Tunneling management

GRE tunnel configuration

GRE (Generic Routing Encapsulation) is a network packet tunneling protocol. Its main purpose is to encapsulate packets of the OSI model network layer into IP packets. GRE may be used for VPN establishment on 3rd level of OSI model. In ESR router implemented static unmanageable GRE tunnels, i.e. tunnels are created manually via configuration on local and remote hosts. Tunnel parameters for each side should be mutually agreeable, otherwise transferred data will not be decapsulated by the partner.

Configuration algorithm

IP-GRE tunnel configuration example

Objective:

Establish L3-VPN for company offices using IP network with GRE protocol for traffic tunneling.

• IP address 115.0.0.1 is used as a local gateway for the tunnel;
• IP address 114.0.0.10 is used as a remote gateway for the tunnel;
• IP address of the tunnel at the local side is 25.0.0.1/24.

Solution:

Pre-configure interfaces on the routers for connection with WAN, enable GRE packets reception from a security zone where WAN connected interfaces operate.

Create GRE 10 tunnel:

esr(config)# tunnel gre 10

Specify local and remote gateways (IP addresses of WAN border interfaces):

esr(config-gre)# local address 115.0.0.1
esr(config-gre)# remote address 114.0.0.10

Specify tunnel IP address 25.0.0.1/24:

esr(config-gre)# ip address 25.0.0.1/24

Also, the tunnel should belong to the security zone in order to create rules that allow traffic to pass through the firewall. To define the tunnel inherence to a zone, use the following command:

esr(config-gre)# security-zone untrusted

Enable tunnel:

esr(config-gre)# enable
esr(config-gre)# exit

Create route to the partner's local area network on the router. Specify previously created GRE tunnel as a destination interface.

esr(config)# ip route 172.16.0.0/16 tunnel gre 10 

When settings are applied, traffic will be encapsulated into the tunnel and sent to the partner regardless of their GRE tunnel existence and settings validity.

Alternatively, the following parameters for GRE tunnel can be specified:

• Enable GRE header checksum calculation and inclusion into a packet with encapsulated packet for outbound traffic:

  esr(config-gre)# local checksum

  CODE

• Enable check for GRE checksum presence and validity for inbound traffic:

  esr(config-gre)# remote checksum

  CODE

• Specify a unique identifier:

  esr(config-gre)# key 15808

  CODE

• Specify DSCP, MTU, TTL values:

  esr(config-gre)# dscp 44
  esr(config-gre)# mtu 1426
  esr(config-gre)# ttl 18

  CODE

• Enable and configure keepalive mechanism:

  esr(config-gre)# keepalive enable
  esr(config-gre)# keepalive timeout <TIME>
  esr(config-gre)# keepalive retries <VALUE>

  CODE

To view the tunnel status, use the following command:

esr# show tunnels status gre 10

To view sent and received packet counters, use the following command:

esr# show tunnels counters gre 10

To view the tunnel configuration, use the following command:

esr# show tunnels configuration gre 10

IPv4-over-IPv4 tunnel configuration is performed in the same manner.

During tunnel creation, enable GRE protocol (47) in the firewall.

DMVPN configuration

DMVPN (Dynamic Multipoint Virtual Private Network) — technology for creating virtual private networks, with the ability to dynamically create tunnels between hosts. The advantage of this solution is its high scalability and ease of setup when connecting branches to the head office. DMVPN is used in the Hub-and-Spoke topology, and allows the construction of direct VPN Spoke-to-Spoke tunnels in addition to the usual Spoke-to-Hub tunnels. This means that branches can communicate with each other directly, without the need for traffic to pass through the Hub.

To establish such a connection, clients (NHC) over an encrypted IPsec tunnel send their internal (tunnel) address and external (NBMA) address to the NHRP server (NHS). When a client wants to connect to another NHC, it sends a request to the server to find out its external address. Having received a response from the server, the client can now independently establish a connection to the remote branch.

Configuration algorithm

Configuration example 1

Objective:

Organize DMVPN between company offices using mGRE tunnels, NHRP (Next Hop Resolution Protocol), Dynamic Routing Protocol (BGP), Ipsec. In our example, we will have a HUB router and two branches. The HUB is the DMVPN server (NHS), and the branches are DMVPN clients (NHC).

External IP addres of Hub — 150.115.0.5;

External IP address of Spoke-1 — 180.100.0.10;

External IP address of Spoke-2 — 140.114.0.4.

IPsec VPN parameters:

IKE:

• Diffie-Hellman group: 2;
• encryption algorithm: AES128;
• authentication algorithm: SHA1.

IPSEC:

• encryption algorithm: AES128;
• authentication algorithm: SHA1.

Solution:

1. Hub configuration
   Create GRE tunnel:

   esr# configure
   esr(config)# tunnel gre 5

   CODE

   Specify the IP address of the interface bordering the ISP:

   esr(config-gre)# local address 150.115.0.5

   CODE

   Specify MTU value:

   esr(config-gre)# mtu 1416

   CODE

   Specify ttl value:

   esr(config-gre)# ttl 16

   CODE

   Specify IP address of GRE tunnel:

   esr(config-gre)# ip address 10.10.0.5/24

   CODE

   Switch the GRE tunnel into multipoint mode to be able to connect to multiple points:

   esr(config-gre)# multipoint

   CODE

   Proceed to NHRP configuration. Configure multicast to dynamically learnt addresses:

   esr(config-gre)# ip nhrp multicast dynamic

   CODE

   Configure the dynamic routing protocol for the Hub. In our example, this will be BGP:

   esr(config)# router bgp 65005
   esr(config-bgp)# address-family ipv4
   esr(config-bgp-af)# neighbor 10.10.0.8
   esr(config-bgp-neighbor)# remote-as 65008
   esr(config-bgp-neighbor)# enable
   esr(config-bgp-neighbor)# exit
   esr(config-bgp-af)# neighbor 10.10.0.4
   esr(config-bgp-neighbor)# remote-as 65004
   esr(config-bgp-neighbor)# enable
   esr(config-bgp-neighbor)# exit
   esr(config-bgp-af)# enable

