® CISCO VPN CONFIGURATION GUIDE PRACTICAL CISCO VPN CONFIGURATION TUTORIALS Your one-stop Information Resource For Configuring Cisco VPN Technologies on Routers and ASA Firewalls WRITTEN BY: HARRIS ANDREA MSc Electrical Engineering and Computer Science Cisco Certified Network Associate (CCNA) Cisco Certified Network Professional (CCNP) Cisco Certified Security Professional (CCSP) Certified Ethical Hacker (CEH) EC-Council Certified Security Analyst (ECSA) http://www.networkstraining.com 1 Enjoy Legal Notice: © 2014, Harris Andrea. All rights reserved. Email: Table of Contents: Chapter 1 Introduction to VPN Technologies .................................................................................... 8 1.1 Policy-Based Vs Route-Based VPN . ............................................................................................................... 9 1.2 Policy-Based VPN (Traditional IPSEC VPN) . ........................................................................................... 11 1.2.1 What is IPSEC .............................................................................................................................................. 11 1.2.2 How IPSEC Works ..................................................................................................................................... 13 1.2.3 Site-to-Site and Hub-and-Spoke IPSEC VPN . ................................................................................. 13 1.2.4 Remote Access IPSEC VPN . ................................................................................................................... 15 1.3 Route-Based VPN ................................................................................................................................................ 16 1.3.1 VPN using GRE ............................................................................................................................................ 16 1.3.1.1 GRE Vs IPSEC .......................................................................................................................................... 17 1.3.2 VPN using Virtual Tunnel Interface (VTI) . ..................................................................................... 19 1.3.2.1 Static VTI .................................................................................................................................................. 20 1.3.2.2 Dynamic VTI ............................................................................................................................................ 21 1.4 Dynamic Multipoint VPN (DMVPN) . ........................................................................................................... 23 1.5 SSL Based VPNs (WebVPN) . ........................................................................................................................... 26 1.5.1 Types of SSL Based VPNs. ...................................................................................................................... 26 1.5.2 Comparison between SSL VPN Technologies . .............................................................................. 26 1.5.3 Overview of AnyConnect VPN operation: . ...................................................................................... 27 1.6 Practical Applications for each VPN Type . ............................................................................................... 29 1.6.1 Policy-Based (Traditional IPSEC) VPN Applications . ................................................................ 29 1.6.2 Route-Based GRE VPN Applications . ................................................................................................ 30 1.6.3 Route-Based VTI VPN Applications. .................................................................................................. 31 1.6.4 Dynamic Multipoint VPN Applications . ........................................................................................... 31 Chapter 2 VPN Configuration on Cisco Routers . ........................................................................... 33 2.1 Policy-Based VPN Configuration on Cisco Routers . ............................................................................. 33 2.1.1 Site-to-Site IPSEC VPN . ........................................................................................................................... 33 2.1.1.1 Site-to-Site IPSEC VPN with Dynamic IP . ................................................................................... 42 2.1.2 Hub-and-Spoke IPSEC VPN . .................................................................................................................. 44 2.1.3 Remote Access IPSEC VPN . ................................................................................................................... 47 3 Enjoy 2.1.4 Site-to-Site and Remote Access IPSEC VPN on same device . .................................................. 53 2.2 Route-Based VPN Configuration on Cisco Routers . ............................................................................. 59 2.2.1 Site-to-Site VPN Using GRE with IPSEC Protection . ................................................................... 59 2.2.2 Hub-and-Spoke VPN Using GRE with IPSEC Protection . .......................................................... 63 2.2.3 VPN Using Static Virtual Tunnel Interface (SVTI) . ...................................................................... 68 2.2.4 VPN Using Dynamic Virtual Tunnel Interface (DVTI) . .............................................................. 69 2.3 Dynamic Multipoint VPN (DMVPN) . ........................................................................................................... 76 2.4 PPTP VPN ............................................................................................................................................................... 83 Chapter 3 VPN Configuration on ASA Firewalls . ........................................................................... 