Wednesday, August 12, 2009

VPN Site-to-Site CLI Configuration

We are going to configure site-to-site VPN (site-to-site) between head office (Lahore) and our regional office (Peshawar), so here i am going to briefly discuss VPN i.e



1. How VPN are established
2. Configuring IKE Phase-1 parameters
3. Configuring IKE Phase-2 parameters
4. Configuring Interesting Traffic
5. CLI configuration

Cisco Router Perspective of VPN Connection

1. The routers recieve traffic considered "WORTHY" of establishing a VPN connection.
2. IKE Phase-1 negotiated, security association (SA) established.
3. IKE Phase-2 negotiated, security association established.
4. Data tranmitted through IPSec tunnel.
5. Once transmission complete, IPSec tunnel turn down (If you configure Time).

**: After 24-hours it can re-negotiated session key
**: After certain amount of data can re-negotiate the key.

Configuration:

1. Set up ISKAMP Policy (IKE Phase-1)
2. Set up IPSec Transform set (IKE Phase-2)
3. Define Interesting Traffic
4. Set up Crypto Map
5. Assign Crypto Map to Interface
PSH-Router(config) # crypto isakmp policy 50
PSH-Router(config-isakmp) # authentication pre-share
PSH-Router(config-isakmp) # encryption aes 128
PSH-Router(config-isakmp) # group 2
PSH-Router(config-isakmp) # hash sha
PSH-Router(config-isakmp) # lifetime 5000
PSH-Router(config-isakmp) #exit

PSH-Router(config) # crypto isakmp key 0 cisco address 71.209.254.34

PSH-Router(config) # crypto ipsec transform-set DEMO esp-aes 128 esp-sha-hmac
PSH-Router(cfg-crypto-trans) #

PSH-Router(config) # ip access-list extended INT_TRAFFIC
PSH-Router(config-ext-nacl) # permit ip 172.30.0.0 0.0.255.255 192.168.1.0 0.0.0.255
PSH-Router(config-ext-nacl) # exit

Note: This is not Permit or Deny ACL, this means encrypt this traffic.
PSH-Router(config) # crypto map VPN_MAP 10 ipsec-isakmp
PSH-Router(config-crypto-map) # set peer 71.209.254.34
PSH-Router(config-crypto-map) # match address INT_TRAFFIC
PSH-Router(config-crypto-map) # set transform-set DEMO

PSH-Router(config) # interface fastethernet 0/1
PSH-Router(config-if) # crypto map VPN_MAP



Head office configuration:

And same configuration is required on the other side with just a bit of changes, lets c

Head-Office(config) # crypto isakmp policy 50
Head-Office(config-isakmp) # authentication pre-share
Head-Office(config-isakmp) # encryption aes 128
Head-Office(config-isakmp) # group 2
Head-Office(config-isakmp) # hash sha
Head-Office(config-isakmp) # lifetime 5000
Head-Office(config-isakmp) #exit

Head-Office(config) # crypto isakmp key 0 cisco address 130.13.140.129

Head-Office(config) # crypto ipsec transform-set DEMO esp-aes 128 esp-sha-hmac
Head-Office(cfg-crypto-trans) #

Head-Office(config) # ip access-list extended INT_TRAFFIC
Head-Office(config-ext-nacl) # permit ip 192.168.1.0 0.0.0.255 172.30.0.0 0.0.255.255
Head-Office(config-ext-nacl) # exit

Head-Office(config) # crypto map VPN_MAP 10 ipsec-isakmp
Head-Office(config-crypto-map) # set peer 130.13.140.129
Head-Office(config-crypto-map) # match address INT_TRAFFIC
Head-Office(config-crypto-map) # set transform-set DEMO

Head-Office(config) # interface fastethernet 0/4
Head-Office(config-if) # crypto map VPN_MAP


I used group-2 in my configuration, actually we have different diffie helmin groups like group-1 is less processor intensive but encryptio is weak (768-bit), group-2 is processor intensive but provides high bit encryption (1024-bit) and group-5 provides even more (1536-bit) encryption. so it depends on you which ever group you are using.

I hope this will be informative for You :)

Any suggestion and comments will be highly appreciated.

Cheers :)

28 comments:

nayyares said...

awesome, nice post !

cheers

Anonymous said...