   CODE

   Configure IPsec for the Hub:

   esr(config)# security ike proposal IKEPROP
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# exit

   CODE

   esr(config)# security ike policy IKEPOLICY
   esr(config-ike-policy)# pre-shared-key ascii-text encrypted 8CB5107EA7005AFF
   esr(config-ike-policy)# proposal IKEPROP
   esr(config-ike-policy)# exit

   CODE

   esr(config)# security ike gateway IKEGW
   esr(config-ike-gw)# ike-policy IKEPOLICY
   esr(config-ike-gw)# local address 150.115.0.5
   esr(config-ike-gw)# local network 150.115.0.5/32 protocol gre
   esr(config-ike-gw)# remote address any
   esr(config-ike-gw)# remote network any
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   esr(config)# security ipsec proposal IPSECPROP
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   esr(config)# security ipsec policy IPSECPOLICY
   esr(config-ipsec-policy)# proposal IPSECPROP
   esr(config-ipsec-policy)# exit

   CODE

   esr(config)# security ipsec vpn IPSECVPN
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway IKEGW
   esr(config-ipsec-vpn)# ike ipsec-policy IPSECPOLICY
   esr(config-ipsec-vpn)# enable

   CODE

   Map IPsec to the GRE tunnel so that clients can establish an encrypted connection:

   esr(config-gre)# ip nhrp ipsec IPSECVPN dynamic

   CODE

   Enable NHRP and the tunnel:

   esr(config-gre)# ip nhrp enable
   esr(config-gre)# enable

   CODE
2. Spoke configuration
   

   Perform the standard DMVPN configuration on the tunnel:

   esr# configure
   esr(config-gre)# tunnel gre 8
   esr(config-gre)# mtu 1416
   esr(config-gre)# ttl 16
   esr(config-gre)# multipoint
   esr(config-gre)# local address 180.100.0.10
   esr(config-gre)# ip address 10.10.0.8/24

   CODE

   Specify the time while the client record will be stored on the server:

   esr(config-gre)# ip nhrp holding-time 300

   CODE

   Specify the tunnel address of NHS:

   esr(config-gre)# ip nhrp nhs 10.10.0.5/24

   CODE

   Specify the tunnel address – real:

   esr(config-gre)# ip nhrp map 10.10.0.5 150.115.0.5

   CODE

   Configure the multicast to the NHRP server:

   esr(config)# ip nhrp multicast nhs

   CODE

   Configure the BGP for spoke:

   esr(config)# router bgp 65008
   esr(config-bgp)# address-family ipv4
   esr(config-bgp-af)# neighbor 10.10.0.5
   esr(config-bgp-neighbor)# remote-as 65005
   esr(config-bgp-neighbor)# enable
   esr(config-bgp-neighbor)# exit
   esr(config-bgp-af)# enable

   CODE

   Configure IPsec. When creating the IKE protocol gateway for NHS, specify particular destination addresses. When creating an IKE gateway for NHC – the destination address will be any:

   esr(config)# security ike proposal IKEPROP
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# exit

   CODE

   esr(config)# security ike policy IKEPOLICY
   esr(config-ike-policy)# pre-shared-key ascii-text encrypted 8CB5107EA7005AFF
   esr(config-ike-policy)# proposal IKEPROP
   esr(config-ike-policy)# exit

   CODE

   esr(config)# security ike gateway IKEGW_HUB
   esr(config-ike-gw)# ike-policy IKEPOLICY
   esr(config-ike-gw)# local address 180.100.0.10
   esr(config-ike-gw)# local network 180.100.0.10/32 protocol gre
   esr(config-ike-gw)# remote address 150.115.0.5
   esr(config-ike-gw)# remote network 150.115.0.5/32 protocol gre
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   esr(config)# security ike gateway IKEGW_SPOKE
   esr(config-ike-gw)# ike-policy IKEPOLICY
   esr(config-ike-gw)# local address 180.100.0.10
   esr(config-ike-gw)# local network 180.100.0.10/32 protocol gre
   esr(config-ike-gw)# remote address any
   esr(config-ike-gw)# remote network any
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   esr(config)# security ipsec proposal IPSECPROP
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   esr(config)# security ipsec policy IPSECPOLICY
   esr(config-ipsec-policy)# proposal IPSECPROP
   esr(config-ipsec-policy)# exit

   CODE

   esr(config)# security ipsec vpn IPSECVPN_HUB
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway IKEGW_HUB
   esr(config-ipsec-vpn)# ike ipsec-policy IPSECPOLICY
   esr(config-ipsec-vpn)# enable

   CODE

   esr(config)# security ipsec vpn IPSECVPN_SPOKE
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway IKEGW_SPOKE
   esr(config-ipsec-vpn)# ike ipsec-policy IPSECPOLICY
   esr(config-ipsec-vpn)# enable

   CODE

   Map IPsec to the GRE tunnel, in order to be able to establish an encrypted connection with the server and with other network clients:

   esr(config-gre)# ip nhrp ipsec IPSECVPN_HUB static
   esr(config-gre)# ip nhrp ipsec IPSECVPN_SPOKE dynamic

   CODE

   Enable NHRP and the tunnel:

   esr(config-gre)# ip nhrp enable
   esr(config-gre)# enable

   CODE

   To view the NHRP records status, use the following command:

   esr# show ip nhrp

   CODE

   NHRP records can be cleared with the following command:

   esr# clear ip nhrp

   CODE

Configuration example 2

Objective:

Organize DMVPN between company offices with corresponding subnets LAN1 and LAN2, using mGRE tunnels, NHRP (Next Hop Resolution Protocol), Dynamic Routing Protocol (OSPF), IPsec. In our example, we will have a HUB router and two branches. The HUB is the DMVPN server (NHS), and the branches are DMVPN clients (NHC).

When using the DMVPN scheme, the HUB must be a DR router. Thus, the routes of local subnets spoke 1 and spoke 2 will be relayed through the hub.

External IP address of HUB — 150.115.0.5;
External IP address of Spoke-1 — 180.100.0.10;
External IP address of Spoke-2 — 140.114.0.4.