87 3.1 Policy-Based VPN Configuration on Cisco ASA . ..................................................................................... 87 3.1.1 Site-to-Site IPSEC VPN . ........................................................................................................................... 87 3.1.1.1 Restricting IPSEC VPN Traffic between the Two Sites . ........................................................ 94 3.1.2 Hub-and-Spoke IPSEC VPN with Dynamic IP Spoke . ................................................................. 96 3.1.2.1 Spoke to Spoke Communication via the Hub ASA . ................................................................. 99 3.1.3 IPSEC VPN between Cisco ASA and Cisco Router . ................................................................... 102 3.1.4 Remote Access IPSEC VPN . ................................................................................................................ 106 3.1.5 Hub-and-Spoke and Remote Access VPN on same device . ................................................... 111 3.1.5.1 Enable Remote Users to Access Spoke Sites through the Hub ....................................... 115 3.1.6 Site-to-Site IPSEC VPN with failover using backup ISP . ........................................................ 117 3.1.7 Site-to-Site IPSEC VPN with Duplicate Subnets –Example1 . ............................................... 123 3.1.8 Site-to-Site IPSEC VPN with Duplicate Subnets –Example2 . ............................................... 127 3.1.9 Site-to-Site IKEv2 IPSEC VPN . .......................................................................................................... 131 3.2 SSL-Based VPN Configuration on Cisco ASA . ....................................................................................... 139 3.2.1 Anyconnect SSL Web VPN. ................................................................................................................. 139 3.3 VPN Authentication using External Server . ......................................................................................... 149 3.3.1 VPN Authentication using Microsoft Active Directory. .......................................................... 149 3.3.2 VPN Authentication using RADIUS or TACACS . ........................................................................ 152 3.3.3 VPN Authentication using RSA . ....................................................................................................... 154 Chapter 4 Complete Configuration Examples . ............................................................................ 156 4.1 Complete VPN Configurations on Cisco Routers . ............................................................................... 156 4.1.1 Site-to-Site IPSEC VPN . ........................................................................................................................ 156 4 Enjoy 4.1.2 Site-to-Site IPSEC VPN with Dynamic IP . ..................................................................................... 160 4.1.3 Hub-and-Spoke IPSEC VPN – Static IP Spokes . .......................................................................... 164 4.1.4 Hub-and-Spoke IPSEC VPN – Dynamic IP Spoke . ..................................................................... 170 4.1.5 Remote Access IPSEC VPN . ................................................................................................................ 173 4.1.6 Site-to-Site and Remote Access IPSEC VPN on same device . ............................................... 176 4.1.7 Site-to-Site VPN using GRE with IPSEC Protection . ................................................................. 184 4.1.8 Hub-and-Spoke VPN using GRE with IPSEC Protection. ........................................................ 188 4.1.9 Hub-and-Spoke VPN using DVTI and SVTI. ................................................................................. 195 4.1.10 Dynamic Multipoint VPN (DMVPN) . .............................................................................................. 202 4.1.11 Point to Point Tunelling Protocol (PPTP) . ................................................................................... 209 4.2 Complete VPN Configurations on Cisco ASA . ....................................................................................... 211 4.2.1 Site-to-Site IPSEC VPN . ........................................................................................................................ 211 4.2.2 Hub-and-Spoke IPSEC VPN with Dynamic IP Spoke . .............................................................. 216 4.2.3 IPSEC VPN Between Cisco ASA and Cisco Router . ................................................................... 223 4.2.4 Remote Access IPSEC VPN on Cisco ASA . .................................................................................... 228 4.2.5 Hub-and-Spoke and Remote Access VPN on same device . ................................................... 231 4.2.6 Site-to-Site IPSEC VPN with failover using backup ISP . ......................................................... 239 4.2.7 Site-to-Site IPSEC VPN with Duplicate Subnets-Example1 . ................................................. 245 4.2.8 Site-to-Site IPSEC VPN with Duplicate Subnets-Example2 . ................................................. 250 4.2.9 Anyconnect SSL Web VPN . ................................................................................................................. 