CCIE Security: IOS VPNs Cheatsheet

Transcription

1 CCIE Security: IOS VPNs Cheatsheet (config)#int lo0 ip add int gi0/0 ip add no shut ip route (config)# int lo0 (config-if)#ip add (config-if)#int gi0/0 (config-if)#ip add (config-if)#no shut (config-if)# ip route will always act as the client (Easy VPN client, Flex VPN client, DMVPN spoke, GETVPN group member ). This is basic configuration. They work, but there are no verification commands shown.

2 IKEv1 ISAKMP Policy Crypto isamp policy 10 Encryption 3des Authentication pre-share Transform Set Crypto ipsec transform-set <name> esp-3des esp-sha-hmac Keyring Crypto keyring <name> Pre-shared-key address <IP> key <key> ACL Ip access-list extended <name> Permit ip host host ISAKMP Profile Crypto isakmp profile <name> Match identity <address> Keyring <name> Crypto Map Crypto map <name> <number> ipsec-isakmp Set peer <IP> Match address <ACL> Set transform-set <name> Set isakmp-profile <name> Interface Int <int> Crypto map <name> (config)#ip access-list extended VPN-Traffic (config-ext-nacl)#permit ip host host (config-ext-nacl)#exit (config)#crypto isakmp policy 10 (config-isakmp)#encryption 3des (config-isakmp)#authentication pre-share (config-isakmp)#hash sha (config-isakmp)#exit (config)#crypto ipsec transform 3des esp-3des esp-shahmac (cfg-crypto-trans)#exit (config)#crypto keyring (conf-keyring)#pre-shared-key address key cisco (conf-keyring)#exit (config)#crypto isakmp profile (conf-isa-prof)#match identity address (conf-isa-prof)#keyring (conf-isa-prof)#exit (config)#crypto map -Map 1 ipsec-isakmp (config-crypto-map)#set peer (config-crypto-map)#match address VPN-Traffic (config-crypto-map)#set transform-set 3des (config-crypto-map)#set isakmp-profile (config-crypto-map)#exit (config)#int gi0/0 crypto map -Map ip access-list extended VPN-Traffic (config-ext-nacl)#permit ip host host (config-ext-nacl)#exit crypto isakmp policy 10 (config-isakmp)#encr 3des (config-isakmp)#auth pre-share (config-isakmp)#hash sha (config-isakmp)#exit crypto ipsec transform-set 3des esp-3des espsha-hmac (cfg-crypto-trans)#exit crypto keyring (conf-keyring)#pre-shared-key address key cisco (conf-keyring)#exit crypto isakmp profile (conf-isa-prof)#match identity address (conf-isa-prof)#keyring (conf-isa-prof)#exit crypto map -Map 1 ipsec-isakmp (config-crypto-map)#set peer (config-crypto-map)#match address VPN-Traffic (config-crypto-map)#set transform-set 3des (config-crypto-map)#set isakmp-profile (config-crypto-map)#exit int gi0/0 (config-if)#crypto map -Map (config-if)#

3 IKEv2 ISAKMP Policy Crypto isamp policy 10 Encryption 3des Authentication pre-share Keyring Crypto keyring <name> Pre-shared-key address <IP> key <key> ISAKMP Profile Crypto isakmp profile <name> Match identity <address> Keyring <name> IKEv2 Proposal Crypto ikev2 proposal<name> Encr 3des Integrity sha1 Group 2 IKEv2 Policy Crypto ikev2 policy 10 Proposal <name> Match address local <criteria> IKEv2 Keyring Crypto ikev2 keyring <name> Peer <name> <address> Pre-shared-key <key> IKEv2 profile Crypto ikev2 profile <name> Identity local <identity> Match address local <criteria> Match identity remote address <IP> Authentication local pre=share Authentication remote pre-share Keyring local <keyring> Transform Set Crypto ipsec transform-set <name> esp-3des esp-sha-hmac Crypto Map Crypto map <name> <number> ipsec-isakmp Set peer <IP> Match address <ACL> Set transform-set <name> Set ikev2-profile <name> Interface Int <int> Crypto map <name> ACL Ip access-list extended <name> Permit ip host host

