IPSec VPN Lab

Student Name _________________________________ Date _____________

SEC450 IPSec VPN iLab

Objectives

In this lab, the students will examine the following objectives.

· Using device configuration files to add VPN commands to routers

· Learn various encryption parameters available to configure IPSec VPN

Scenario

A small company is using the topology shown below. It is necessary to secure all TCP traffic between Dallas and Chicago using an IPSec VPN across the Internet. The VPN should be testing to validate compliance with the company security policy.

Topology

The last page of the Lab Assignment document contains a full-page topology. Remove this page and use it for reference to the topology and the IP addresses.

Initial OpNet Modeler Preparation

The Week 6 iLab is entitled IPSec VPN. The following steps show how to create the project required for the Week 6 iLab.

· Log into the Citrix iLab Environment (lab.devry.edu).

· Click on the OpNet Modeler 175 icon.

· Click the Accept button to Open OpNet Modeler 175.

· Click File/Open and navigate to the F:\op_models\SEC450\SEC450.project\SEC450 file and click Open.

You are now ready to begin the IPSec VPN iLab with a project called IPSecVPN.

Initial Configuration

The Dallas and Chicago Router’s FastEthernet and Serial interfaces used for the lab have been correctly configured and enabled. Unused interfaces have been shutdown. The RIP routing tables are complete for all Routers and Hosts. No ACLs have been applied to any of the routers. Below are the initial configurations in Dallas and Chicago routers.

11

Revision Date: MAY14

Dallas Router

version 12.3(4)T7

!

hostname Dallas

!

no crypto isakmp enable

!

!

interface FastEthernet0/0

ip address 192.168.100.1 255.255.255.0

!

interface FastEthernet0/1

ip address 192.168.10.1 255.255.255.0

shutdown

!

interface Serial0/0

bandwidth 1544

ip address 192.168.30.1 255.255.255.0

shutdown

!

interface Serial0/1

bandwidth 1544

ip address 200.100.10.2 255.255.255.0

!

router rip

network 192.168.100.0

network 200.100.10.0

!

ip default-network 200.100.10.0

ip route 0.0.0.0 0.0.0.0 serial0/1

!

!

line con 0

line aux 0

line vty 0 4

password cisco

line vty 5 15

password cisco

!

end

Chicago Router

version 12.3(4)T7

!

hostname Chicago

!

no crypto isakmp enable

!

!

interface FastEthernet0/0

ip address 192.168.200.1 255.255.255.0

!

interface FastEthernet0/1

ip address 192.168.20.1 255.255.255.0

shutdown

!

interface Serial0/0

ip address 200.100.20.2 255.255.255.0

!

interface Serial0/1

ip address 192.168.30.2 255.255.255.0

shutdown

!

router rip

network 192.168.200.0

network 200.100.20.0

!

ip default-network 200.100.20.0

ip route 0.0.0.0 0.0.0.0 serial0/0

!

!

line con 0

line aux 0

line vty 0 4

password cisco

line vty 5 15

password cisco

!

end

Lab Data Collection and Submission

Open SEC450_W6_IPSecVPN_Report and enter your name and date at the top of the lab document. As you complete each task of the lab assignment, answer the questions into the lab report document. You will submit the completed SEC450_W6_IPSecVPN_Report.docx file into the week’s eCollege iLab Dropbox.

Note: RED text indicates the required questions to answer

Command Summary	Description
Authentication {rsa-sig |rsa-encr | pre-share}	Specify the authentication method within an IKE policy.
Crypto ipsec transform-set transform-set-name transform1 [ transform2[ transform3]]	Define a transform set, which is an acceptable combination of security protocols and algorithms, and enters crypto transform configuration mode.
Crypto isakmp enable	Enables IKE/ISAKMP on the router.
Crypto isakmp key key address address	Sets up the pre-shared key and peer address.
Crypto isakmp policy priority	Define an IKE policy, and enters ISAKMP policy configuration mode.

Crypto map map name	Apply a previously defined crypto map set to an interface.
Crypto map map-name seq-num ipsec-isakmp	Create or modifies a dynamic crypto map entry, and enters the crypto map configuration mode.
hash {sha | md5}	Specify the hash algorithm within an IKE policy.
Match address access-list number	Specify an extended access list for a crypto map entry.
mode [tunnel | transport]	Specify the mode for the transform set.

Task 1—Configure a Site-to-Site IPSec VPN on the Dallas Router

· We will need to edit the Dallas configuration file to enter the commands required to establish an IPSec VPN on the Dallas Router. Right click on the Dallas Router and select Post Import Operations/View Collected Output Files. This action will open the Dallas configuration file in the Edit Pad text editor.

· Move the cursor to line that displays no crypto iskmp enable. Delete the no in front of the line, then move the cursor to the end of the line and press <enter>. The crypto isakmp enable allows routers to exchange IPSec VPN keys and policy information. On the blank line where the cursor is, begin typing the commands shown on the next page required to implement a site-to-site IPSec VPN from the Dallas Router to the Chicago Router.

· We will need to edit the Dallas configuration file to enter the commands required to establish an IPSec VPN on the Dallas Router.

· Move the cursor to line that displays no crypto iskmp enable. Delete the no in front of the line, then move the cursor to the end of the line and press <enter>. The crypto isakmp enable allows routers to exchange IPSec VPN keys and policy information. On the blank line where the cursor is, begin typing the commands shown on the next page required to implement a site-to-site IPSec VPN from the Dallas Router to the Chicago Router.

