200
!
failover lan unit secondary
failover lan interface lan-fo Ethernet2.200
failover key letmeinfo
failover interface ip lan-fo 192.168.20.1 255.255.255.0 standby 192.168.20.2
failover lan enable
failover


At this point you should wait until the two configurations are synced up and the primary has taken the "active" role.

Setting up L2L VPN:

access-list NO-NAT extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list IPSEC-TUN extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
nat (Inside) 0 access-list NO-NAT
crypto ipsec transform-set FW1-TRANSFORM esp-3des esp-sha-hmac
crypto map FW1 10 match address IPSEC-TUN
crypto map FW1 10 set peer 10.0.34.3
crypto map FW1 10 set transform-set FW1-TRANSFORM
crypto isakmp identity address
crypto isakmp enable Outside
crypto isakmp policy 100
authentication pre-share
encryption 3des
hash sha
group 2
tunnel-group 10.0.34.3 type ipsec-l2l
tunnel-group 10.0.34.3 ipsec-attributes
pre-shared-key letmeinl2l


Setting up the other end (FW3):
Basic setup:

!
interface Ethernet0
nameif outside
security-level 0
ip address 10.0.34.3 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!


VPN and ACLs:

access-list WAN_IN extended permit icmp any any
access-list NO-NAT extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list IPSEC-TUN extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
global (outside) 1 interface
nat (inside) 0 access-list NO-NAT
nat (inside) 1 0.0.0.0 0.0.0.0
access-group WAN_IN in interface outside
route outside 0.0.0.0 0.0.0.0 10.0.34.4 1
crypto isakmp enable outside
crypto isakmp policy 100
authentication pre-share
encryption 3des
hash sha
group 2
tunnel-group 10.0.0.1 type ipsec-l2l
tunnel-group 10.0.0.1 ipsec-attributes
pre-shared-key letmeinl2l



Now, as it stands we should have an "Hub" and a "Spoke" set up with L2L vpn between the sites as well as their own wan (internet) traffic going out untouched.

Now Remote Access VPN:
Obviously LAN= 192.168.1.0/24 and VPN=10.1.1.0/24

access-list NO-NAT extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list 101 extended permit tcp 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0 eq www
access-list 101 extended permit tcp 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0 eq ftp
access-list 101 extended permit tcp 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0 eq telnet
access-list 101 extended permit icmp any any
aaa-server acs protocol radius
aaa-server acs (Outside) host 192.168.0.45
timeout 5
key letmein
ip local pool VPN-POOL 10.1.1.1-10.1.1.254
crypto ipsec transform-set VPN-TRANSFORM esp-3des esp-sha-hmac
crypto dynamic-map DYNA-MAP 1 set transform-set VPN-TRANSFORM
crypto dynamic-map DYNA-MAP 1 set security-association lifetime seconds 288000
crypto dynamic-map DYNA-MAP 1 set reverse-route
crypto map FW1 20 ipsec-isakmp dynamic DYNA-MAP
group-policy VPN-REMOTE internal
group-policy VPN-REMOTE attributes
dns-server value 208.67.222.222
vpn-idle-timeout none
vpn-tunnel-protocol IPSec
default-domain value cookie.local
tunnel-group VPN-REMOTE type remote-access
tunnel-group VPN-REMOTE general-attributes
address-pool VPN-POOL
authentication-server-group acs
default-group-policy VPN-REMOTE
tunnel-group VPN-REMOTE ipsec-attributes
pre-shared-key cisco123



Now the Split Tunnel and IPsec access to the Spoke:
FW-3:

access-list NO-NAT extended permit ip 192.168.2.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list IPSEC-TUN extended permit ip 192.168.2.0 255.255.255.0 10.1.1.0 255.255.255.0


FW1:

same-security-traffic permit intra-interface
access-list NO-NAT extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list IPSEC-TUN extended permit ip 10.1.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list splittunnel standard permit 192.168.1.0 255.255.255.0
access-list splittunnel standard permit 192.168.2.0 255.255.255.0
group-policy VPN-REMOTE attributes
dns-server value 208.67.222.222
vpn-idle-timeout none
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value splittunnel




And that is it! :P

If you need any info as to how to setup the client look here:
Setup VPN Client
The "group name" is VPN-REMOTE and the password is cisco123


Screenshot of it all working:

Tuesday 29 September 2009

PIX/ASA Remote Access VPN with L2L VPN and Failover

Well I was going to do a nice multiple context PIX/ASA lab, but after playing around with GNS for a while and a good few hours into the lab I came to a brick wall.

The brick wall being that if you use multiple contexts you cannot use VPNs:
(http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/contexts.html#wp1116132)

So I created this lab instead:




If I get time ill upload the config tonight.

Monday 28 September 2009

Load Balancing With HSRP

Got a nice simple lab for you today, load balancing with Hot Standby Routing Protocol.

HSRP is designed to increase the redundancy in LAN gateways. It does this by creating a Virtual MAC address and Virtual IP address.
One router of the "group" is elected as the "active" and the other the "standby", therefore once the "active" router, say for example gets accidentally turned off, the "standby" takes over.

Here is the picture of the lab:





Here is the important configuration:
R2

interface FastEthernet0/0
ip address 10.0.0.2 255.255.255.0
duplex auto
speed auto
!This is the virtual ip group 1
standby 1 ip 10.0.0.253
!I want this router to be the active router
standby 1 priority 12
!Take over active when your priority is higher
standby 1 preempt
!Any name here
standby 1 name Load1
!When this interface goes down, decrease my priority by 10
standby 1 track Serial0/0

!This is the virtual ip group 2
standby 2 ip 10.0.0.254
!I want this router to be the standby router
standby 2 priority 11
!Take over active when your priority is higher
standby 2 preempt
!Any name here
standby 2 name Load2
!When this interface goes down, decrease my priority by 10
standby 2 track Serial0/0


R3

interface FastEthernet0/0
ip address 10.0.0.3 255.255.255.0
duplex auto
speed auto
standby 1 ip 10.0.0.253
standby 1 priority 11
standby 1 preempt
standby 1 name Load1
standby 1 track Serial0/0
standby 2 ip 10.0.0.254
standby 2 priority 12
standby 2 preempt
standby 2 name Load2
standby 2 track Serial0/0



Note that for the load balancing to work 50% of the devices have 10.0.0.253 as their default gateway and the other 50% have 10.0.0.254.

Enjoy :)

Monday 14 September 2009

Wednesday 9 September 2009

MPLS VPN with MP-BGP

Currently working on a new lab, here is the setup:




More to follow...

Monday 7 September 2009

Vyatta - Remote Access VPN Lab

Hi again this is the setup:



This lab details setting up NAT on vyatta routers, OpenVPN with TLS authentication, basic firewall setup and all the steps inbetween.

Here is the video:

Vyatta Remote Access OpenVPN lab with NAT and Firewall setup from Richard Vimeo on Vimeo.



Enjoy!

Tuesday 1 September 2009

Vyatta Vmware Lab

Hi again,

Just to spice things up a little I thought I would do a lab on vyatta, so I dug out part of an old lab, and presto - A Vyatta based OSPF 3 site lab:


and this is how I did it:

Part 1:

Vyatta Vmware Lab Part1 from Richard Vimeo on Vimeo.



Part2

Vyatta Vmware Lab Part2 from Richard Vimeo on Vimeo.



Enjoy!