4 IKEv2 Configs (config)#ip access-list ext VPN-Traffic (config-ext-nacl)#permit icmp host host (config-ext-nacl)#exit (config)#crypto isakmp policy 10 (config-isakmp)#enc 3des (config-isakmp)#hash sha (config-isakmp)#auth pre (config-isakmp)#exit (config)#cry ipsec transform 3des esp-3des esp-sha-hmac (cfg-crypto-trans)#exit (config)#crypto keyring (conf-keyring)#pre-shared-key add key cisco (conf-keyring)#exit (config)#crypto ikev2 keyring (config-ikev2-keyring)#peer (config-ikev2-keyring-peer)#add (config-ikev2-keyring-peer)#pre-shared-key cisco (config-ikev2-keyring-peer)#exit (config-ikev2-keyring)#exit (config)#crypto isakmp profile (conf-isa-prof)#match identity address (conf-isa-prof)#keyring (conf-isa-prof)#exit (config)#crypto ikev2 proposal (config-ikev2-proposal)#encryption 3des (config-ikev2-proposal)#integrity sha1 (config-ikev2-proposal)#group 2 (config-ikev2-proposal)#exit (config)#crypto ikev2 policy 10 (config-ikev2-policy)#proposal (config-ikev2-policy)#match address local (config-ikev2-policy)#exit (config)#crypto ikev2 profile (config-ikev2-profile)#identity local address (config-ikev2-profile)#match ident remote add (config-ikev2-profile)#authentication local pre-share (config-ikev2-profile)#authentication remote pre-share (config-ikev2-profile)#keyring local (config-ikev2-profile)#exit (config)#crypto map -Map 1 ipsec-isakmp (config-crypto-map)#set peer (config-crypto-map)#match add VPN-Traffic (config-crypto-map)#set transform-set 3des (config-crypto-map)#set ikev2-profile (config-crypto-map)#exit (config)#int gi0/0 crypto map -Map ip access-list extended VPN-Traffic (config-ext-nacl)# permit icmp host hos (config-ext-nacl)#exit crypto isakmp policy 10 (config-isakmp)# encr 3des (config-isakmp)# has sha (config-isakmp)# authentication pre-share (config-isakmp)#exit cry ipsec transform 3des esp-3des esp-sha-hmac (cfg-crypto-trans)# exit crypto keyring (conf-keyring)#pre-shared-key add key cisco (conf-keyring)#exit crypto ikev2 keyring (config-ikev2-keyring)# peer (config-ikev2-keyring-peer)#address (config-ikev2-keyring-peer)#pre-shared-key cisco (config-ikev2-keyring-peer)#exit (config-ikev2-keyring)#exit (config-isakmp)#crypto isakmp profile (conf-isa-prof)#keyring (conf-isa-prof)#match identity address (conf-isa-prof)#exit (conf-keyring)#crypto ikev2 proposal (config-ikev2-proposal)#encryption 3des (config-ikev2-proposal)#integrity sha1 (config-ikev2-proposal)#group 2 (config-ikev2-proposal)#exit crypto ikev2 policy 10 (config-ikev2-policy)#match address local (config-ikev2-policy)#proposal (config-ikev2-policy)#exit crypto ikev2 profile (config-ikev2-profile)#match ident remote add (config-ikev2-profile)#identity local address (config-ikev2-profile)#authentication remote pre-share (config-ikev2-profile)#authentication local pre-share (config-ikev2-profile)#keyring local (config-ikev2-profile)#exit crypto map -Map 1 ipsec-isakmp (config-crypto-map)#set peer (config-crypto-map)#set transform-set 3des (config-crypto-map)#set ikev2-profile (config-crypto-map)#match address VPN-Traffic (config-crypto-map)#exit int gi0/0 (config-if)#crypto map -Map (config-if)#

