RE 16 2003 Cisco Systems Inc All rights

RE 16 © 2003, Cisco Systems, Inc. All rights reserved. 1 1

Module 14 PIX VPN RE 16 2

Learning Objectives • Upon completion of this module, you will be able to perform the following tasks: – – – Identify how the PIX Firewall enables a secure VPN. Identify the tasks to configure PIX Firewall IPSec support. Identify the commands to configure PIX Firewall IPSec support. Configure a VPN between PIX Firewalls. Describe the Cisco VPN Client. RE 16 3

Overview This module will cover the creation and configuration of secure VPNs are a very useful tool in securing traffic between two remote networks. Both site-to-site and remote access VPNs will be covered.

Key Terms • • IPSec IKE DES, 3 DES, AES SHA-1, MD 5 RSA Digital Certificates Pre-shared keys Diffie-Hellman

The PIX Firewall Enables a Secure VPN RE 16 6

PIX Firewall VPN Topologies RE 16 7

IPSec Enables PIX Firewall VPN Features – – Data confidentiality Data integrity Data authentication Anti-replay RE 16 8

What Is IPSec? • IETF standard that enables encrypted communication between peers – Consists of open standards for securing private communications. – Network layer encryption ensuring data confidentiality, integrity, and authentication. – Scales from small to very large networks. – Included in PIX Firewall version 5. 0 and later. RE 16 9

IPSec Standards Supported by the PIX Firewall – IPSec (IP Security protocol) • Authentication Header (AH) • Encapsulating Security Payload (ESP) – – – – Internet Key Exchange (IKE) Data Encryption Standard (DES) Triple DES (3 DES) Diffie-Hellman (DH) Message Digest 5 (MD 5) Secure Hash Algorithm (SHA) Ravist, Shamir, Adelman signatures (RSA) Certificate Authorities (CA) RE 16 10

IPSec Configuration Tasks RE 16 11

Task 1—Prepare to Configure VPN Support RE 16 12

IPSec Configuration Tasks Overview – – Task 1—Prepare to configure VPN support. Task 2—Configure IKE parameters. Task 3—Configure IPSec parameters. Task 4—Test and verify VPN configuration. RE 16 13

Task 1—Prepare to Configure VPN Support – – Step 1—Determine the IKE (IKE phase one) policy. Step 2—Determine the IPSec (IKE phase two) policy. Step 3—Ensure that the networks without encryption. Step 4—Implicitly permit IPSec packets to bypass PIX Firewall access lists, access groups, and conduits. RE 16 14

Plan for IKE

IKE Phase One Policy Parameters

Determine IKE Phase One Policy Parameter Site 1 Site 2 Encryption algorithm DES Hash algorithm SHA Authentication method Pre-share Key exchange 768 -bit D-H IKE SA lifetime 86, 400 seconds

Plan for IPSec

Determine IPSec (IKE Phase Two) Policy

Ensure the Network Works pixfirewall# ping 172. 30. 2. 2 RE 16 20

Ensure ACLs do not Block IPSec Traffic RE 16 21

Task 2—Configure IKE Parameters RE 16 22

Step 1—Enable or Disable IKE pixfirewall (config)# isakmp enable interface-name – Enables or disables IKE on the PIX Firewall interfaces. – IKE is enabled by default. – Disable IKE on interfaces not used for IPSec. pixfirewall(config)# isakmp enable outside RE 16 23

Step 2—Configure an IKE Phase One Policy pixfirewall(config)# isakmp encryption des pixfirewall(config)# isakmp sha pixfirewall(config)# isakmp authentication pre-share pixfirewall(config)# isakmp lifetime 86400 – – – policy 10 hash policy 10 group 1 policy 10 Creates a policy suite grouped by priority number. Creates policy suites that match peers. Can use default values. RE 16 24

Step 3—Configure the IKE Pre-shared Key pixfirewall(config)# isakmp keystring address peer-address [netmask] – Pre-shared keystring must be identical at both peers. – Use any combination of alphanumeric characters up to 128 bytes for keystring. – Specify peer-address as a host or wildcard address. – Easy to configure, yet is not scalable. pixfirewall(config)# isakmp key cisco 123 address 192. 168. 6. 2 RE 16 25

