1.1 Configuring HQ Router as Remote Access Group VPN Server

Transcription

1 Notes:

2 1.1 Configuring HQ Router as Remote Access Group VPN Server Step 1 Enable AAA model for local and remote access authentication. AAA will prompt extended authentication for remote access group VPN clients whenever user try to establish connection with HQ Router. Use local credential as the default authentication. aaa new-model aaa authentication login default local aaa authorization network default local Step 2 Configure DHCP pool for local users and exclude a range of IP addresses for static IP addresses. Configure this in global configuration mode as shown below. ip dhcp excluded-address ip dhcp excluded-address ! ip dhcp pool LOCAL-LAN import all network default-router dns-server Step 3 Configure crypto isakmp policy for phase 1 negotiation. This isakmp policy is for Remote Access VPN. Issue the crypto command as shown below. crypto isakmp policy 10 encr aes authentication pre-share group 2

3 Step 4 Configure remote access group VPN for telecommuters. Issue the command as shown below. crypto isakmp client configuration group MYGROUP key abcde12345 dns pool vpnpool acl 101 netmask Step 5 Configure crypto IPSec for phase 2 negotiations. Name the transform-set as RASET. crypto ipsec transform-set RASET esp-aes esp-sha-hmac Step 6 Create a dynamic crypto map with the name of dynmap. Bind the transform-set to this dynamic map. crypto dynamic-map dynmap 10 set transform-set RASET reverse-route Step 7 Create a crypto map that will prompt remote connection request with extended authentication, authorization and DHCP IP address. Bind the crypto map to the dynamic crypto map. Issue the following command to complete this step crypto map mymap client authentication list default crypto map mymap isakmp authorization list default crypto map mymap client configuration address initiate crypto map mymap client configuration address respond crypto map mymap 10 ipsec-isakmp dynamic dynmap

4 Step 8 Associate crypto map to the outside interface to allow remote access group VPN clients to dial-in. Enable NAT outside. interface FastEthernet0/0 description ***WAN INTERFACE*** ip address ip nat outside crypto map mymap Step 9 Configure the HQ Router local interface and enable NAT inside interface FastEthernet0/1 ip address ip nat inside Step 10 Create a local IP address pool for remote access group VPN clients. Assign a range of IP address as shown below. ip local pool vpnpool Step 11 Configure the router for Port Address Translation to allow local network to be translated to the internet with the outside interface. Issue the command as show below. ip nat inside source list 100 interface FastEthernet0/0 overload

5 Step 12 Configure extended access-list for remote access group VPN. This access-list is to allow local network to be encrypted to the remote sites local network. access-list 101 permit ip Step 13 Configure extended access-list for Port Address Translation at Step 16. This access-list will also deny translation between local and remote network. access-list 100 deny ip access-list 100 permit ip any Step 14 Create local credentials for remote access group VPN clients authentication. username shrek password cisco username ben password cisco Step 15 Create inspection rules to inspect local network traffic from going out to the internet. This inspection rule should apply to inside interface. Use CBAC as the inspection name and select the protocols to be inspected. Issue the following command to complete this step. ip inspect tcp finwait-time 2 ip inspect tcp synwait-time 5 ip inspect name CBAC https ip inspect name CBAC ftp ip inspect name CBAC telnet ip inspect name CBAC ssh ip inspect name CBAC isakmp ip inspect name CBAC pptp ip inspect name CBAC telnets ip inspect name CBAC http ip inspect name CBAC icmp ip inspect name CBAC tcp ip inspect name CBAC udp

6 Step 16 Apply the inspection policy to inside interface inbound direction as shown below interface FastEthernet0/1 ip address ip nat inside ip inspect CBAC in Step 17 Create implicit deny extended access-list to deny any unknown traffic from going in to the HQ router. Permit certain protocols from coming in to the HQ Router network. In this scenario, permit remote access group VPN (port 4500 or non500-isakmp), telnet (port 23), SSH (port 22) and remote desktop connection (3389). Name the extended access-list as OUTSIDE_IN. ip access-list extended OUTSIDE_IN permit icmp any any permit gre any host permit udp any host eq non500-isakmp permit esp any host permit tcp any host eq 22 permit tcp any host eq 23 permit tcp any host eq 3389 deny ip host any deny ip any deny ip any deny ip any deny tcp any any deny udp any any

7 Step 18 Apply extended access-list OUTSIDE_IN to the outside interface inbound direction. interface FastEthernet0/1 ip address ip nat inside ip access-group OUTSIDE_IN in Step 19 Run the show ip inspect session command to view the inspection progress from internal network to the internet. Established Sessions Session 82BEAA64 ( :51198)=>( :53) dns SIS_OPEN Half-open Sessions Session 82BF48D4 ( :1028)=>( :161) udp SIS_OPENING * The above output shown that the inspections were successful. All product names used herein, are trade names, service marks, trademarks, or registered trademarks of their respective owners. and Cisco VPN Reference Guide for Field Engineers are not associated with any product or vendor mentioned, including Cisco Systems. Cisco Routers are registered trademarks of Cisco Systems, Inc. Copyright network-insider.net 2010, All Rights Reserved