IPsec VPN parameters:

IKE:

• Diffie-Hellman group: 2;
• encryption algorithm: AES128;
• authentication algorithm: MD5.

IPSEC:

• Diffie-Hellman group: 2;
• encryption algorithm: AES128;
• authentication algorithm: MD5.

Solution:

1. HUB configuration:
   First, configure the OSPF protocol:

   esr(config)# router ospf log-adjacency-changes
   esr(config)# router ospf 1
   esr(config-ospf)# router-id 77.77.77.77
   esr(config-ospf)# area 10.10.0.0
   esr(config-ospf-area)# enable
   esr(config-ospf-area)# exit
   esr(config-ospf)# enable
   esr(config-ospf)# exit

   CODE

   Configure the interface and identify its inherence to a security zone:

   esr(config)# interface gigabitethernet 1/0/1
   esr(config-if-gi)# security-zone untrusted
   esr(config-if-gi)# ip address 150.115.0.5/30
   esr(config-if-gi)# exit

   CODE

   Configure the GRE tunnel, define the security zone membership, configure OSPF on the GRE tunnel, configure NHRP and enable the tunnel and NHRP with the enable command. To make HUB DR, set the maximum priority.

   esr(config)# tunnel gre 1
   esr(config-gre)# ttl 16
   esr(config-gre)# mtu 1416
   esr(config-gre)# multipoint
   esr(config-gre)# security-zone untrusted 
   esr(config-gre)# local address 150.115.0.5
   esr(config-gre)# ip address 10.10.0.1/28
   esr(config-gre)# ip ospf instance 1
   esr(config-gre)# ip ospf area 10.10.0.0
   esr(config-gre)# ip ospf priority 255
   esr(config-gre)# ip ospf
   esr(config-gre)# ip nhrp multicast dynamic
   esr(config-gre)# ip nhrp enable
   esr(config-gre)# enable
   esr(config-gre)# exit

   CODE

   Create static routes for the subnets of the spoke interfaces 180.100.0.8/30 and 140.114.0.4/30.

   esr(config)# ip route 180.100.0.8/30 150.115.0.6
   esr(config)# ip route 140.114.0.4/30 150.115.0.6

   CODE

   Configure IPsec for the HUB.

   esr(config)# security ike proposal ike_prop1
   esr(config-ike-proposal)# authentication algorithm md5
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# exit

   CODE

   esr(config)# security ike policy ike_pol1
   esr(config-ike-policy)# pre-shared-key ascii-text password
   esr(config-ike-policy)# proposal ike_prop1
   esr(config-ike-policy)# exit

   CODE

   esr(config)# security ike gateway ike_spoke
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# local address 150.115.0.5
   esr(config-ike-gw)# local network 150.115.0.5/32 protocol gre 
   esr(config-ike-gw)# remote address any
   esr(config-ike-gw)# remote network any
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   esr(config)# security ipsec proposal ipsec_prop1
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# pfs dh-group 2
   esr(config-ipsec-proposal)# exit

   CODE

   esr(config)# security ipsec policy ipsec_pol1
   esr(config-ipsec-policy)# proposal ipsec_prop1
   esr(config-ipsec-policy)# exit

   CODE

   esr(config)# security ipsec vpn ipsec_spoke
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_spoke
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit

   CODE

   Map IPsec to the GRE tunnel so that clients can establish an encrypted connection:

   esr(config)# tunnel gre 1
   esr(config-gre)# ip nhrp ipsec ipsec_spoke dynamic
   esr(config-gre)# exit

   CODE

2. SPOKE configuration:
   Preliminary configure the OSPF protocol with the advertising of the subnet LAN1:

   esr(config)# router ospf log-adjacency-changes
   esr(config)# router ospf 1
   esr(config-ospf)# router-id 1.1.1.1
   esr(config-ospf)# area 10.10.0.0
   esr(config-ospf-area)# network 192.168.1.0/24
   esr(config-ospf-area)# enable
   esr(config-ospf-area)# exit
   esr(config-ospf)# enable
   esr(config-ospf)# exit

   CODE

   Configure the interface and identify its inherence to a security zone:

   esr(config)# interface gigabitethernet 1/0/1
   esr(config-if-gi)# security-zone untrusted
   esr(config-if-gi)# ip address 180.100.0.10/30
   esr(config-if-gi)# exit

   CODE

   Configure the GRE tunnel, define the security zone membership, configure OSPF on the GRE tunnel, configure NHRP and enable the tunnel and NHRP with the enable command. To make HUB DR, set the minimum priority on spoke:

   esr(config)# tunnel gre 1
   esr(config-gre)# ttl 16
   esr(config-gre)# mtu 1416
   esr(config-gre)# multipoint
   esr(config-gre)# ip firewall disable
   esr(config-gre)# local address 180.100.0.10
   esr(config-gre)# ip address 10.10.0.2/28
   esr(config-gre)# ip ospf instance 1
   esr(config-gre)# ip ospf area 10.10.0.0
   esr(config-gre)# ip ospf priority 0
   esr(config-gre)# ip ospf
   esr(config-gre)# ip nhrp holding-time 300
   esr(config-gre)# ip nhrp map 10.10.0.1 150.115.0.5
   esr(config-gre)# ip nhrp nhs 10.10.0.1/28
   esr(config-gre)# ip nhrp multicast nhs
   esr(config-gre)# ip nhrp enable
   esr(config-gre)# enable
   esr(config-gre)# exit

   CODE

   Create static routes for the subnets of the spoke interfaces 180.100.0.8/30 and 140.114.0.4/30:

   esr(config)# ip route 150.115.0.4/30 180.100.0.9
   esr(config)# ip route 140.114.0.4/30 180.100.0.9

   CODE

   Configure IPsec for the HUB:

   esr(config)# security ike proposal ike_prop1
   esr(config-ike-proposal)# authentication algorithm md5
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# exit

   CODE

   esr(config)# security ike policy ike_pol1
   esr(config-ike-policy)# pre-shared-key ascii-text password
   esr(config-ike-policy)# proposal ike_prop1
   esr(config-ike-policy)# exit

