Преглеждане на кода на Site-to-Site IPsec VPN конфигурация с CLI

[[Category:Cisco]]
[http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html Site-to-Site and Extranet VPN Business Scenarios]
==Примерна топология==
[[Файл:IPSec_Site_to_Site_Topology.png]]
==Етапи==
Конфигурирането на Site-to-Site IPSec VPN на устройства на Cisco с CLI се състои от следните етапи:
#Проверка за съвместимост на филтрирането на трафика (ACL) с необходимите протоколи за IPSec.
#Конфигуриране на ISAKMP (IKE) политика.
#Конфигуриране на т.нар. "transform set".
#Дефиниране на ACL (crypto ACL), описваща кой трафик да преминава през тунела.
#Поставяне на "crypto map", обобщаващ параметрите на тунела на съответен интерфейс.

==Първоначална конфигурация на устройствата от топологията==
===Маршрутизатор R1===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
Router>
Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R1
R1(config)#interface fa0/0
R1(config-if)#ip address 11.0.0.1 255.255.0.0
R1(config-if)#no shutdown
R1(config-if)#int s0/0/0
R1(config-if)#ip address 81.0.0.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#router eigrp 101
R1(config-router)#network 81.0.0.0
R1(config-router)#network 11.0.0.0
R1(config-router)#no auto-summary
R1(config-router)#end
R1#
</pre>
===Маршрутизатор R2===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
Router>
Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R2
R2(config)#interface s0/0/0
R2(config-if)#ip address 81.0.0.2 255.0.0.0
R2(config-if)#clock rate 4000000
R2(config-if)#no shutdown
R2(config-if)#interface s0/0/1
R2(config-if)#ip address 194.141.69.2 255.255.255.0
R2(config-if)#clock rate 4000000
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#router eigrp 101
R2(config-router)#network 81.0.0.0
R2(config-router)#network 194.141.69.0
R2(config-router)#no auto-summary
R2(config-router)#end
R2#</pre>
===Маршрутизатор R3===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
Router>
Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R3
R3(config)#interface fa0/0
R3(config-if)#ip address 12.0.0.1 255.255.0.0
R3(config-if)#no shutdown
R3(config-if)#int s0/0/0
R3(config-if)#ip address 194.141.69.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#router eigrp 101
R3(config-router)#network 194.141.69.0
R3(config-router)#network 12.0.0.0
R3(config-router)#no auto-summary
R3(config-router)#end
R3#
</pre>
==Етап 1 - Проверка за филтриране на трафика==
Препоръчително е да се провери дали между двете мрежи, които трябва да комуникират през IPSec VPN не са филтрирани AH, ESP и UDP порт 500.

Примерни ACE, разрешаващи необходимия трафик са:
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
access-list 101 permit ahp host 81.0.0.1 host 194.141.69.2
access-list 101 permit esp host 81.0.0.1 host 194.141.69.2
access-list 101 permit udp host 81.0.0.1 host 194.141.69.2 eq isakmp 
</pre>
==Етап 2 - Конфигуриране на ISAKMP политика==
За да се опише ISAKMP политиката се използват следните команди:
*'''crypto isakmp policy''' ''#'' - създава политика със зададения номер
*'''authentication''' - дефинира метода за автенитфикация
*'''encryption''' - посочва криптографски алгоритъм за криптиране (шифриране)
*'''group''' - посочва група DH функции
*'''hash''' - задава криптографска хеш функция
*'''lifetime''' - посочва времето на живот на политиката в секунди, след което трябва параметрите да се предоговорят
*'''crypto isakmp key''' ''парола'' '''address''' ''IP адрес'' - при автентификация със споделени пароли (preshared keys) командата посочва за отдалечената система (peer) съответна парола
==Етап 3 - Дефиниране на Transform set==
Дефинирането на "transform set" се извършва с командата '''crypto ipsec transform-set''' ''име'' ''трансформации'', например:
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
crypto ipsec transform-set TESTVPN esp-aes 256 esp-sha-hmac 
</pre>
В примера "transform set" има име TESTVPN, криптирането на трафика ще бъде с алгоритъм AES256, а HMAC се базира на SHA.
==Етап 4 - Създаване на ACL за трафика през тунела==
Crypto ACL се използва за да филтрира трафика, който преминава през тунела. Разрешените пакети се криптират, а останалите преминават в чест оригинален вид през изходящия интерфейс.
За примерната топология crypto ACL могат да бъдат:
*Маршрутизатор R1
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
access-list 102 permit ip 11.0.0.0 0.255.255.255 12.0.0.0 0.255.255.255
</pre>
*Маршрутизатор R3
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
access-list 102 permit ip 12.0.0.0 0.255.255.255 11.0.0.0 0.255.255.255
</pre>
==Етап 5 - Обединяване на настройките "crypto map"==
Обединяването на настройките за тунела и поставянето им на определен интерфейс е чрез т.нар. "crypto map".
*'''crypto map''' ''име'' ''приоритет'' ''протокол'' - командата създава "crypto map" с посоченото име, приоритет и протокол.
*'''match address''' ''ACL'' - определя, коя ACL ще се използва за определяне кои пакети да преминават през тунела и кои не.
*'''set peer''' ''IP адрес'' - IP адрес на отдалечената система.
*'''set pfs''' - конфигуриране на Perfect Forward Secrecy.
*'''set transform-set''' ''име'' - име на "transform set".
*'''set security-association lifetime''' - интервал на валидност на SA.