Step 4—Verify IKE Phase One Policies pixfirewall# show isakmp policy Protection suite of priority 10 encryption algorithm: hash algorithm: authentication method: Diffie-Hellman group: lifetime: Default protection suite encryption algorithm: hash algorithm: authentication method: Diffie-Hellman group: lifetime: – DES - Data Encryption Standard (56 bit keys). Secure Hash Standard Pre-Shared Key #1 (768 bit) 86400 seconds, no volume limit DES - Data Encryption Standard (56 bit keys). Secure Hash Standard Rivest-Shamir-Adleman Signature #1 (768 bit) 86400 seconds, no volume limit Displays configured and default IKE protection suites. RE 16 26

Task 3—Configure IPSec Parameters RE 16 27

Step 1—Configure Interesting Traffic pixfirewall(config)# access-list acl_ID {deny | permit} protocol source_addr source_mask destination_addr destination_mask – – – permit = encrypt deny = do not encrypt access-list selects IP traffic by address, network, or subnet pixfirewall# access-list 101 permit ip host 192. 168. 1. 10 host 192. 168. 6. 10 RE 16 28

Example Crypto ACLs PIX 1 pix 1(config)# show static (inside, outside) 192. 168. 1. 10 10. 0. 1. 11 netmask 255 0 0 pix 1(config)# show access-list 110 permit ip host 192. 168. 1. 10 host 192. 168. 6. 10 PIX 6 pix 6(config)# show static (inside, outside) 192. 168. 6. 10 10. 0. 6. 11 netmask 255 0 0 pix 2(config)# show access-list 101 permit ip host 192. 168. 6. 10 host 192. 168. 1. 10 – Lists should always be symmetrical.

Step 2—Configure an IPSec Transform Set pixfirewall(config)# crypto ipsec transform-set-name transform 1 [transform 2 [transform 3]] – Sets are limited to up to one AH and up to two ESP transforms. – Default mode is tunnel. – Configure matching sets between IPSec peers. pix 1(config)# crypto ipsec transform-set pix 6 esp-des RE 16 30

Available IPSec Transforms ah-md 5 -hmac ah-sha-hmac esp-des esp-3 des esp-md 5 -hmac esp-sha-hmac AH-HMAC-MD 5 transform AH-HMAC-SHA transform ESP transform using DES cipher (56 bits) ESP transform using 3 DES cipher(168 bits) ESP transform using HMAC-MD 5 auth ESP transform using HMAC-SHA auth RE 16 31

Step 3—Configure the Crypto Map pixfirewall(config)# crypto map MYMAP 10 ipsec-isakmp pixfirewall(config)# crypto map MYMAP 10 match address 101 pixfirewall(config)# crypto map MYMAP 10 set peer 192. 168. 6. 2 pixfirewall(config)# crypto map MYMAP 10 set transform-set pix 6 pixfirewall(config)# crypto map MYMAP 10 set pfs group 1 pixfirewall(config)# crypto map MYMAP 10 set securityassociation lifetime seconds 28800 – – Specifies IPSec (IKE phase two) parameters. Map names and sequence numbers group entries into a policy. RE 16 32

Step 4—Apply the Crypto Map to an Interface pixfirewall(config)# crypto map-name interface-name – Applies the crypto map to an interface. – Activates IPSec policy. pixfirewall(config)# crypto map MYMAP interface outside RE 16 33

Example Crypto Map for PIX 1 pix 1(config)# show crypto map Crypto Map "peer 2" 10 ipsec-isakmp Peer = 192. 168. 2. 2 access-list 101 permit ip host 192. 168. 1. 11 host 192. 168. 2. 11 (hitcnt=0) Current peer: 192. 168. 2. 2 Security association lifetime: 4608000 kilobytes/28800 seconds PFS (Y/N): N Transform sets={ pix 2, }