Greetings from Idaho! I'm bored to death at work so I decided to check out your website on my iphone during lunch break. I love the info you provide here and can't wait to take a look when I get home.
I'm surprised at how quick your blog loaded on my mobile .. I'm not even using WIFI, just 3G .
. Anyhow, amazing site!
My webpage :: working at home

Anonymous said...

Why people still make use of to read news papers when in this technological world the whole thing
is presented on net?
Also see my page :: how to quit smoking

Anonymous said...

Does your site have a contact page? I'm having trouble locating it but, I'd like to shoot you an email.
I've got some suggestions for your blog you might be interested in hearing. Either way, great site and I look forward to seeing it grow over time.

Here is my blog post :: make money
My webpage > Http://www.Monroeunderwood.com

Anonymous said...

Howdy! I know this is sort of off-topic however I needed to
ask. Does managing a well-established website like yours take a massive amount work?
I am brand new to writing a blog but I do write in my journal on
a daily basis. I'd like to start a blog so I can share my personal experience and views online. Please let me know if you have any kind of ideas or tips for brand new aspiring blog owners. Thankyou!

Here is my blog post ... online shopping experience

Anonymous said...

I am regular visitor, how are you everybody? This paragraph posted at
this web site is in fact good.

Stop by my web site ... http://manganetwork.freehostingcloud.com/index.php?title=User:SoniaEric

Anonymous said...

It is in point of fact a nice and helpful piece of information.
I'm happy that you simply shared this helpful info with us. Please keep us up to date like this. Thank you for sharing.

Here is my web-site ... seo services india

Anonymous said...

This is my first time pay a visit at here and i am in fact
pleassant to read everthing at alone place.

my webpage: carinoculetto.com

Anonymous said...

This article is in fact a pleasant one it assists new the web
users, who are wishing for blogging.

My blog :: drip coffee

Anonymous said...

Nice blog! Is your theme custom made or did
you download it from somewhere? A theme like yours with a few simple tweeks would really make my blog
stand out. Please let me know where you got your design.
Kudos

My webpage ... kiteboarding video

Anonymous said...

Hello there, I found your site by means of Google while searching for a similar topic, your site
came up, it looks good. I have bookmarked it in my google
bookmarks.
Hi there, just turned into aware of your weblog
via Google, and located that it is truly informative.
I'm gonna watch out for brussels. I'll be grateful if you proceed this in future.
A lot of other people will be benefited out of your writing.
Cheers!

Feel free to visit my blog post how long to pass a drug test

Anonymous said...

I am only commenting to make you know of the useful encounter my wife's daughter obtained visiting your web site. She figured out a good number of pieces, not to mention what it's like to have a wonderful coaching nature to have the
rest with no trouble learn about several very confusing subject matter.
You truly exceeded our expected results.
Thank you for presenting such valuable, healthy, revealing and as well as easy thoughts on the topic to Julie.


Feel free to visit my web-site ... best gps running watch

Anonymous said...

Heya i am for the primary time here. I found this board and I in finding It really useful & it helped me out much.
I hope to give one thing again and aid others like you helped me.


Feel free to visit my blog post :: cure for yeast infection in women

Anonymous said...

Hey there I am so delighted I found your blog, I really
found you by mistake, while I was researching on Askjeeve for something
else, Regardless I am here now and would just like to say thank you for a fantastic post and a all round entertaining blog (I also love the theme/design), I don’t have time to
read it all at the moment but I have bookmarked it
and also included your RSS feeds, so when I have time I
will be back to read a great deal more, Please do keep up the excellent jo.


Also visit my page: how to pass a drug test in 3 days

Anonymous said...

Thanks for your write-up on this web site. From my own experience, there are occassions when softening upwards a photograph may provide the professional photographer with a little bit of an imaginative flare.
Sometimes however, the soft cloud isn't just what you had in your mind and can in many cases spoil an otherwise good picture, especially if you consider enlarging the item.

Feel free to surf to my weblog - http://www.realoldspower.com/

Anonymous said...

I am glad for writing to let you be aware of what a excellent discovery my
girl enjoyed viewing your site. She even learned such a lot of
issues, including what it's like to possess a very effective giving style to have the rest quite simply learn specific complex matters. You undoubtedly did more than my expected results. Thanks for rendering the productive, trusted, explanatory and cool tips on that topic to Jane.

My site - best gps running watch under $200

Anonymous said...

What's up to all, how is everything, I think every one is getting more from this site, and your views are nice designed for new viewers.

Also visit my site :: www.contre-l-idex-spc.org

Anonymous said...