   CODE

   esr(config)# security ike gateway ike_spoke
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# local address 180.100.0.10
   esr(config-ike-gw)# local network 180.100.0.10/32 protocol gre 
   esr(config-ike-gw)# remote address any
   esr(config-ike-gw)# remote network any
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit
   esr(config)# security ike gateway ike_hub
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# local address 180.100.0.10
   esr(config-ike-gw)# local network 180.100.0.10/32 protocol gre 
   esr(config-ike-gw)# remote address 150.115.0.5
   esr(config-ike-gw)# remote network 150.115.0.5/32 protocol gre 
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   esr(config)# security ipsec proposal ipsec_prop1
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# pfs dh-group 2
   esr(config-ipsec-proposal)# exit

   CODE

   esr(config)# security ipsec policy ipsec_pol1
   esr(config-ipsec-policy)# proposal ipsec_prop1
   esr(config-ipsec-policy)# exit

   CODE

   esr(config)# security ipsec vpn ipsec_spoke
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_spoke
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit
   esr(config)# security ipsec vpn ipsec_hub
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_hub
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit

   CODE

   Map IPsec to the GRE tunnel, in order to be able to establish an encrypted connection with the server and with other network clients:

   esr(config)# tunnel gre 1
   esr(config-gre)# ip nhrp ipsec ipsec_hub static
   esr(config-gre)# ip nhrp ipsec ipsec_spoke dynamic
   esr(config-gre)# exit

   CODE

3. To view the NHRP records status, use the following command.

   esr# show ip nhrp

   CODE

4. Additionally, in the security zone-pair untrusted self, the protocols for the GRE over IPSec tunnel must be allowed.

   esr(config)# object-group service ISAKMP_PORT
   esr(config-object-group-service)# port-range 500
   esr(config-object-group-service)# poRt-range 4500
   esr(config-object-group-service)# exit
   esr(config)# security zone-pair untrusted self
   esr(config-zone-pair)# rule 1
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol udp
   esr(config-zone-pair-rule)# match destination-port ISAKMP_PORT
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)# rule 2
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol gre
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)# rule 3
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol esp
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)# rule 4
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol ah
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)# exit
   

   CODE

L2TPv3 tunnel configuration

L2TPv3 (Layer 2 Tunnelling Protocol Version 3) is a protocol used for tunneling of 2nd level OSI model packets between two IP nodes. IP or UDP is used as an encapsulation protocol. L2TPv3 may be used as an alternative to MPLS P2P L2VPN (VLL) for L2 VPN establishment. In ESR router implemented static unmanageable L2TPv3 tunnels, i.e. tunnels are created manually via configuration on local and remote hosts. Tunnel parameters for each side should be mutually agreeable, otherwise transferred data will not be decapsulated by the partner.

Configuration algorithm

L2TPv3 tunnel configuration example

Objective:

Establish L2 VPN for company offices using IP network with L2TPv3 protocol for traffic tunneling.

• UDP is used as an encapsulation protocol, port number at the local side and port number at the partner's side is 519;
• IP address 21.0.0.1 is used as a local gateway for the tunnel;
• IP address 183.0.0.10 is used as a remote gateway for the tunnel;
• Tunnel identifier at the local side equals 2, at the partner's side - 3;
• Tunnel identifier inside the tunnel equals 100, at the partner's side - 200;
• Forward traffic into the tunnel from the bridge with identifier 333.

Solution:

Create L2TPv3 333 tunnel:

esr# configure
esr(config)# tunnel l2tpv3 333

Specify local and remote gateways (IP addresses of WAN border interfaces):

esr(config-l2tpv3)# local address 21.0.0.1
esr(config-l2tpv3)# remote address 183.0.0.10

Specify the type of encapsulating protocol and UDP port numbers:

esr(config-l2tpv3)# protocol udp
esr(config-l2tpv3)# local port 519
esr(config-l2tpv3)# remote port 519

Specify identifiers for session inside the tunnel for local and remote sides:

esr(config-l2tpv3)# local session-id 100
esr(config-l2tpv3)# remote session-id 200

Define the inherence of L2TPv3 tunnel to a bridge that should be mapped to remote office network (for bridge configuration, see Section Configuration example of bridge for VLAN and L2TPv3 tunnel):

esr(config-l2tpv3)# bridge-group 333

Enable previously created tunnel and exit:

esr(config-l2tpv3)# enable
esr(config-l2tpv3)# exit

Create sub-interface for switching of traffic coming from the tunnel into LAN with VLAN id 333:

esr(config)# interface gi 1/0/2.333

Define the inherence of sub-interface to a bridge that should be mapped to LAN (for bridge configuration, see Section Configuration of PPP via E1):

esr(config-subif)# bridge-group 333
esr(config-subif)# exit

When settings are applied, traffic will be encapsulated into the tunnel and sent to the partner regardless of their L2TPv3 tunnel existence and settings validity.

Tunnel settings for the remote office should mirror local ones. IP address 183.0.0.10 should be used as a local gateway. IP address 21.0.0.1 should be used as a remote gateway for the tunnel. Encapsulation protocol port number at the local side should be 520, at the partner's side – 519. Session identifier inside the tunnel should be equal to 200, at the partner's side – 100. Also, the tunnel should belong to a bridge that should be connected with the partner's network.

To view the tunnel status, use the following command:

esr# show tunnels status l2tpv3 333

To view sent and received packet counters, use the following command:

esr# show tunnels counters l2tpv3 333

To view the tunnel configuration, use the following command:

esr# show tunnels configuration l2tpv3 333

In addition to tunnel creation, enable UDP inbound traffic in the firewall with source port 519 and destination port 519.

IPsec VPN configuration

IPsec is a set of protocols that enable security features for data transferred via IP protocol. This set of protocols allows for identity validation (authentication), IP packet integrity check and encryption, and also includes protocols for secure key exchange over the Internet.

Route-based IPsec VPN configuration algorithm

Route-based IPsec VPN configuration example

Objective:

Configure IPsec tunnel between R1 and R2.

• R1 IP address: 120.11.5.1;
• R2 IP address: 180.100.0.1.

IKE:

• Diffie-Hellman group: 2;
• encryption algorithm: AES 128 bit;
• authentication algorithm: MD5.

