Lab Objective:
The focus of this lab is to understand branch office connectivity implementation and configuration. Additional technologies include IP routing, tunnels, and IPsec VPNs.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please bring up the LAN interfaces connected to the routers by issuing the no shutdown command on the connected switches. If you are using a home lab with no interface fastethernet 0/0 Alternately, you can simply connect the interfaces to a hub or switch if you have one available in your own lab. |
Task 1
Configure hostnames, IP addressing on all routers as illustrated in the network topology.
Task 2
Configure BGP on R2 and R3 as illustrated in the topology. Ensure that the R1-R2 and the R3-R3 WAN subnets are advertised. Verify your configuration using the appropriate commands.
Task 3
Configure a GRE tunnel between R1 and R4. Enable OSPF and advertise the LAN subnets that are connected to these routers. Verify your configuration using the appropriate commands.
Task 4
Management is concerned about security over the GRE tunnel. They have requested that the GRE tunnel itself be encrypted using IPsec to allow for secure connectivity between the R1 and R4 subnets across this tunnel. Configure the IPsec solution as follows:
- Use Triple Digital Encryption Standard (3DES) as the encryption algorithm
- Use pre-shared key authentication with a shared key of CCNP2011
- Use Diffie-Hellman group 2
Due to the relatively complex nature of this task, the following section includes a bank of commands that you can use to completed this task. Your task is to figure out which of these commands to apply where. The bank of available commands is as follows:
- The crypto isakmp policy command
- The crypto isakmp key command
- The crypto ipsec transform-set command and mode transport subcommand
- The crypto ipsec profile command and set transform-set subcommand
- The tunnel mode ipsec ipv4 command
- The tunnel protection ipsec profile command
Test your solution and verify that R1 and R2 can ping each other from their LAN interfaces.
Lab Validation
Task 1
Please refer to previous labs for basic IPv4, IPv6 addressing and hostname configuration. This will not be included in this section to avoid being redundant.
Task 2
The requirements in this task are straightforward. Because basic BGP configuration has been illustrated in detail in previous labs, this configuration is omitted for brevity. Following the configuration, your routing tables on R2 and R3 should show the following IP route entries:
| R2#show ip route bgp 150.2.0.0/16 is variably subnetted, 3 subnets, 2 masks B 150.2.4.0/28 [200/0] via 150.2.2.3, 00:00:14 |
| R3#show ip route bgp 150.2.0.0/16 is variably subnetted, 3 subnets, 2 masks B 150.2.1.0/28 [200/0] via 150.2.2.2, 00:00:26 |
Task 3
In order to complete this task, several actions are required. First, to allow for the configuration of a GRE tunnel between R1 and R4, you need to configure static routes for these routers’ links to R2 and R3, i.e. their WAN links. Next, configure the GRE tunnel and enable OSPF for all the connected subnets. This task is completed as follows:
| R1(config)#ip route 150.2.4.4 255.255.255.255 serial 0/0 R1(config)#router ospf 1 R1(config-router)#router-id 1.1.1.1 R1(config-router)#exit R1(config)#interface tunnel 0 R1(config-if)#ip address 192.168.1.1 255.255.255.0 R1(config-if)#tunnel source serial 0/0 R1(config-if)#tunnel destination 150.2.4.4 R1(config-if)#ip ospf 1 area 0 R1(config-if)#exit R1(config)#interface fastethernet 0/0 R1(config-if)#ip ospf 1 area 1 R1(config-if)#exit |
| R4(config)#ip route 150.2.1.1 255.255.255.255 serial 0/0 R4(config)#router ospf 4 R4(config-router)#router-id 4.4.4.4 R4(config-router)#exit R4(config)#interface tunnel 0 R4(config-if)#ip address 192.168.1.4 255.255.255.0 R4(config-if)#tunnel source serial 0/0 R4(config-if)#tunnel destination 150.2.1.1 R4(config-if)#ip ospf 4 area 0 R4(config-if)#exit R4(config)#interface fastethernet 0/0 R4(config-if)#ip ospf 4 area 4 R4(config-if)#exit |
Next, verify your configuration by checking OSPF adjacency states. This also confirms whether the GRE tunnel between R1 and R4 is up and operational as well:
| R1#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface |
| R4#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface |
Finally, verify that the LAN subnets are advertised as configured:
| R1#show ip route ospf 10.0.0.0/24 is subnetted, 6 subnets O IA 10.4.2.0 [110/11112] via 192.168.1.4, 00:03:40, Tunnel0 O IA 10.4.3.0 [110/11112] via 192.168.1.4, 00:03:40, Tunnel0 O IA 10.4.1.0 [110/11112] via 192.168.1.4, 00:03:40, Tunnel0 |
| R4#show ip route ospf 10.0.0.0/24 is subnetted, 6 subnets O IA 10.1.3.0 [110/11112] via 192.168.1.1, 00:03:52, Tunnel0 O IA 10.1.2.0 [110/11112] via 192.168.1.1, 00:03:52, Tunnel0 O IA 10.1.1.0 [110/11112] via 192.168.1.1, 00:03:52, Tunnel0 |
Additionally, ping between the LAN subnets to confirm LAN-to-LAN reachability:
| R1#ping 10.4.1.4 source 10.1.1.1 repeat 10 size 1500
Type escape sequence to abort. |
Task 4
The requirements of this task are a little complex; however, you have the bank of commands to use to complete this task. Using this bank, this task is completed as follows:
