VPN:
CIA: Combination of Confidentiality and Integrity and Authentication through securely transfer the data
1) CONFIDENTIALITY
ENCRYPTION
DES, 3DES (OLD VERSION)
AES -128, 192,256
2) INTEGRITY
HASHING
MD5 (IT IS THE OLD VERSION)
SHA 128, 256 (IT IS THE NEW VERSION)
3) AVAILABILITY
LIFETIME, SIZE
ALL THIS HAVE TO COMBAIN TO MAINTAIN A IPsec
IPsec are 2 types …> this is the phase 2
1) ISAKMP (Internet Security Association and Key Management Protocol)
It is a Phase 1
2) IKE (INTERNET KEY EXCHANGE)
Deffie-helman (DH-Group)
It is a phase 1
We have 2 phases
1) phase 1 … between the gateway (IPsec … like CIA) > I is a PRE
2) Phase 2 … protect the data … > it is a POST
IPsec VPN and SSl VPN
--
IPsec network is a overlay network
PHASE 1 WE HAVE (HAGEL)
PHASE 1 WE HAVE(HAGEL) PHASE 1 WE HAVE(HAGEL)
1) Hashing 1) Hashing
2) Authentication 2) Authentication
3) DH-Group 3) DH-Group
4) Encryption 4) Encryption
5) Life-time 5) Life-time
VPN Have 2 types
1) Site-to-Site (L2L, S2S)
2) Remote-VPN (RA-VPN, C-S-VPN)
VPN configuration
1) SOURCE
Create one object … (network-object [Link] [Link])
Object-group … (object-group network <abc-LOCAL>)
2) DESTINATION
3) Create one object … (network-object [Link] [Link])
Object-group … (object-group network <abc-REMOTE>)
1) Create ACL for interesting traffic/ encryption domain
Access-list <name-acl> permit ip object-group <abc-LOCAL> object-group <abc-REMOTE>
1) NAT (configure NO_NAT … > its mean it will NAT at same source to same source & same destination to
destination) its means NO PAT (no-proxy-ap route-lookup)
Nat (any, outside) source static <abc-LOCAl> <abc-LOCAL> destination static <abc-REMOTE> <abc-REMOTE> no-
proxy-arp route-lookup
Phase 1 create policy-set Encryption: aes-128, aes-256
Crypto ikev1 policy <phase1-name>
Authentication <pre-share> Hashing: sha128, sha256
Encryption <aes> DH_Group: 1, 4, 5, 7, 9 … etc.
Hash <sha>
Group <5> Authentication: pre-shared-key, certificate.
Lifetime <86400>
Lifetime: 86400 sec.
Phase 2 Encryption
Crypto IPsec ikev1 transform-set <AES256-SHA-NAME> esp-aes esp-sha-hmac
THIS IS OPTIONAL FOR IKEV2
BIND ALL TOGETHER
Crypto map VPN-MAP < phase1-name > match address <acl-name>
Crypto map VPN-MAP < phase1-name > set peer <IP>
Crypto map VPN-MAP < phase1-name > set ikev1 transform-set < AES256-SHA-NAME>
Crypto map VPN-MAP < phase1-name > set security-association lifetime seconds 86400 (LIFE-TIME)
Crypto map VPN-MAP < phase1-name > set pfs group5 (DH_GROUP) … > (Perfect Forward Secrecy)
Crypto ikev1 enable outside
Crypto ikev2 enable outside
Crypto map VPN-MAP interface outside
PHASE 2
Encryption (CONFIDENTIALITY)
Hashing (INTEGRITY)
DH_GROUP
LIFE-TIME
Tunnel-group <PEER_IP> type ipsec-l2l
Tunnel-group <PEER-IP> IPsec-attributes
ASA1 (config-IPsec-attributes) # ikev1 pre-shared-key <MySecretKey123>
Exit
IN-FIREWALL:
CONF T: Interface Ethernet 0/1 Interface Ethernet 0/2
Interface Ethernet 0/0 No shutdown No shutdown
No shutdown nameif inside nameif DMZ
nameif outside security-level 100 security-level 100
security-level 0 ip address [Link] ip address [Link] [Link]
ip address [Link] [Link] [Link] no shutdown
no shutdown no shutdown
1) ACL
Access-list <acl-in> extended deny ip any any
Access-group <acl-out> in interface outside
Access-group <acl-in> in interface inside
Access-group <acl-dmz> in interface DMZ
2) Route outside [Link] [Link] [Link]
TROUBLESHOOTING:
1) The tunnel-group UP or NOT
Show crypto isakmp sa
2) Check the PHASE 2 State
show crypto ipsec sa
3)
1) Show run object-group id <object-group-name>
2) Show run access-list <acl-name>
3) Show run nat (NAT)
4) Show run crypto ikev1(phase 1)
5) Show run crypto ipsec (to see phase 2 running config)
6) Show run crypto map (to see crypto map)
7) Show run tunnel-group (to check the tunnel group)
8) More system:running-config |b tunnel-group (to check the pre-shared-key)
Packet-tracer input inside tcp [Link] 1234 [Link] 80
Show vpn-sessiondb type l2l
Show vpn-sessiondb detail l2l
In privilege mode ( When the tunnel is hang )
Vpn-sessiondb logoff name <peer-ip>
PHASE 1: GATEWAY COMMUNICATE BOTH FIREWALLS TRUST WITH EACH OTHER. (ISAKMP)
PHASE 2: COMMUNICATE PC TO PC FROM ONE ZONE TO ANOTHER ZONE And TRANSFORM THE DATA. (IPSEC)
IKE:
THOSE KEY ARE GENERATING FROM DH-GROUP
Encryption from AES
Decryption from SHA
1) IKEV1 has 6 messages.
1 message initiator proposal FW_G1 to FW_G2 (PROPOSAL STANDS COMBINATION OF HAGEL)
2 messages receiver accept the all proposal and pick it one proposal and accept them
3 message initiator generate the key
4 message receiver can accept the key.