IP sec:

• encryption algorithm: AES 128 bit;
• authentication algorithm: MD5.

Solution:

1. R1 configuration:
   Configure external network interface and identify its inherence to a security zone:

   esr# configure
   esr(config)# interface gi 1/0/1
   esr(config-if-gi)# ip address 180.100.0.1/24
   esr(config-if-gi)# security-zone untrusted
   esr(config-if-gi)# exit

   CODE

   Create VTI tunnel. Traffic will be routed via VTI into IPsec tunnel. Specify IP addresses of WAN border interfaces as local and remote gateways:

   esr(config)# tunnel vti 1
   esr(config-vti)# local address 180.100.0.1
   esr(config-vti)# remote address 120.11.5.1
   esr(config-vti)# enable
   esr(config-vti)# exit

   CODE

   To configure security zones rules, create ISAKMP port profile:

   esr(config)# object-group service ISAKMP
   esr(config-object-group-service)# port-range 500
   esr(config-object-group-service)# exit

   CODE

   Create a static route to the remote LAN. For each subnet located beyond the IPsec tunnel, specify a route via VTI tunnel:

   esr(config)# ip route 192.0.2.0/24 tunnel vti 1

   CODE

   Create IKE protocol profile. Select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm in the profile. The given security parameters are used for IKE connection protection:

   esr(config)# security ike proposal ike_prop1
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# authentication algorithm md5
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# exit

   CODE

   Create IKE protocol policy. For the policy, specify the list of IKE protocol profiles that may be used for node and authentication key negotiation:

   esr(config)# security ike policy ike_pol1
   esr(config-ike-policy)# pre-shared-key hexadecimal 123FFF
   esr(config-ike-policy)# proposal ike_prop1
   esr(config-ike-policy)# exit

   CODE

   Create IKE protocol gateway. For this profile, specify VTI tunnel, policy, protocol version and mode of traffic redirection into the tunnel.

   esr(config)# security ike gateway ike_gw1
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# mode route-based
   esr(config-ike-gw)# bind-interface vti 1
   esr(config-ike-gw)# version v2-only
   esr(config-ike-gw)# exit

   CODE

   Create security parameters profile for IPsec tunnel. For the profile, select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm. Use the following parameters to secure IPsec tunnel:

   esr(config)# security ipsec proposal ipsec_prop1
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used for node negotiation:

   esr(config)# security ipsec policy ipsec_pol1
   esr(config-ipsec-policy)# proposal ipsec_prop1
   esr(config-ipsec-policy)# exit

   CODE

   Create IPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and connection establishment method. When all parameters are entered, enable tunnel using the enable command.

   esr(config)# security ipsec vpn ipsec1
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_gw1
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit
   esr(config)# exit

   CODE
2. R2 configuration
   

   Configure external network interface and identify its inherence to a security zone:

   esr# configure
   esr(config)# interface gi 1/0/1
   esr(config-if)# ip address 120.11.5.1/24
   esr(config-if)# security-zone untrusted
   esr(config-if)# exit

   CODE

   Create VTI tunnel. Traffic will be routed via VTI into IPsec tunnel. Specify IP addresses of WAN border interfaces as local and remote gateways:

   esr(config)# tunnel vti 1
   esr(config-vti)# remote address 180.100.0.1
   esr(config-vti)# local address 120.11.5.1
   esr(config-vti)# enable
   esr(config-vti)# exit

   CODE

   To configure security zones rules, create ISAKMP port profile:

   esr(config)# object-group service ISAKMP
   esr(config-object-group-service)# port-range 500
   esr(config-object-group-service)# exit

   CODE

   Create a static route to the remote LAN. For each subnet located beyond the IPsec tunnel, specify a route via VTI tunnel:

   esr(config)# ip route 10.0.0.0/16 tunnel vti 1

   CODE

   Create IKE protocol profile. Select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm in the profile. The given security parameters are used for IKE connection protection:

   esr(config)# security ike proposal ike_prop1
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# authentication algorithm md5
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# exit
   esr(config)#

   CODE

   Create IKE protocol policy. For the policy, specify the list of IKE protocol profiles that may be used for node and authentication key negotiation:

   esr(config)# security ike policy ike_pol1
   esr(config-ike-policy)# pre-shared-key hexadecimal 123FFF
   esr(config-ike-policy)# proposal ike_prop1
   esr(config-ike-policy)# exit

   CODE

   Create IKE protocol gateway. For this profile, specify VTI tunnel, policy, protocol version and mode of traffic redirection into the tunnel.

   esr(config)# security ike gateway ike_gw1
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# mode route-based
   esr(config-ike-gw)# bind-interface vti 1
   esr(config-ike-gw)# version v2-only
   esr(config-ike-gw)# exit

   CODE

   Create security parameters profile for IPsec tunnel. For the profile, select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm. Use the following parameters to secure IPsec tunnel:

   esr(config)# security ipsec proposal ipsec_prop1
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used for node negotiation:

   esr(config)# security ipsec policy ipsec_pol1
   esr(config-ipsec-policy)# proposal ipsec_prop1
   esr(config-ipsec-policy)# exit

   CODE

   Create IPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and connection establishment method. When all parameters are entered, enable tunnel using the enable command.

   esr(config)# security ipsec vpn ipsec1
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_gw1
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit
   esr(config)# exit

   CODE

   To view the tunnel status, use the following command:

   esr# show security ipsec vpn status ipsec1

   CODE

   To view the tunnel configuration, use the following command:

   esr# show security ipsec vpn configuration ipsec1

   CODE

Enable ESP and ISAKMP protocol (UDP port 500) in the firewall.

Policy-based IPsec VPN configuration algorithm

Policy-based IPsec VPN configuration example

Objective:

Configure IPsec tunnel between R1 and R2.

R1 IP address – 198.51.100.1;

R2 IP address – 203.0.113.1.

IKE:

• Diffie-Hellman group: 2;
• encryption algorithm: AES 128 bit;
• authentication algorithm: MD5.

IPSEC:

• encryption algorithm: AES 128 bit;
• authentication algorithm: MD5.