5 Easy VPN Client Client Crypto ipsec client ez EasyGroup Connect auto Group EasyGroup key cisco Mode client Peer Outside interface Int gi0/0 Crypto ipsec client ez <group> Inside Interface Int loop0 Crypto ipsec client ez <group> inside ISAKMP Policy Crypto isakmp policy 10 Encr 3des Hash sha Group 2 Auth pre-share Server Pool ip local pool EasyPool AAA aaa new-model aaa authoriz netw AuthZ-list local Group crypto isakmp client config group EasyGroup key cisco pool EasyPool Transform Set Crypto ipsec transform-set 3des esp-3des esp-sha-hmac ISAKMP profile crypto isakmp profile match identity group EasyGroup isakmp authoriz list AuthZ-list client config add respond client config group EasyGroup virtual-template 1 IPSec profile crypto ipsec profile set transform-set 3des set isakmp-profile Virtual-Template int virtual-templ 1 type tunnel ip unnum lo0 tun mo ipsec ipv4 tun protection ipsec profile

6 EasyVPN Configs (config)#crypto ipsec client ez EasyGroup (config-crypto-ezvpn)#connect auto (config-crypto-ezvpn)#group EasyGroup key cisco (config-crypto-ezvpn)#mode client (config-crypto-ezvpn)#peer (config-crypto-ezvpn)# (config-crypto-ezvpn)#exit (config)#int gi0/0 crypto ipsec client ez EasyGroup int lo0 crypto ipsec client ez EasyGroup inside crypto isakmp policy 10 (config-isakmp)#enc 3des (config-isakmp)#has sha (config-isakmp)#group 2 (config-isakmp)#auth pre (config-isakmp)#exit crypto ipsec transform-set 3des esp-3des esp-sha-hmac (cfg-crypto-trans)# (cfg-crypto-trans)#exit crypto isakmp profile (conf-isa-prof)#match identity group EasyGroup (conf-isa-prof)#isakmp authoriz list AuthZ-list (conf-isa-prof)#client config add respond (conf-isa-prof)#client config group EasyGroup (conf-isa-prof)#virtual-template 1 (conf-isa-prof)#exit crypto ipsec profile (ipsec-profile)#set transform-set 3des (ipsec-profile)#set isakmp-profile (ipsec-profile)#exit aaa new aaa authoriz netw AuthZ-list local ip local pool EasyPool crypto isakmp client config group EasyGroup (config-isakmp-group)#key cisco (config-isakmp-group)#pool EasyPool (config-isakmp-group)#exit int virtual-templ 1 type tunnel (config-if)#ip unnum lo0 (config-if)#tun mo ipsec ipv4 (config-if)#tun protection ipsec profile (config-if)#

7 DMVPN Client (config)#int tun 0 ip add no ip redirects ip nhrp authentication cisco ip nhrp map ip nhrp map multicast ip nhrp network-id 101 ip nhrp nhs tun so gi0/0 tun mode gre multipoint Hub int tun 0 (config-if)#ip nhrp map multicast dyn (config-if)#ip nhrp network-id 101 (config-if)#ip add (config-if)#ip nhrp authentication cisco (config-if)#tun sou gi0/0 (config-if)#tun mode gre multi (config-if)#ip nhrp shortcut (config-if)#ip nhrp redirect (config-if)#