Hi! Do you know if they make any plugins to assist
with SEO? I'm trying to get my blog to rank for some targeted keywords but I'm
not seeing very good success. If you know of any please share.
Many thanks!

Stop by my web-site ... http://wiki.free-community.in/index.php?title=Unique_Women_Clothes_Online

Anonymous said...

Can I just say what a relief to discover somebody that actually knows what they're discussing on the internet. You actually know how to bring an issue to light and make it important. More and more people need to look at this and understand this side of the story. I was surprised that you're not more popular because you certainly possess
the gift.

Also visit my web page: Highly recommended Web-site

Anonymous said...

I was wondering if you ever considered changing the page
layout of your website? Its very well written; I love what youve got to say.
But maybe you could a little more in the way of content so people could connect with it better.
Youve got an awful lot of text for only having 1 or two pictures.
Maybe you could space it out better?

Stop by my blog www.noamik.De

Anonymous said...

It's great that you are getting thoughts from this paragraph as well as from our dialogue made at this time.

Feel free to surf to my web page :: www.suparpat.com

Anonymous said...

Right away I am going away to do my breakfast, when having my breakfast coming again to read additional
news.

Feel free to surf to my blog post - Modcloth coupon

Anonymous said...

We're a bunch of volunteers and starting a new scheme in our community. Your web site offered us with useful information to work on. You have performed a formidable task and our entire group will likely be thankful to you.

my web page: http://wiki.kspu.karelia.ru/

Anonymous said...

Hi, I do believe this is an excellent web site.
I stumbledupon it ;) I'm going to revisit once again since I bookmarked it. Money and freedom is the greatest way to change, may you be rich and continue to help other people.

Stop by my webpage; mouse click the up coming website

Anonymous said...

Remarkable issues here. I am very satisfied to
peer your post. Thanks so much and I'm taking a look forward to touch you. Will you please drop me a e-mail?

Here is my site; http://www.porno4sex.com

Unknown said...

replica watches, ugg boots, ralph lauren pas cher, oakley sunglasses, louis vuitton, nike roshe run, chanel handbags, burberry, kate spade outlet, louis vuitton outlet, nike outlet, longchamp, louboutin shoes, gucci outlet, ray ban sunglasses, air jordan pas cher, nike free, jordan shoes, sac longchamp, uggs on sale, louboutin, nike free, cheap oakley sunglasses, nike air max, prada outlet, air max, christian louboutin outlet, tory burch outlet, longchamp pas cher, polo ralph lauren outlet, ugg boots, polo ralph lauren outlet, louis vuitton, replica watches, nike air max, louboutin pas cher, oakley sunglasses, tiffany jewelry, oakley sunglasses, ray ban sunglasses, louis vuitton, prada handbags, michael kors, ray ban sunglasses, louis vuitton outlet, louboutin outlet, longchamp outlet, oakley sunglasses, longchamp outlet, tiffany and co

Unknown said...

vans shoes, beats by dre, ghd, lancel, herve leger, new balance, ray ban, ralph lauren, abercrombie and fitch, celine handbags, north face outlet, birkin bag, louboutin, chi flat iron, soccer jerseys, nike air max, ferragamo shoes, mont blanc, insanity workout, hollister, jimmy choo shoes, nfl jerseys, soccer shoes, nike huarache, nike air max, nike roshe, wedding dresses, instyler, iphone cases, p90x workout, timberland boots, reebok shoes, mcm handbags, gucci, oakley, hollister, asics running shoes, valentino shoes, longchamp, converse, vans, converse outlet, baseball bats, hollister, north face outlet, bottega veneta, lululemon, babyliss, mac cosmetics, nike trainers

Unknown said...

bottes ugg, ugg boots uk, ugg,uggs,uggs canada, canada goose uk, canada goose outlet, pandora jewelry, moncler, hollister, marc jacobs, swarovski, juicy couture outlet, replica watches, canada goose, moncler, swarovski crystal, links of london, wedding dresses, moncler outlet, thomas sabo, karen millen, pandora jewelry, moncler, montre pas cher, juicy couture outlet, ugg pas cher, louis vuitton, moncler, moncler, louis vuitton, moncler, louis vuitton, supra shoes, coach outlet, canada goose, toms shoes, ugg,ugg australia,ugg italia, moncler, doudoune canada goose, canada goose, canada goose outlet, louis vuitton, pandora charms, canada goose, sac louis vuitton pas cher, pandora charms