Solution:

1. R1 configuration
   

   Configure external network interface and identify its inherence to a security zone:

   esr# configure
   esr(config)# interface gigabitethernet 1/0/1
   esr(config-if-gi)# ip address 198.51.100.1/24
   esr(config-if-gi)# security-zone untrusted
   esr(config-if-gi)# exit

   CODE

   To configure security zones rules, create ISAKMP port profile:

   esr(config)# object-group service ISAKMP
   esr(config-object-group-service)# port-range 500
   esr(config-object-group-service)# exit

   CODE

   Create IKE protocol profile. Select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm in the profile. The given security parameters are used for IKE connection protection:

   esr(config)# security ike proposal ike_prop1
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# authentication algorithm md5
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# exit

   CODE

   Create IKE protocol policy. For the policy, specify the list of IKE protocol profiles that may be used for node and authentication key negotiation:

   esr(config)# security ike policy ike_pol1
   esr(config-ike-policy)# pre-shared-key hexadecimal 123FFF
   esr(config-ike-policy)# proposal ike_prop1
   esr(config-ike-policy)# exit

   CODE

   Create IKE protocol gateway. For this profile, specify VTI tunnel, policy, protocol version and mode of traffic redirection into the tunnel.

   esr(config)# security ike gateway ike_gw1
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# local address 198.51.100.1
   esr(config-ike-gw)# local network 10.0.0.0/16
   esr(config-ike-gw)# remote address 203.0.113.1
   esr(config-ike-gw)# remote network 192.0.2.0/24
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   Create security parameters profile for IPsec tunnel. For the profile, select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm. Use the following parameters to secure IPsec tunnel:

   esr(config)# security ipsec proposal ipsec_prop1
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used for node negotiation:

   esr(config)# security ipsec policy ipsec_pol1
   esr(config-ipsec-policy)# proposal ipsec_prop1
   esr(config-ipsec-policy)# exit

   CODE

   Create IPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and connection establishment method. When all parameters are entered, enable tunnel using the enable command.

   esr(config)# security ipsec vpn ipsec1
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_gw1
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit
   esr(config)# exit

   CODE
2. R2 configuration

3. Configure external network interface and identify its inherence to a security zone:

   esr# configure
   esr(config)# interface gi 1/0/1
   esr(config-if)# ip address 203.0.113.1/24
   esr(config-if)# security-zone untrusted
   esr(config-if)# exit

   CODE

   To configure security zones rules, create ISAKMP port profile:

   esr(config)# object-group service ISAKMP
   esr(config-addr-set)# port-range 500
   esr(config-addr-set)# exit

   CODE

   Create IKE protocol profile. Select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm in the profile. The given security parameters are used for IKE connection protection:

   esr(config)# security ike proposal ike_prop1
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# authentication algorithm md5
   esr(config-ike-proposal)# encryption algorithm aes128
   esr(config-ike-proposal)# exit
   esr(config)#

   CODE

   Create IKE protocol policy. For the policy, specify the list of IKE protocol profiles that may be used for node and authentication key negotiation:

   esr(config)# security ike policy ike_pol1
   esr(config-ike-policy)# pre-shared-key hexadecimal 123FFF
   esr(config-ike-policy)# proposal ike_prop1
   esr(config-ike-policy)# exit

   CODE

   Create IKE protocol gateway. For this profile, specify VTI tunnel, policy, protocol version and mode of traffic redirection into the tunnel:

   esr(config)# security ike gateway ike_gw1
   esr(config-ike-gw)# ike-policy ike_pol1
   esr(config-ike-gw)# remote address 198.51.100.1
   esr(config-ike-gw)# remote network 10.0.0.0/16
   esr(config-ike-gw)# local address 203.0.113.1
   esr(config-ike-gw)# local network 192.0.2.0/24
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# exit

   CODE

   Create security parameters profile for IPsec tunnel. For the profile, select Diffie-Hellman group 2, AES 128 bit encryption algorithm and MD5 authentication algorithm. Use the following parameters to secure IPsec tunnel:

   esr(config)# security ipsec proposal ipsec_prop1
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used for node negotiation:

   esr(config)# security ipsec policy ipsec_pol1
   esr(config-ipsec-policy)# proposal ipsec_prop1
   esr(config-ipsec-policy)# exit

   CODE

   Create IPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and connection establishment method. When all parameters are entered, enable tunnel using the enable command:

   esr(config)# security ipsec vpn ipsec1
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway ike_gw1
   esr(config-ipsec-vpn)# ike ipsec-policy ipsec_pol1
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit
   esr(config)# exit

   CODE

   To view the tunnel status, use the following command:

   esr# show security ipsec vpn status ipsec1

   CODE

   To view the tunnel configuration, use the following command:

   esr# show security ipsec vpn configuration ipsec1

   CODE

Enable ESP and ISAKMP protocol (UDP port 500) in the firewall.

Remote Access IPsec VPN configuration algorithm

Remote Access IPsec VPN – scenario for organizing temporary VPN connections in which the IPsec VPN server is waiting for incoming connections, and clients make temporary connections to the server to gain access to network resources.

An additional feature of RA IPsec VPN is the ability to use the second IPsec authentication factor – Extended Authentication (XAUTH), where the second authentication factor is the login-password pair for the IPsec VPN client.

Remote Access IPsec VPN configuration example

Objective:

Configure Remote Access IPsec VPN between R1 and R2 using the second IPsec authentication factor, XAUTH. Configure router R1 as the IPsec VPN server, and router R2 as the IPsec VPN client.

R2 IP address: 120.11.5.1;

R1 IP address: 180.100.0.1;

For IPsec VPN clients:

• issue addresses from the subnet pool 192.0.2.0/24
• provide access to the LAN subnet 10.0.0.0/16

IKE:

• Diffie-Hellman group: 2;
• encryption algorithm: 3DES;
• authentication algorithm: SHA1.

IPSEC:

• encryption algorithm: 3DES;
• authentication algorithm: SHA1.

XAUTH:

• login: client1;
• password: password123.

