ASA Firewall Lab PDF

IPSec over GRE Tunnel:
Advantages:
 Will create a logical virtual interface between the two routers that the traffic will appear to flow across
 Allows us to run a IGP routing protocol
 Allows Multicast Routing
 Encrypted Traffic going through the Internet
Pre-Configuration:
 ASA
!
interface GigabitEthernet0
ip address 100.100.100.2 255.255.255.0
nameif outside
security-level 0
no shutdown
!
!
ip address 10.10.10.1 255.255.255.252
nameif inside
security-level 100
no shutdown
 Corp
!
interface FastEthernet 0/0
ip address 10.10.10.2 255.255.255.252
no shutdown
ip address 10.10.11.1 255.255.255.252
no shutdown
 Branch
!
ip address 100.100.100.10 255.255.255.0
no shutdown
!
ip address 10.10.14.1 255.255.255.252
no shutdown
 ASA
!
no nameif
security-level 0
no ip address
no shut
!
interface GigabitEthernet1.1
nameif DMZ
security-level 50
ip address 20.20.20.1 255.255.255.0
 SW1
vlan database
vlan 10 name DMZ
exit
conf t
!
no ip routing
!
int fa1/0
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface range FastEthernet 1/1 - 2
switchport mode access
switchport access vlan 10
!
ip default-gateway 20.20.20.1
 SW2
!
vlan database
vlan 2 name Sales
vlan 3 name Finance
exit
conf t
!
spanning-tree portfast
!
!
interface vlan 2
ip address 10.10.12.1 255.255.255.0
no shut
!
interface vlan 3
ip address 10.10.13.1 255.255.255.0
no shut
!
ip address 10.10.11.2 255.255.255.252
no shut
!
ip dhcp excluded-address 10.10.12.1 10.10.12.9
!
ip dhcp pool VLAN2
network 10.10.12.0 /24
default-router 10.10.12.1
dns-server 8.8.8.8
!
!
ip dhcp pool VLAN3
network 10.10.13.0 /24
dns-server 8.8.8.8
 SW3
!
vlan database
vlan 2 name Accounting
vlan 3 name Management
exit
conf t
!
!
!
interface vlan 2
ip address 10.10.15.1 255.255.255.0
no shut
!
interface vlan 3
ip address 10.10.16.1 255.255.255.0
no shut
!
ip address 10.10.14.2 255.255.255.252
no shut
!
!
ip dhcp pool VLAN2
network 10.10.15.0 /24
dns-server 8.8.8.8
!
!
ip dhcp pool VLAN3
network 10.10.16.0 /24
dns-server 8.8.8.8
Advantages:
 Will create a logical virtual interface between the two routers that the traffic will appear to flow across
 Allows us to run a IGP routing protocol
 Allows Multicast Routing
 Encrypted Traffic going through the Internet
Configuration GRE Tunnel:
Step 1: Create OSPF routing process:
 CORP(config)# router ospf 123

CORP(config-router)# network 192.168.1.0 0.0.0.255 area 0
 BRANCH(config)# router ospf 123

BRANCH(config-router)# network 10.1.1.0 0.0.0.255 area 0
Step 2: Configure layer 3 tunnel interfaces:
 CORP(config)# interface tunnel 0

CORP(config-if)# tunnel source f0/0
CORP(config-if)# tunnel destination 192.168.137.10
CORP(config-if)# ip address 10.10.1.1 255.255.255.252
CORP(config-if)# tunnel path-mtu-discovery
CORP(config-if)# ip ospf mtu-ignore
 BRANCH(config)# interface tunnel 0

BRANCH(config-if)# tunnel source f0/0
BRANCH(config-if)# tunnel destination 192.168.137.2
BRANCH(config-if)# ip address 10.10.1.2 255.255.255.252
BRANCH(config-if)# tunnel path-mtu-discovery
BRANCH(config-if)# ip ospf mtu-ignore
Verify:
 CORP# ping 10.10.1.2
Step 3: Update OSPF Network Statements:
 CORP(config)# router ospf 123

 CORP(config-router)# network 10.10.1.0 0.0.0.3 area 0
 BRANCH(config)# router ospf 123

 BRANCH(config-router)# network 10.10.1.0 0.0.0.3 area 0
Verify:
 CORP# show ip ospf neighbor
Configure IPSec:
Step 1: Define Traffic to be encrypted
 CORP(config)# ip access-list extended IPSEC-TRAFFIC

CORP(config-ext-nacl)# remark VPN Traffic
CORP(config-ext-nacl)# permit gre host 192.168.137.2 host 192.168.137.10
 BRANCH(config)# ip access-list extended IPSEC-TRAFFIC

