IPsec over a GRE tunnel

Cisco VPN (ISAKMP + IPSec)

Yesterday I have found a great channel on youtube: CBTvideochannel. There are a lot of video about Cisco CCNA espetially about security.
Youtube playlist: http://www.youtube.com/playlist?list=PL6ED021B0FA97EFB1
CBT Nuggets official website: http://www.cbtnuggets.com/

Here is a checklist to make Site-to-Site VPN using IPSec (c) CBTNuggets:

Creating Site‐to‐Site VPNs with Pre‐Shared Keys 

Documentation: 

1. Document your IKE Phase 1 negotiation criteria (example below)
• Hashing: SHA‐1
• Authentication: pre‐shared
• Key exchange: Diffie‐Hellman Group 2

2. Document your IPSec (IKE Phase 2) negotiation criteria (example below)
• Encryption algorithm: esp‐aes 128
• Authentication: esp‐sha‐hmac

Configuring IKE Phase 1: 

1. Enable ISAKMP
• Router(config)#crypto isakmp enable

2. Create ISAKMP Policy :
• Router(config)#crypto isakmp policy <1-10000>
• Router(config)#crypto isakmp policy 100
• Router(config-isakmp)#encryption aes 128
• Router(config-isakmp)#authentication pre-share
• Router(config-isakmp)#group 2
• Router(config-isakmp)#hash sha
• Router(config-isakmp)#exit

3. Configure ISAKMP Identity:
• Router(config)#crypto isakmp identity <address/hostname>
• Router(config)#crypto isakmp identity address

4. Configure ISAKMP Key:
• Router(config)#crypto isakmp key 0 <Pre-Shared-Key> address <remote IP address>
• Router(config)#crypto isakmp key 0 SUPERSECRETKEY address

Configuring IKE Phase 2: 

1. Create transform sets:
• Router(config)#crypto ipsec transform-set <name> <methods>
• Router(config)#crypto ipsec transform-set SET-NAME esp-aes 128 esp-sha-hmac
• Router(cfg-crypto-trans)#mode tunnel
• Router(cfg-crypto-trans)#exit

2. (optional) Configure IPSec lifetime :
• Router(config)#crypto ipsec security-association lifetime <seconds/kilobytes> <value>
• Router(config)#crypto ipsec security-association lifetime seconds 86400

3. Create mirrored ACLs defining traffic to be encrypted and the traffic expected to be received
encrypted.
• Router(config)#ip access-list extended <name>, Router(config)#permit ip <source network | wildcard> <destination network | wildcard>
• Router(config)#ip access-list extended S2S-VPN-TRAFFIC
• Router(config-ext-nacl)#permit ip 172.30.2.0 0.0.0.255 192.168.1.0 0.0.0.255
• Router(config-ext-nacl)#exit

4. Set up IPSec crypto‐map : Router(config)#crypto map <name> <seq> ipsec-iskmp
• Router(config)#crypto map S2S-VPN 100 ipsec-isakmp
   o Router(config-crypto-map)#match address S2S-VPN-TRAFFIC
   o Router(config-crypto-map)#set peer 1.1.1.2 <remote IP>
   o Router(config-crypto-map)#set pfs group2 <group1/2/5 optional>
   o Router(config-crypto-map)#set transform-set SET-NAME <set>

Apply to Interface: 

1. Apply crypto‐map to interface
• Router(config)#int fa4
• Router(config-int)#crypto map S2S-VPN

Create Interesting Traffic: 

1. Ping from source network to destination network.
Verify:
2. Show and debug commands (QM_IDLE is good)
• Router#show crypto isakmp sa
• Router#show crypto ipsec sa
• Router#debug crypto isakmp
• Router#debug crypto ipsec
• Router#show crypto map
• Router#show crypto isakmp policy
• Router#show crypto ipsec transform-set
• Router#clear crypto sa