8 Flex VPN Client Server Pool ip local pool FlexPool Access-list ip access-list standard Flex-Traffic permit IKEv2 Authorization policy crypto ikev2 authorization policy default route set interface IKEv2 Authorization Policy crypto ikev2 authorization policy default pool FlexPool route set access-list Flex-Traffic no route set interface IKEv2 Proposal crypto ikev2 proposal IKE-Prop encryption 3des integrity sha1 group 2 IKEv2 Policy crypto ikev2 policy IKE-Pol proposal IKE-Prop IKEv2 Keyring crypto ikev2 keyring peer address pre-shared-key cisco AAA aaa new-model aaa authorization network AuthZ-list local IKEv2 Keyring crypto ikev2 keyring peer address pre-shared-key cisco IKEv2 Profile crypto ikev2 profile authentication local pre-share authentication remote pre-share keyring local match identity remote address aaa authorization group psk list AuthZ-list default IKEv2 Profile crypto ikev2 profile match identity remote address keyring local authentication local pre-share authentication remote pre-share aaa authorization group psk list AuthZ-list default virtual-template 1 IPSec Transform-set crypto ipsec transform-set 3des esp-3des esp-sha-hmac mode tunnel IPSec Profile crypto ipsec profile set ikev2-profile set transform-set 3des IPSec Profile crypto ipsec profile set ikev2-profile set transform-set 3des Tunnel Interface int tunnel 0 ip add negotiated tun so gi0/0 tun mo ipsec ipv4 tun dest tunnel protection ipsec profile Virtual template int virtual-template 1 type tunne1 ip unnum gi0/0 tun so gi0/0 tun mo ipsec ipv4 tunn prot ipsec profile IKEv2 Client crypto ikev2 client flexvpn Flex-Client peer client connect tunnel 0

9 FlexVPN Configs (config)#aaa new-model (config)#aaa authorization network AuthZ-list local (config)#crypto ikev2 authorization policy default (config-ikev2-author-policy)#route set interface (config-ikev2-author-policy)#exit (config)#crypto ikev2 proposal (config-ikev2-proposal)#encryption 3des (config-ikev2-proposal)#integrity sha1 (config-ikev2-proposal)#group 2 (config-ikev2-proposal)#exit (config)#crypto ikev2 policy (config-ikev2-policy)#proposal (config-ikev2-policy)#exit (config)#crypto ikev2 keyring (config-ikev2-keyring)#peer (config-ikev2-keyring-peer)#address (config-ikev2-keyring-peer)#pre-shared-key cisco (config-ikev2-keyring-peer)#exit (config-ikev2-keyring)#exit (config)#crypto ikev2 profile (config-ikev2-profile)#authentication local pre-share (config-ikev2-profile)#authentication remote pre-share (config-ikev2-profile)#keyring local (config-ikev2-profile)#match identity remote address (config-ikev2-profile)#aaa authorization group psk list AuthZ-list default (config-ikev2-profile)#exit (config)#crypto ipsec transform-set 3des esp-3des esp-sha-hmac (cfg-crypto-trans)#exit (config)#crypto ipsec profile (ipsec-profile)#set ikev2-profile (ipsec-profile)#set transform-set 3des (ipsec-profile)#exit (config)#int tunnel 0 ip add negotiated tun so gi0/0 tun mo ipsec ipv4 tun dest tunnel protection ipsec profile exit (config)#crypto ikev2 client flexvpn Flex-Client (config-ikev2-flexvpn)#peer (config-ikev2-flexvpn)#client connect tunnel 0 (config-ikev2-flexvpn)#exit (config)# ip access-list standard Flex-Traffic (config-ext-nacl)#permit (config-ext-nacl)#exit aaa new-model aaa authorization network AuthZ-list local crypto ikev2 authorization policy default (config-ikev2-author-policy)#pool FlexPool (config-ikev2-author-policy)#route set access-list Flex-Traffic (config-ikev2-author-policy)#no route set interface (config-ikev2-author-policy)#exit crypto ikev2 proposal (config-ikev2-proposal)#encryption 3des (config-ikev2-proposal)#integ sha1 (config-ikev2-proposal)#group 2 (config-ikev2-proposal)#exit crypto ikev2 policy (config-ikev2-policy)#proposal (config-ikev2-policy)#exit crypto ikev2 keyring (config-ikev2-keyring)#peer (config-ikev2-keyring-peer)#address (config-ikev2-keyring-peer)#pre-shared-key cisco (config-ikev2-keyring-peer)#exit (config-ikev2-keyring)#exit crypto ikev2 profile (config-ikev2-profile)#match identity remote address (config-ikev2-profile)#keyring local (config-ikev2-profile)#authentication local pre-share (config-ikev2-profile)#authentication remote pre-share (config-ikev2-profile)#aaa authorization group psk list AuthZ-list default (config-ikev2-profile)#virtual-template 1 (config-ikev2-profile)#exit crypto ipsec transform-set 3des esp-3des esp-sha-hmac (cfg-crypto-trans)#exit crypto ipsec profile (ipsec-profile)#set transform-set 3des (ipsec-profile)#set ikev2-profile (ipsec-profile)#exit int virtual-template 1 type tunne1 (config-if)#ip unnum gi0/0 (config-if)#tun so gi0/0 (config-if)#tun mo ipsec ipv4 (config-if)#tunn prot ipsec profile (config-if)#exit ip local pool FlexPool