Configure Dallas Router IKE (ISAKMP) Policies

· Set the policy priority to 110 and enter ISAKMP configuration mode.

crypto isakmp policy 110

#1. Which IKE (isakmp) policy would have the highest priority—100 or 200?

· Set authentication to use pre-shared keys.

authentication pre-share

#2. What authentication options are available?

· Set IKE encryption to DES.

encryption des

#3. What encryption options are available?

· Set the Diffie-Hellman group to 1.

group 1

#4. What are the Diffie-Hellman group options available on most IOS Firewall routers?

· Set the hash algorithm to MD5.

hash md5

#5. What are the common hash algorithm options?

· Set the IKE security association (SA) lifetime to 12 hours and exit isakmp configuration mode.

lifetime 43200

exit

· Set up the pre-shared key to cisco1234 and peer address to 200.100.20.2.

crypto isakmp key cisco1234 address 200.100.20.2

Configure Dallas Router IPSec Parameters

· Define a transform set. Use the following parameters.

1. Transform name: TSet

2. ESP protocols: des

3. Replay prevention: md5

4. Mode: tunnel

crypto ipsec transform-set TSet esp-des esp-md5-hmac

· Set the mode to tunnel.

mode tunnel

exit

Create an IPSec/ISAKMP Crypto Map

· Configure ACL # 102 that will permit all TCP traffic. This ACL will be used to specify what traffic will be encrypted through the VPN Tunnel.

access-list 102 permit tcp any any

· Create a crypto map named CMap with the map number 10. Use the key exchange method ipsec-isakmp.

crypto map CMap 10 ipsec-isakmp

· Use ACL # 102 to determine what traffic that will be encrypted.

match address 102

· Use the transform set mine to specify the IPSec/IKE parameters.

set transform-set TSet

· Assign the VPN peer using the IP address of the remote router’s outside interface.

set peer 200.100.20.2

exit

· Apply the crypto map to the outside interface (S0/1) of the Dallas Router.

interface s0/1

crypto map CMap

exit Dallas configuration file should look like this after entering the commands.

· After you have completed typing in the Dallas IPSec configuration commands, highlight the commands you typed in using your mouse (click and drag) or the keyboard (<Shift> + Arrow keys) use <Ctrl>A to select all of the commands in the Dallas configuration file. Use <Ctrl>C to put the commands in the clipboard. Use <Ctrl>V to paste these commands into the table cell provided in the Lab Report document.

Task 2—Configure a Site-to-Site IPSec VPN on the Chicago Router

· We will now need to edit the Chicago configuration file to enter the commands required to establish an IPSec VPN on the Chicago Router. Right click on the Chicago Router and select Post Import Operations/View Collected Output Files. This action will open the Chicago configuration file in the Edit Pad text editor.

· Move the cursor to line that displays no crypto iskmp enable. Delete the no in front of the line, then move the cursor to the end of the line and press <enter>. The crypto isakmp enable allows routers to exchange IPSec VPN keys and policy information. On the blank line where the cursor is, begin typing the commands required to implement a site-to-site IPSec VPN from the Chicago Router to the Dallas Router.

Configure Chicago Router IKE (ISAKMP) Policies

· Set the policy priority to 110 and enter ISAKMP configuration mode.

crypto isakmp policy 110

· Set authentication to use pre-shared keys.

authentication pre-share

· Set IKE encryption to DES.

encryption des

· Set the Diffie-Hellman group to 1.

group 1

· Set the hash algorithm to MD5.

hash md5

· Set the IKE security association (SA) lifetime to 12 hours and exit isakmp configuration mode.

lifetime 43200

exit

· Set up the pre-shared key to cisco1234 and peer address to 200.100.10.2.

crypto isakmp key cisco1234 address 200.100.10.2

exit

Configure Chicago Router IPSec Parameters

· Define a transform set. Use the following parameters.

1. Transform name: TSet

2. ESP protocols: des

3. Replay prevention: md5

4. Mode: tunnel

crypto ipsec transform-set TSet esp-des esp-md5-hmac

· Set the mode to tunnel.

mode tunnel

exit

Create an IPSec/ISAKMP Crypto Map

· Configure ACL # 102 that will permit all TCP traffic. This ACL will be used to specify what traffic will be encrypted through the VPN Tunnel.

access-list 102 permit tcp any any

· Create a crypto map named CMap with the map number 10. Use the key exchange method ipsec-isakmp.

crypto map CMap 10 ipsec-isakmp

· Use ACL # 102 to determine what traffic that will be encrypted.

match address 102

· Use the transform set mine to specify the IPSec/IKE parameters.

set transform-set TSet

· Assign the VPN peer using the IP address of the remote router’s outside interface.

set peer 200.100.10.2

exit

· Apply the crypto map to the outside interface (S0/0) of the Chicago Router.

interface s0/0

crypto map CMap

exit

· After you have completed typing in the Chicago IPSec configuration commands, Highlight the commands you typed in using your mouse (click and drag) or the keyboard (<Shift> + Arrow keys) use <Ctrl>A to select all of the commands in the Chicago configuration file. Use <Ctrl>C to put the commands in the clipboard. Use <Ctrl>V to paste these commands into the table cell provided in the Lab Report document.

· What commands did you type in that specified the packets to be encrypted?

· Exit OpNet Modeler 175, and save your Lab Report document to submit.