255 5 Enjoy About the Author: Harris Andrea is a Senior Network Security Engineer working for a leading Internet Service Provider in Europe. He graduated from the University of Kansas USA in 1998 with a B.S and M.S degrees in Electrical Engineering and Computer Science. Since then, he has been working in the Networking field, designing, implementing and managing large scale networking projects with Cisco products and technologies. His main focus is on Network Security based on Cisco ASA Firewalls, VPN technologies, IDS/IPS products, AAA services, IOS Security Features etc. To support his knowledge and to build a strong professional standing, Harris pursued and earned several Cisco Certifications such as CCNA, CCNP, CCSP and other security related certifications such as CEH and ECSA. He is also a technology blogger owing a networking blog about Cisco technologies which you can visit for extra technical information and tutorials. http://www.networkstraining.com 6 Enjoy Introduction: Thank you for purchasing this technical Book about configuring Cisco VPN Technologies. Virtual Private Networks constitute a hot topic in networking because they provide low cost and secure communications while improving productivity by extending corporate networks to remote locations. The two major Cisco networking devices that support VPNs are Cisco Routers and Cisco ASA Firewalls. That’s why this book focuses on VPN implementations using these two device types. I remember building my first site-to-site IPSEC VPN back in 2000 using two Cisco PIX 501 firewalls. I was impressed when communication was established between two private LAN networks over the Internet. Since then, I have designed, configured and managed hundreds of VPN implementations using Cisco Routers and PIX/ASA firewalls. This Book therefore is the result of my working experience with Cisco VPN technology for more than a decade. I have tried to include the most important and commonly found VPN topologies that you will find in real world networks. Also, I have included several scenarios which are somewhat infrequent or unusual to encounter and they are also a little bit difficult to configure. These include VPN Failover using Backup ISP, site-to-site VPN with duplicate subnets, VPN Hairpinning, Active Directory authentication, DMVPN etc. Virtual Private Networks are based on complex protocols and algorithms. The intention of this book is not to delve into the theory and details of VPNs but rather to provide practical and step-by-step configuration instructions. Nevertheless, some required basic theory, applications and comparisons of the various VPN types are included in the book. Overall, I believe that this book is probably the most updated and comprehensive resource on Cisco VPNs out there and I firmly believe it will be valuable for Cisco networking professionals. If you are interested in my other book “Cisco ASA Firewall Fundamentals-3rd Edition”, you can find more information about it here: http://www.networkstraining.com/ciscoasaebook.php For any questions that you may have or clarifications about the information presented in this Book, please contact me at: Chapter 1 Introduction to VPN Technologies The intention of this book is to be a practical configuration guide of the major VPN technologies supported by Cisco, thus I will not cover all the theory and details behind Virtual Private Networks. However, an introductory description of the various VPN types that we will be using throughout this book is essential. Specifically, I will briefly discuss some theory and practical applications of Policy-Based VPNs (traditional IPSEC VPNs), Route-Based VPNs (GRE VPNs and VPNs based on Virtual Tunnel Interface-VTI), SSL Web VPNs, and finally Dynamic Multipoint VPNs (DMVPN). In the next Chapters we will go into the actual practical configuration details of the various VPN types. The diagram below illustrates the four general VPN categories that we will be using in this book. 8 Enjoy 1.1 Policy-Based Vs Route-Based VPN Two important VPN categories supported by Cisco are the first two shown on figure above. These are Policy-Based and Route-Based VPNs. In my opinion it’s important to describe the main differences between these two VPN types. Knowing the differences will help professionals choose the right VPN type for their company or customers. Both of these VPN categories make use of the IPSEC protocol (we will describe it later) which is the de facto standard for creating secure VPN networks. Let’s see a brief description of them below:  Policy-Based IPSEC VPN: This is the traditional IPSEC VPN type which is still widely used today. This VPN category is supported on both Cisco ASA Firewalls and Cisco Routers. With this VPN type, the device encrypts and encapsulates a subset of traffic flowing through an interface according to a defined policy (using an Access Control List). The IPSEC protocol is used for tunneling and for securing the communication flow. Most of the discussion on IPSEC in this book is based on the legacy IKEv1 IPSEC, although there is a small section about the new IKEv2 IPSEC as well.  Route-Based VPN: A route-based VPN configuration employs Layer3 routed tunnel interfaces as the endpoints of the virtual network. All traffic passing through a special Layer3 tunnel interface is placed into the VPN. Rather than relying on an explicit policy to dictate which traffic enters the VPN, static or dynamic IP routes are configured to direct the desired traffic through the VPN tunnel interface. This configuration method is supported only on Cisco Routers and is based on GRE or VTI Tunnel Interfaces as we will see later. For secure communication, Route-Based VPNs use also the IPSEC protocol on top of the GRE or VTI tunnel to encrypt everything. 9 Enjoy The Table below shows the main differences between Policy-Based and Route-Based VPNs: Policy-Based IPSEC VPN Route-Based VPN (Traditional IPSEC) (GRE and VTI) Supported on most network devices (Cisco Supported only on Cisco IOS Routers. Very Routers, Cisco ASA, other vendors etc) Limited interoperability with other vendors. Does not support multicast or non-IP protocols Supports multicast (GRE and VTI) and non-IP protocols (GRE) Routing Protocols (e.g OSPF, EIGRP) cannot pass Routing Protocols (e.g OSPF, EIGRP) can pass through the VPN tunnel through the VPN tunnel. Use an access list to select which traffic is going All traffic passing through a special Tunnel to be encrypted and placed in VPN tunnel. Interface will be encapsulated and placed in the VPN. Strong Security natively GRE or VTI alone do not provide security. You must combine them with IPSEC for securing the VPN. Complex Configuration Simplified Configuration Limited QoS. QoS is fully supported. 10 Enjoy