Поставянето на "crypto map" на определен интерфейс е чрез командата ''' crypto map'''.

Примерна конфигурация за "crypto map" на маршрутизатор R3 е:
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
R3#
R3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R3(config)#crypto map MAPR1 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R3(config-crypto-map)#match address 102
R3(config-crypto-map)#set peer 194.141.69.1
R3(config-crypto-map)#set pfs group5
R3(config-crypto-map)#set transform-set TESTVPN
ERROR: transform set with tag TESTVPN does not exist.
R3(config-crypto-map)#set security-association lifetime seconds 86400
R3(config-crypto-map)#exit
R3(config)#int s0/0/0
R3(config-if)#crypto map MAPR1
*Jan  3 07:16:26.785: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R3(config-if)#end
R3#
</pre>

==Примерна конфигурация==
===Маршрутизатор R1===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
Router>
Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R1
R1(config)#interface fa0/0
R1(config-if)#ip address 11.0.0.1 255.255.0.0
R1(config-if)#no shutdown

R1(config-if)#int s0/0/0
R1(config-if)#ip address 81.0.0.1 255.0.0.0
R1(config-if)#no shutdown

R1(config-if)#exit
R1(config)#router eigrp 101
R1(config-router)#network 81.0.0.0
R1(config-router)#network 11.0.0.0
R1(config-router)#no auto-summary
R1(config-router)#
R1(config-router)#crypto isakmp policy 1
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#encryption aes
R1(config-isakmp)#group 5
R1(config-isakmp)#hash sha
R1(config-isakmp)#lifetime 86400
R1(config-isakmp)#exit
R1(config)#crypto isakmp key cisco12345 address 194.141.69.1
R1(config)#
R1(config)#crypto ipsec transform-set TESTVPN esp-aes 256 esp-sha-hmac 
R1(config)#
R1(config)#access-list 102 permit ip 11.0.0.0 0.255.255.255 12.0.0.0 0.255.255.255
R1(config)#
R1(config)#crypto map MAPR1 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R1(config-crypto-map)#match address 102
R1(config-crypto-map)#set peer 194.141.69.1
R1(config-crypto-map)#set pfs group5
R1(config-crypto-map)#set transform-set TESTVPN
R1(config-crypto-map)#set security-association lifetime seconds 86400
R1(config-crypto-map)#exit
R1(config)#int s0/0/0
R1(config-if)#crypto map MAPR1
*Jan  3 07:16:26.785: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1(config-if)#
R1(config-if)#end
R1#
</pre>
===Маршрутизатор R3===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R3
R3(config)#interface fa0/0
R3(config-if)#ip address 12.0.0.1 255.255.0.0
R3(config-if)#no shutdown

R3(config-if)#int s0/0/0
R3(config-if)#ip address 194.141.69.1 255.255.255.0
R3(config-if)#no shutdown