BRANCH(config-ext-nacl)# remark VPN Traffic
BRANCH(config-ext-nacl)# permit gre host 192.168.137.10 host 192.168.137.2
Step 2: Phase 1: Isakmp policy
 CORP(config)# crypto isakmp policy 1

CORP(config-isakmp)# authentication pre-share
CORP(config-isakmp)# encryption aes 128
CORP(config-isakmp)# hash sha
CORP(config-isakmp)# group 2
 BRANCH(config)# crypto isakmp policy 1

BRANCH(config-isakmp)# authentication pre-share
BRANCH(config-isakmp)# encryption aes 128
BRANCH(config-isakmp)# hash sha
BRANCH(config-isakmp)# group 2
Step 3: Define Shared Secret
 CORP(config)# crypto isakmp key 0 CISCO address 192.168.137.10
 BRANCH(config)# crypto isakmp key 0 CISCO address 192.168.137.2
Step 4: Phase 2: IPSec transform set
 CORP(config)# crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac

CORP(cfg-crypto-trans)# mode tunnel
 BRANCH(config)# crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac

BRANCH(cfg-crypto-trans)# mode tunnel
Step 5: Create crypto-map
 CORP(config)# crypto map CRYPTO-MAP 1 ipsec-isakmp

CORP(config-crypto-map)# description to BRANCH
CORP(config-crypto-map)# match address IPSEC-TRAFFIC
CORP(config-crypto-map)# set peer 192.168.137.10
CORP(config-crypto-map)# set transform-set TRANS-SET-GRE-TUNNEL
 BRANCH(config)# crypto map CRYPTO-MAP 1 ipsec-isakmp

BRANCH(config-crypto-map)# description to CORP
BRANCH(config-crypto-map)# match address IPSEC-TRAFFIC
BRANCH(config-crypto-map)# set peer 192.168.137.2
BRANCH(config-crypto-map)# set transform-set TRANS-SET-GRE-TUNNEL
Step 6: Apply crypto-map to interfaces
 CORP(config)# interface f0/0

CORP(config-if)# crypto map CRYPTO-MAP
 CORP(config-if)# interface tunnel 0
CORP(config-if)# crypto map CRYPTO-MAP
 BRANCH(config)# interface f0/0

BRANCH(config-if)# crypto map CRYPTO-MAP
 BRANCH(config-if)# interface tunnel 0
BRANCH(config-if)# crypto map CRYPTO-MAP
Step 7: Verification
CORP# show ip ospf neighbor

CORP# show crypto ipsec sa
CORP# ping 10.10.1.2 repeat 50

ASA Firewall Lab PDF

Uploaded by

Document Informationclick to expand document information

Document Informationclick to expand document information

Copyright:

Available Formats

ASA Firewall Lab PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ASA Firewall Lab PDF

Uploaded by

Copyright:

Available Formats

IPSec over GRE Tunnel:

Configuration GRE Tunnel:

Step 1: Create OSPF routing process:

 CORP(config)# router ospf 123

 BRANCH(config)# router ospf 123

Step 2: Configure layer 3 tunnel interfaces:

 CORP(config)# interface tunnel 0

 BRANCH(config)# interface tunnel 0

 CORP# ping 10.10.1.2

Step 3: Update OSPF Network Statements:

 CORP(config)# router ospf 123

 BRANCH(config)# router ospf 123

 CORP# show ip ospf neighbor

Step 1: Define Traffic to be encrypted

 CORP(config)# ip access-list extended IPSEC-TRAFFIC

 BRANCH(config)# ip access-list extended IPSEC-TRAFFIC

Step 2: Phase 1: Isakmp policy

 CORP(config)# crypto isakmp policy 1

 BRANCH(config)# crypto isakmp policy 1

Step 3: Define Shared Secret

 CORP(config)# crypto isakmp key 0 CISCO address 192.168.137.10

 BRANCH(config)# crypto isakmp key 0 CISCO address 192.168.137.2

Step 4: Phase 2: IPSec transform set

 CORP(config)# crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac

 BRANCH(config)# crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac

Step 5: Create crypto-map

 CORP(config)# crypto map CRYPTO-MAP 1 ipsec-isakmp

 BRANCH(config)# crypto map CRYPTO-MAP 1 ipsec-isakmp

Step 6: Apply crypto-map to interfaces

 CORP(config)# interface f0/0

 BRANCH(config)# interface f0/0

CORP# show ip ospf neighbor

You might also like