Solution:

1. R1 configuration
   Configure external network interface and identify its inherence to a security zone:

   esr# configure
   esr(config)# security zone untrusted
   esr(config-zone)# exit
   esr(config)# interface gigabitethernet 1/0/1
   esr(config-if-gi)# security-zone untrusted
   esr(config-if-gi)# ip address 180.100.0.1/24
   esr(config-if-gi)# exit

   CODE

   To configure security zones rules, create ISAKMP port profile:

   esr(config)# object-group service ISAKMP
   esr(config-object-group-service)# port-range 500,4500
   esr(config-object-group-service)# exit

   CODE

   Create IKE protocol profile. Select Diffie-Hellman group 2, 3DES encryption algorithm and SHA1 authentication algorithm in the profile. The given security parameters are used for IKE connection protection:

   esr(config)# security ike proposal IKEPROP
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# authentication algorithm sha1
   esr(config-ike-proposal)# encryption algorithm 3des
   esr(config-ike-proposal)# exit

   CODE

   Create IKE protocol policy. For the policy, specify the list of IKE protocol profiles that may be used for node, authentication key and XAUTH authentication method by key negotiation:

   esr(config)# security ike policy IKEPOLICY
   esr(config-ike-policy)# pre-shared-key hexadecimal 123FFF
   esr(config-ike-policy)# authentication method xauth-psk-key
   esr(config-ike-policy)# proposal IKEPROP
   esr(config-ike-policy)# exit

   CODE

   Create an access profile and get in it a pair of username and password for the IPsec VPN client:

   esr(config)# access profile XAUTH
   esr(config-access-profile)# user client1
   esr(config-profile)# password ascii-text password123
   esr(config-profile)# exit
   esr(config-access-profile)# exit

   CODE

   Create a pool of destination addresses from which IP clients will be issued IPsec VPN:

   esr-1000(config)# address-assignment pool CLIENT_POOL
   esr-1000(config-pool)# ip prefix 192.0.2.0/24
   esr-1000(config-pool)# exit

   CODE

   Create IKE protocol gateway. In this profile, specify the IKE protocol policy, the local subnet, the destination address pool as the remote subnet, set the mode of traffic redirection to the tunnel according to the policy and use the second authentication factor XAUTH:

   esr(config)# security ike gateway IKEGW
   esr(config-ike-gw)# ike-policy IKEPOLICY
   esr(config-ike-gw)# local address 180.100.0.1
   esr(config-ike-gw)# local network 10.0.0.0/16
   esr(config-ike-gw)# remote address any
   esr(config-ike-gw)# remote network dynamic pool CLIENT_POOL
   esr(config-ike-gw)# dead-peer-detection action clear
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# xauth access-profile XAUTH
   esr(config-ike-gw)# exit

   CODE

   Create security parameters profile for IPsec tunnel. Specify 3DES encryption algorithm and SHA1 authentication algorithm in the profile. Use the following parameters to secure IPsec tunnel:

   esr(config)# security ipsec proposal IPSECPROP
   esr(config-ipsec-proposal)# authentication algorithm sha1
   esr(config-ipsec-proposal)# encryption algorithm 3des
   esr(config-ipsec-proposal)# exit

   CODE

   Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used for node negotiation:

   esr(config)# security ipsec policy IPSECPOLICY
   esr(config-ipsec-policy)# proposal IPSECPROP
   esr(config-ipsec-policy)# exit

   CODE

   Create IPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and waiting mode for the incoming IPsec connection – by-request. When all parameters are entered, enable tunnel using the enable command.

   esr(config)# security ipsec IPSECVPN
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel by-request
   esr(config-ipsec-vpn)# ike gateway IKEGW
   esr(config-ipsec-vpn)# ike ipsec-policy IPSECPOLICY
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit

   CODE

   Allow esp protocol and udp ports 500, 4500 in the firewall configuration for establishing IPsec VPN:

   esr(config)# security zone-pair untrusted self
   esr(config-zone-pair)# rule 1
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol udp
   esr(config-zone-pair-rule)# match destination-port ISAKMP
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)#   rule 2
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol esp
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)# end

   CODE

2. R2 configuration
   Configure external network interface and identify its inherence to a security zone:

   esr# configure
   esr(config)# interface gi 1/0/1
   esr(config-if)# ip address 120.11.5.1/24
   esr(config-if)# security-zone untrusted
   esr(config-if)# exit

   CODE

   To configure security zones rules, create ISAKMP port profile:

   esr(config)# object-group service ISAKMP
   esr(config-addr-set)# port-range 500,4500
   esr(config-addr-set)# exit

   CODE

   Create IKE protocol profile. Select Diffie-Hellman group 2, 3DES encryption algorithm and SHA1 authentication algorithm in the profile. The given security parameters are used for IKE connection protection:

   esr(config)# security ike proposal IKEPROP
   esr(config-ike-proposal)# dh-group 2
   esr(config-ike-proposal)# authentication algorithm sha1
   esr(config-ike-proposal)# encryption algorithm 3des
   esr(config-ike-proposal)# exit

   CODE

   Create IKE protocol policy. For the policy, specify the list of IKE protocol profiles that may be used for node, authentication key, XAUTH authentication method by key and client authentication mode negotiation:

   esr(config)# security ike policy IKEPOLICY
   esr(config-ike-policy)# pre-shared-key hexadecimal 123FFF
   esr(config-ike-policy)# authentication method xauth-psk-key
   esr(config-ike-policy)# authentication mode client
   esr(config-ike-policy)# proposal IKEPROP
   esr(config-ike-policy)# exit

   CODE

   Create an access profile and get in it a pair of username and password:

   esr(config)# access profile XAUTH
   esr(config-access-profile)# user client1
   esr(config-profile)# password ascii-text password123
   esr(config-profile)# exit
   esr(config-access-profile)# exit