R3(config-if)#exit
R3(config)#router eigrp 101
R3(config-router)#network 194.141.69.0
R3(config-router)#network 12.0.0.0
R3(config-router)#no auto-summary
R3(config-router)#
R3(config-router)#crypto isakmp policy 1
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#encryption aes
R3(config-isakmp)#group 5
R3(config-isakmp)#hash sha
R3(config-isakmp)#lifetime 86400
R3(config-isakmp)#exit
R3(config)#crypto isakmp key cisco12345 address 81.0.0.1
R3(config)#
R3(config)#crypto ipsec transform-set TESTVPN esp-aes 256 esp-sha-hmac 
R3(config)#
R3(config)#access-list 102 permit ip 12.0.0.0 0.255.255.255 11.0.0.0 0.255.255.255
R3(config)#
R3(config)#crypto map MAPR3 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R3(config-crypto-map)#match address 102
R3(config-crypto-map)#set peer 81.0.0.1
R3(config-crypto-map)#set pfs group5
R3(config-crypto-map)#set transform-set TESTVPN
R3(config-crypto-map)#set security-association lifetime seconds 86400
R3(config-crypto-map)#exit
R3(config)#int s0/0/0
R3(config-if)#crypto map MAPR3
*Jan  3 07:16:26.785: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R3(config-if)#
R3(config-if)#end
R3#
</pre>
==Проверка на тунела==
Най-основната проверка на работата на тунела е да се генерира трафик и чрез командата '''show crypto ipsec sa''' да се провери броя на енкпасулираните и деенкапсулирани пакети.
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
R3#sh crypto ipsec sa

interface: Serial0/0/0
    Crypto map tag: MAPR3, local addr 194.141.69.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (12.0.0.0/255.0.0.0/0/0)
   remote  ident (addr/mask/prot/port): (11.0.0.0/255.0.0.0/0/0)
   current_peer 81.0.0.1 port 500
    PERMIT, flags={origin_is_acl,}
   #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 0
   #pkts decaps: 2, #pkts decrypt: 2, #pkts verify: 0
   #pkts compressed: 0, #pkts decompressed: 0
   #pkts not compressed: 0, #pkts compr. failed: 0
   #pkts not decompressed: 0, #pkts decompress failed: 0
   #send errors 1, #recv errors 0

     local crypto endpt.: 194.141.69.1, remote crypto endpt.:81.0.0.1
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0/0
     current outbound spi: 0x608666A7(1619420839)

     inbound esp sas:
      spi: 0x7D9A1843(2107250755)
        transform: esp-aes 256 esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 2009, flow_id: FPGA:1, crypto map: MAPR3
        sa timing: remaining key lifetime (k/sec): (4525504/86386)
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x608666A7(1619420839)
        transform: esp-aes 256 esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 2010, flow_id: FPGA:1, crypto map: MAPR3
        sa timing: remaining key lifetime (k/sec): (4525504/86386)
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

R3#
</pre>
==Ctrl+C/Ctrl+V==
===Маршрутизатор R1===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal
hostname R1
interface fa0/0
ip address 11.0.0.1 255.255.0.0
no shutdown
int s0/0/0
ip address 81.0.0.1 255.0.0.0
no shutdown
exit
router eigrp 101
network 81.0.0.0
network 11.0.0.0
no auto-summary

crypto isakmp policy 1
authentication pre-share
encryption aes
group 5
hash sha
lifetime 86400
exit
crypto isakmp key cisco12345 address 194.141.69.1

crypto ipsec transform-set TESTVPN esp-aes 256 esp-sha-hmac 

access-list 102 permit ip 11.0.0.0 0.255.255.255 12.0.0.0 0.255.255.255

crypto map MAPR1 1 ipsec-isakmp
match address 102
set peer 194.141.69.1
set pfs group5
set transform-set TESTVPN
set security-association lifetime seconds 86400
exit
int s0/0/0
crypto map MAPR1

end
</pre>

===Маршрутизатор R2===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal
hostname R2
interface s0/0/0
ip address 81.0.0.2 255.0.0.0
clock rate 4000000
no shutdown
interface s0/0/1
ip address 194.141.69.2 255.255.255.0
clock rate 4000000
no shutdown
exit
router eigrp 101
network 81.0.0.0
network 194.141.69.0
no auto-summary
end
</pre>
===Маршрутизатор R3===
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal
hostname R3
interface fa0/0
ip address 12.0.0.1 255.255.0.0
no shutdown
int s0/0/0
ip address 194.141.69.1 255.255.255.0
no shutdown
exit
router eigrp 101
network 194.141.69.0
network 12.0.0.0
no auto-summary

crypto isakmp policy 1
authentication pre-share
encryption aes
group 5
hash sha
lifetime 86400
exit
crypto isakmp key cisco12345 address 81.0.0.1

crypto ipsec transform-set TESTVPN esp-aes 256 esp-sha-hmac 

access-list 102 permit ip 12.0.0.0 0.255.255.255 11.0.0.0 0.255.255.255

crypto map MAPR3 1 ipsec-isakmp
match address 102
set peer 81.0.0.1
set pfs group5
set transform-set TESTVPN
set security-association lifetime seconds 86400
exit
int s0/0/0
crypto map MAPR3

end
</pre>