10 GET VPN Group Member Key Server ISAKMP Policy crypto isakmp policy 1 encr 3des auth pre-share group 2 ISAKMP Key crypto isakmp key cisco address ISAKMP Key crypto isakmp key cisco address Transform Set crypto ipsec transform-set 3des esp-3des esp-sha-hmac exit IPSec profile crypto ipsec profile set transform-set 3des RSA key crypto key generate rsa label GET-KEY mod 1024 exportable ACL access-list 101 permit ip GDOI Group crypto gdoi group GDOI-Group identity number 1 server address ipv Crypto Map crypto map CRY-Map 10 gdoi set group GDOI-Group GDOI Group crypto gdoi group GDOI-Group identity number 1 server local rekey retransmit 10 number 3 rekey authentication mypubkey rsa GET-KEY rekey transport unicast sa ipsec 1 profile match address ipv4 101 replay counter window-size 64 address ipv exit Interface int gi0/0 crypto map CRY-Map

11 GET VPN Configs (config)#crypto isakmp policy 1 (config-isakmp)#encr 3des (config-isakmp)#auth pre-share (config-isakmp)#group 2 (config-isakmp)#exit (config)# (config)#crypto isakmp key cisco address (config)# (config)#crypto gdoi group GDOI-Group (config-gkm-group)#identity number 1 (config-gkm-group)#server address ipv (config-gkm-group)#exit (config)# (config)#crypto map CRY-Map 10 gdoi % NOTE: This new crypto map will remain disabled until a valid group has been configured. (config-crypto-map)#set group GDOI-Group (config-crypto-map)#exit (config)# (config)#int gi0/0 crypto map CRY-Map %CRYPTO-6-GDOI_ON_OFF: GDOI is ON crypto isakmp policy 10 (config-isakmp)#encr 3des (config-isakmp)#auth pre-share (config-isakmp)#group 2 (config-isakmp)#exit crypto isakmp key cisco address crypto ipsec transform-set 3des esp-3des esp-sha-hmac (cfg-crypto-trans)#exit crypto ipsec profile (ipsec-profile)#set transform-set 3des (ipsec-profile)#exit crypto key generate rsa label GET-KEY mod 1024 exportable The name for the keys will be: GET-KEY % The key modulus size is 1024 bits % Generating 1024 bit RSA keys, keys will be exportable... [OK] (elapsed time was 1 seconds) %SSH-5-ENABLED: SSH 1.99 has been enabled crypto gdoi group GDOI-Group (config-gkm-group)#identity number 1 (config-gkm-group)#server local (gkm-local-server)#rekey retransmit 10 number 3 (gkm-local-server)#rekey authentication mypubkey rsa GET-KEY (gkm-local-server)#rekey transport unicast (gkm-local-server)# (gkm-local-server)#sa ipsec 1 (gkm-sa-ipsec)#profile (gkm-sa-ipsec)#match address ipv4 101 (gkm-sa-ipsec)#replay counter window-size 64 (gkm-sa-ipsec)#address ipv (gkm-local-server)#exit (config-gkm-group)#exit access-list 101 permit ip