   CODE

   Create a loopback interface for terminating the IP address received from the IPsec VPN server:

   esr(config)# interface loopback 8
   esr(config-loopback)# exit

   CODE

   Create IKE protocol gateway. Specify the policy, the termination interface, the dynamic setting mode of the remote subnet, the access profile selection for XAUTH, and the mode of redirecting traffic to the tunnel by policy in this profile:

   esr(config)# security ike gateway IKEGW
   esr(config-ike-gw)# ike-policy IKEPOLICY
   esr(config-ike-gw)# assign-interface loopback 8
   esr(config-ike-gw)# local address 120.11.5.1
   esr(config-ike-gw)# remote address 180.100.0.1
   esr(config-ike-gw)# remote network dynamic client
   esr(config-ike-gw)# mode policy-based
   esr(config-ike-gw)# xauth access-profile xauth client client1
   esr(config-ike-gw)# exit

   CODE

   Create security parameters profile for IPsec tunnel. Specify 3DES encryption algorithm and SHA1 authentication algorithm in the profile. Use the following parameters to secure IPsec tunnel:

   esr(config)# security ipsec proposal IPSECPROP
   esr(config-ipsec-proposal)# authentication algorithm md5
   esr(config-ipsec-proposal)# encryption algorithm aes128
   esr(config-ipsec-proposal)# exit

   CODE

   Create a policy for IPsec tunnel. For the policy, specify the list of IPsec tunnel profiles that may be used for node negotiation:

   esr(config)# security ipsec policy IPSECPOLICY
   esr(config-ipsec-policy)# proposal IPSECPROP
   esr(config-ipsec-policy)# exit

   CODE

   Create IPsec VPN. For VPN, specify IKE protocol gateway, IPsec tunnel policy, key exchange mode and connection establishment method. When all parameters are entered, enable tunnel using enable command.

   esr(config)# security ipsec vpn IPSECVPN
   esr(config-ipsec-vpn)# mode ike
   esr(config-ipsec-vpn)# ike establish-tunnel route
   esr(config-ipsec-vpn)# ike gateway IKEGW
   esr(config-ipsec-vpn)# ike ipsec-policy IPSECPOLICY
   esr(config-ipsec-vpn)# enable
   esr(config-ipsec-vpn)# exit

   CODE

   Allow esp protocol and udp ports 500,4500 in the firewall configuration for establishing IPsec VPN:

   esr(config)# security zone-pair untrusted self
   esr(config-zone-pair)# rule 1
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol udp
   esr(config-zone-pair-rule)# match destination-port ISAKMP
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)#   rule 2
   esr(config-zone-pair-rule)# action permit
   esr(config-zone-pair-rule)# match protocol esp
   esr(config-zone-pair-rule)# enable
   esr(config-zone-pair-rule)# exit
   esr(config-zone-pair)# end

   CODE

   To view the tunnel status, use the following command:

   esr# show security ipsec vpn status IPSECVPN

   CODE

   To view the tunnel configuration, use the following command:

   esr# show security ipsec vpn configuration IPSECVPN

   CODE

Enable ESP and ISAKMP protocol (UDP port 500, 4500) in the firewall.

DPD configuration example (Dead Peer Detection) 

Objective:

Configure Dead Peed Detection on R1 for Policy-based Ipsec VPN between R1 and R2.

The initial configuration can be taken from the Policy-based IPsec VPN configuration example.

Solution:

On R1 in IKE protocol gateway specify the following: DPD operation mode – restart, polling interval – 1 second, timeout – 4 seconds:

esr# configure 
esr(config)# security ike gateway ike_gw1
esr(config-ike-gw)# dead-peer-detection action restart
esr(config-ike-gw)# dead-peer-detection interval 1
esr(config-ike-gw)# dead-peer-detection timeout 4
esr(config-ike-gw)# exit

State of the tunnel can be seen with the command:

esr# show security ipsec vpn status ipsec1

Configuration of the tunnel can be seen with the command:

esr# show security ipsec vpn configuration ipsec1

After the connection between R1 and R2 on R1 is broken, the IPsec tunnel will start rebuilding 4 seconds after the break.

esr# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec1                            198.51.100.1      203.0.113.1       0x7a77a25a55853255   0xb62fd04f2db43d08   Established   
2037-10-30T07:52:53+00:00 %CLI-I-CMD: user admin from console  input: show security ipsec vpn status
esr# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec1                            198.51.100.1      203.0.113.1       0x77706e37b4e68cce   0x0000000000000000   Connecting    
2037-10-30T07:52:57+00:00 %CLI-I-CMD: user admin from console  input: show security ipsec vpn status

LT tunnels configuration

LT (Logical Tunnel) is a type of tunnels dedicated for transmission of routing information and traffic between different virtual routers (VRF) configured on a router. LT tunnel might be used for organization of interaction between two or more VRF using firewall restrictions.

Configuration algorithm

Configuration example

Objective:

Organize interaction between hosts terminated in two VRF vrf_1 and vrf_2.

Initial configuration:

hostname esr
ip vrf vrf_1
exit
ip vrf vrf_2
exit
interface gigabitethernet 1/0/1
  ip vrf forwarding vrf_1
  ip firewall disable
  ip address 10.0.0.1/24
exit
interface gigabitethernet 1/0/2
  ip vrf forwarding vrf_2
  ip firewall disable
  ip address 10.0.1.1/24
exit

Solution:

Create LT tunnels for each VRF, specifying IP address from one subnet:

esr(config)# tunnel lt 1
esr(config-lt)# ip vrf forwarding vrf_1
esr(config-lt)# ip firewall disable
esr(config-lt)# ip address 192.168.0.1/30
esr(config-lt)# exit
esr(config)# tunnel lt 2
esr(config-lt)# ip vrf forwarding vrf_2
esr(config-lt)# ip firewall disable
esr(config-lt)# ip address 192.168.0.2/30
esr(config-lt)# exit

Designate LT tunnel from VRF, which is necessary to establish link with, for each LT tunnel and activate them.

esr(config)# tunnel lt 1
esr(config-lt)# peer lt 2
esr(config-lt)# enable
esr(config-lt)# exit
esr(config)# tunnel lt 2
esr(config-lt)# peer lt 1
esr(config-lt)# enable
esr(config-lt)# exit

If none of dynamic routing protocols is configured in VRF, specify static routes for each VRF:

esr(config)# ip route vrf vrf_1 0.0.0.0/0 192.168.0.2
esr(config)# ip route vrf vrf_2 0.0.0.0/0 192.168.0.1

CODE