IPsec VPN High Availability with HSRP - CCIE Blog

IPsec VPN High Availability with HSRP - CCIE Blog

Designing Site-to-Site IPsec VPNs (NIL IP Corner)

Designing Site-to-Site IPsec VPNs

Router-to-Router IPSec (RSA Keys) on GRE Tunnel with RIP Configuration Example / Cisco Systems

Router-to-Router IPSec (RSA Keys) on GRE Tunnel with RIP Configuration Example [IPSec Negotiation/IKE Protocols] - Cisco Systems
This document provides a sample configuration for routers with RSA keys. Both routers are configured for RSA keys and IPSec/Generic Routing Encapsulation (GRE) tunnel with Routing Information Protocol (RIP).




Router 101

Building configuration...

Current configuration : 1486 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 101
!
!
clock timezone PST -8
ip subnet-zero
ip domain name cisco.com
ip host 102.cisco.com 20.1.1.2
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 1
 authentication rsa-encr
crypto isakmp identity hostname
crypto isakmp keepalive 20 5
!
!
crypto ipsec transform-set test esp-des esp-sha-hmac
 mode transport
!
crypto map test 10 ipsec-isakmp
 set peer 20.1.1.2
 set transform-set test
 match address 101
!
!
crypto key pubkey-chain rsa
 named-key 102.cisco.com
  key-string
   305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00DB4FEB EF0C0D3D
   72FC5BD3 29C8E94B 726161BC F1AF337C E5F2D11D FBFC2245 95EA2AB7 9D09156C
   08A5A7CD 36E43D94 F1E3C978 37A79379 384D2A72 CE575E91 3F020301 0001
  quit
 !
 !
 !
 interface Loopback1
 ip address 192.168.1.1 255.255.255.0
!
interface Tunnel0
 ip address 10.10.10.1 255.255.255.252
 ip mtu 1420
 tunnel source Ethernet1/0
 tunnel destination 20.1.1.2
 crypto map test
!
interface Ethernet0/0
 ip address 1.1.1.1 255.255.255.0
!
interface Ethernet1/0
 ip address 20.1.1.1 255.255.255.0
 crypto map test
!
interface Serial2/0
 no ip address
 shutdown
!
interface Serial3/0
 no ip address
 shutdown
!
router rip
 version 2
 passive-interface Ethernet1/0
 network 10.0.0.0
 network 192.168.1.0
!
ip classless
no ip http server
!
!
access-list 101 permit gre host 20.1.1.1 host 20.1.1.2
!
!
line con 0
line aux 0
line vty 0 4
 login
!
end

101#

Router 102

102#write terminal
Building configuration...

Current configuration : 1484 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 102
!
!
clock timezone PST -8
ip subnet-zero
ip domain name cisco.com
ip host 101.cisco.com 20.1.1.1
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 1
 authentication rsa-encr
crypto isakmp identity hostname
crypto isakmp keepalive 20 5
!
!
crypto ipsec transform-set test esp-des esp-sha-hmac
 mode transport
!
crypto map test 10 ipsec-isakmp
 set peer 20.1.1.1
 set transform-set test
 match address 101
!
!
crypto key pubkey-chain rsa
 named-key 101.cisco.com
  address 20.1.1.1
  key-string
   305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A7D24F E6E15787
   5EE1434A A76A3DC1 ADE96A4D C6B4D0F3 A7DDAD10 446EF83A 89D1115F 0C517118
   ECAF418E F4C84823 2A017B97 F85690EF EBCF3414 AB3E81F6 A5020301 0001
  quit
 !
 !
 !
 interface Loopback1
 ip address 172.16.1.1 255.255.255.0
!
interface Tunnel0
 ip address 10.10.10.2 255.255.255.252
 ip mtu 1420
 tunnel source Ethernet0/0
 tunnel destination 20.1.1.1
 crypto map test
!
interface Ethernet0/0
 ip address 20.1.1.2 255.255.255.0
 crypto map test
!
interface Ethernet1/0
 no ip address
!
interface Serial2/0
 no ip address
 shutdown
!
interface Serial3/0
 no ip address
 shutdown
!
router rip
 version 2
 passive-interface Ethernet0/0
 network 10.0.0.0
 network 172.16.0.0
!
ip classless
no ip http server
!
!
access-list 101 permit gre host 20.1.1.2 host 20.1.1.1
!
!
line con 0
line aux 0
line vty 0 4
 login
!
end

102#

Related Information:
IPSec Support Page

IPSec Tunnel End-Point Discovery - TED

Configuring IPSec Tunnel End-Point Discovery (Cisco Systems)

!--- Defines a dynamic crypto map to use for establishing IPsec SAs.

crypto dynamic-map ted-map 10
 set transform-set ted-transforms
 match address 101
!
!