Example Crypto Map for PIX 2 pix 2(config)# show crypto map Crypto Map "peer 1" 10 ipsec-isakmp Peer = 192. 168. 1. 2 access-list 101 permit ip host 192. 168. 2. 11 host 192. 168. 1. 11 (hitcnt=0) Current peer: 192. 168. 1. 2 Security association lifetime: 4608000 kilobytes/28800 seconds PFS (Y/N): N Transform sets={ pix 1, }

Task 4—Test and Verify VPN Configuration RE 16 36

Task 4—Test and Verify VPN Configuration – Verify ACLs and interesting traffic. show access-list – Verify correct IKE configuration. show isakmp policy – Verify correct IPSec configuration. show crypto ipsec transform-set RE 16 37

Task 4—Test and Verify VPN Configuration (cont. ) – Verify the correct crypto map configuration. show crypto map – Clear the IPSec SA. clear crypto ipsec sa – Clear the IKE SA. clear crypto isakmp sa – Debug IKE and IPSec traffic through the PIX Firewall. debug crypto ipsec debug crypto isakmp RE 16 38

The Cisco VPN Client RE 16 39

Topology Overview

Cisco VPN Client Features – Support for Windows ME, Windows 2000, and Windows XP – Data compression – Split tunneling – User authentication by way of VPN central-site device – Automatic VPN Client configuration – Internal MTU adjustment – CLI to the VPN Dialer – Start Before Logon – Software update notifications from the VPN device upon connection RE 16 41

PIX Firewall to VPN Client Pre-Shared Example pixfirewall# write terminal access-list 80 permit ip 10. 0 255. 0 10. 0. 20. 0 255. 0 ip address outside 192. 168. 0. 2 255. 0 ip address inside 10. 0. 0. 1 255. 0 ip local pool MYPOOL 10. 0. 20. 1 -10. 0. 254 nat (inside) 0 access-list 80 route outside 0 0 192. 168. 0. 1 aaa-server MYTACACS protocol tacacs+ aaa-server MYTACACS (inside) host 10. 0. 0. 10 tacacskey timeout 5 aaa authentication include any inbound 0 0 MYTACACS sysopt connection permit-ipsec crypto ipsec transform-set AAADES esp-des esp-md 5 -hmac crypto dynamic-map DYNOMAP 10 set transform-set AAADES RE 16 42

PIX Firewall to VPN Client Pre-Shared Example (cont. ) pixfirewall# write terminal crypto map VPNPEER 20 ipsec-isakmp dynamic DYNOMAP crypto map VPNPEER client authentication MYTACACS crypto map VPNPEER interface outside isakmp enable outside isakmp identity address isakmp policy 10 authentication pre-share isakmp policy 10 encryption des isakmp policy 10 hash md 5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup TRAINING address-pool MYPOOL vpngroup TRAINING idle-time 1800 vpngroup TRAINING password **** RE 16 43

VPN Client to PIX Firewall Example – A new connection entry named vpnpeer 0 is created. – The remote server IP is the PIX Firewall outside interface. vpnpeer 0 RE 16 44

VPN Client to PIX Firewall Example (cont. ) – The group name matches the vpngroup name in the PIX Firewall. – The password is the pre-shared key and must match the vpngroup password. – You can use the digital certificate for authentication. TRAINING RE 16 45

PIX Firewall Assigns the IP Address to the VPN Client

Scale PIX Firewall VPNs RE 16 47

CA Server Fulfilling Requests from IPSec Peers • Each IPSec peer individually enrolls with the CA server.

Enroll a PIX Firewall with a CA – – – Configure CA support Generate public or private keys Authenticate the CA Request signed certificates from the CA CA administrator verifies request and sends signed certificates RE 16 49

Summary RE 16 50

Summary – The PIX Firewall enables a secure VPN. – IPSec configuration tasks include configuring IKE and IPSec parameters. – CAs enable scaling to a large number of IPSec peers. – Remote users can establish secure VPN tunnels between PCs running Cisco VPN Client software and any Cisco VPN-enabled product, such as the PIX Firewall, that supports the Unified Client framework. RE 16 51

RE 16 © 2003, Cisco Systems, Inc. All rights reserved. 52 52