!--- The 'discover' keyword used with the dynamic crypto map
!--- enables peer discovery.

crypto map tedtag 10 ipsec-isakmp dynamic ted-map discover
!

Tunnel End-Point Discovery (TED) is a Cisco IOS Software feature which allows routers to automatically discover IP Security (IPsec) endpoints. The deployment of IPsec with Internet Key Exchange (IKE) requires the configuration of a crypto map for every peer which identifies the endpoint to which a secure tunnel is to be established. This approach does not scale well when there are many peers to which tunnels are to be established. Dynamic crypto maps simplify such a scenario by automatically determining the IPsec peer. This only works on routers that receive IKE requests. TED allows routers that initiate and receive IKE requests to dynamically discover the IPsec tunnel endpoint.
TED uses a discovery probe which is a special IKE packet sent from the initiating peer towards the destination network or host that the original traffic was destined to. Since TED probes use the addresses of the protected entities, the addresses must be globally routable. TED does not work if Network Address Translation (NAT) is involved.

Downloads:
Configuring IPSec Tunnel End-Point Discovery (pdf)

Stateful Failover for IPSec / SSO

Stateful Failover for IPSec (Cisco Systems)
Stateful failover for IP Security (IPSec) enables a router to continue processing and forwarding IPSec packets after a planned or unplanned outage occurs. Customers employ a backup (secondary) router that automatically takes over the tasks of the active (primary) router if the active router loses connectivity for any reason. This process is transparent to the user and does not require adjustment or reconfiguration of any remote peer.

Stateful failover for IPSec is designed to work in conjunction with stateful switchover (SSO) and Hot Standby Routing Protocol (HSRP).
HSRP provides network redundancy for IP networks, ensuring that user traffic immediately and transparently recovers from failures in network edge devices or access circuits. That is, HSRP monitors both the inside and outside interfaces so that if either interface goes down, the whole router is deemed to be down and ownership of Internet Key Exchange (IKE) and IPSec security associations (SAs) is passed to the standby router (which transitions to the HSRP active state).
SSO allows the active and standby routers to share IKE and IPSec state information so that each router has enough information to become the active router at any time. To configure stateful failover for IPSec, a network administrator should enable HSRP, assign a virtual IP address, and enable the SSO protocol.


Downloads:
Stateful Failover for IPSec (pdf)

IPSec Virtual Tunnel Interface - VTI

IPSec Virtual Tunnel Interface (Cisco Systems)
IP security (IPsec) virtual tunnel interfaces (VTIs) provide a routable interface type for terminating IPsec tunnels and an easy way to define protection between sites to form an overlay network. IPsec VTIs simplify configuration of IPsec for protection of remote links, support multicast, and simplify network management and load balancing.


Downloads:
IPSec Virtual Tunnel Interface (pdf)

Network Access Protection (NAP) and IPsec Enforcement on Windows Server 2008 (Microsoft)

Demonstrate NAP IPsec Enforcement in a Test Lab (Microsoft)
Test lab to demonstrate NAP IPsec enforcement

NAPIPsec_StepByStep.doc, 2/29/2008, Version 2.2

Overview
Network Access Protection (NAP) is a new policy enforcement technology in the Windows Vista operating system and Windows Server 2008 operating system. NAP provides components and an application programming interface (API) set that help administrators enforce compliance with health requirements for network access and communication. This paper contains an introduction to NAP and instructions for setting up a test lab to deploy NAP with the Internet Protocol security (IPsec) enforcement method.

related resources @ Microsoft
Microsoft Network Access Protection Web page
Network Access Protection: Frequently Asked Questions
Introduction to Network Access Protection white paper