| R1(config)#crypto isakmp policy 1 R1(config-isakmp)#encryption 3des R1(config-isakmp)#authentication pre-share R1(config-isakmp)#group 2 R1(config-isakmp)#exit R1(config)#crypto isakmp key CCNP2011 address 150.2.4.4 R1(config)#crypto ipsec transform-set TRIPLE-DES esp-3des R1(cfg-crypto-trans)#mode transport R1(cfg-crypto-trans)#exit R1(config)#crypto ipsec profile ENCRYPT-GRE R1(ipsec-profile)#set transform-set TRIPLE-DES R1(ipsec-profile)#exit R1(config)#interface tunnel 0 R1(config-if)#tunnel mode ipsec ipv4 R1(config-if)#tunnel protection ipsec profile ENCRYPT-GRE R1(config-if)#exit |
| R4(config)#crypto isakmp policy 1 R4(config-isakmp)#encryption 3des R4(config-isakmp)#authentication pre-share R4(config-isakmp)#group 2 R4(config-isakmp)#exit R4(config)#crypto isakmp key CCNP2011 address 150.2.1.1 R4(config)#crypto ipsec transform-set TRIPLE-DES esp-3des R4(cfg-crypto-trans)#mode transport R4(cfg-crypto-trans)#exit R4(config)#crypto ipsec profile ENCRYPT-GRE R4(ipsec-profile)#set transform-set TRIPLE-DES R4(ipsec-profile)#exit R4(config)#interface tunnel 0 R4(config-if)#tunnel mode ipsec ipv4 R4(config-if)#tunnel protection ipsec profile ENCRYPT-GRE R4(config-if)#exit |
Following this, verify your configuration using the show crypto commands:
| R1#show crypto ipsec profile IPSEC profile ENCRYPT-GRE Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ TRIPLE-DES, } |
| R1#show crypto isakmp policy
Global IKE policy |
| R1#show crypto session detail Crypto session current status Code: C – IKE Configuration mode, D – Dead Peer Detection Interface: Tunnel0 |
Next, verify that the Tunnel interface is up following the modified configuration parameters:
| R1#show interfaces tunnel 0 Tunnel0 is up, line protocol is up Hardware is Tunnel Internet address is 192.168.1.1/24 MTU 1514 bytes, BW 9 Kbit/sec, DLY 500000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 150.2.1.1 (Serial0/0), destination 150.2.4.4 Tunnel protocol/transport IPSEC/IP Tunnel TTL 255 Fast tunneling enabled Tunnel transmit bandwidth 8000 (kbps) Tunnel receive bandwidth 8000 (kbps) Tunnel protection via IPSec (profile “ENCRYPT-GRE”) Last input 00:19:17, output 00:19:18, output hang never Last clearing of “show interface” counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 174 packets input, 31060 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 188 packets output, 32492 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out |
Following that, verify your OSPF neighbor adjacencies and dynamic routing information:
| R1#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface |
| R1#show ip route ospf 10.0.0.0/24 is subnetted, 6 subnets O IA 10.4.2.0 [110/11112] via 192.168.1.4, 00:07:07, Tunnel0 O IA 10.4.3.0 [110/11112] via 192.168.1.4, 00:07:07, Tunnel0 O IA 10.4.1.0 [110/11112] via 192.168.1.4, 00:07:07, Tunnel0 |
Next, ping between router R1 and router R4s LAN subnets using an extended ping:
| R1#ping 10.4.1.4 source 10.1.1.1 repeat 10 size 1500
Type escape sequence to abort. |
Finally, verify encryption statistics (and configuration) on the router(s):
| R1#show crypto ipsec sa
interface: Tunnel0 protected vrf: (none) local crypto endpt.: 150.2.1.1, remote crypto endpt.: 150.2.4.4 inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: |
Finally, you can use the show crypto isakmp sa [detail] command to verify SA status:
| R1#show crypto isakmp sa detail Codes: C – IKE configuration mode, D – Dead Peer Detection K – Keepalives, N – NAT-traversal X – IKE Extended Authentication psk – Preshared key, rsig – RSA signature renc – RSA encryption C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap. |
This solution is commonly used in branch office solutions where you need to enable dynamic IP routing protocols over a GRE tunnel across the Internet. If you were to debug IP traffic traversing either R2 or R3, for example, while traffic was traversing the LAN subnets of R1 and R4, you would see ESP packets going back and forth. In other words, the GRE packets are encapsulation using IPsec in a manner that would be similar to encapsulating and transporting voice packets using IP, i.e. VoIP. Alternatively, you could also configure an ACL and enable logging and view the matches against the ACL as illustrated below on R3:
| R3(config)#access-list 100 permit ip any any log-input R3(config)#interface serial 1/2 R3(config-if)#ip access-group 100 out R3(config-if)#ip access-group 100 in *Jun 15 20:19:51.427: %SEC-6-IPACCESSLOGNP: list 100 permitted 50 150.2.4.4 -> 150.2.1.1, 1 packet *Jun 15 20:21:32.351: %SEC-6-IPACCESSLOGNP: list 100 permitted 50 150.2.1.1 -> 150.2.4.4, 1 packet |
If you were to send multiple pings or transfer data between the LAN subnets connected to R1 and R4, you would see multiple packets being sent instead of just the single packet:
| *Jun 15 20:25:37.139: %SEC-6-IPACCESSLOGNP: list 100 permitted 50 150.2.4.4 -> 150.2.1.1, 135 packets *Jun 15 20:26:37.139: %SEC-6-IPACCESSLOGNP: list 100 permitted 50 150.2.1.1 -> 150.2.4.4, 138 packets |
In the output above, IP protocol 50 is being permitted between R1 and R4. IP protocol number 50 is Encapsulating Security Payload (ESP). In both transport and tunnel mode, IPsec adds a new header to all the IP packets to provide the required information for securing the data within the original IP datagram. This header may either be an Encapsulating Security Payload (ESP) or Authentication Header (AH) header.
- ESP is an IP-based protocol that uses IP port 50 for communication between IPsec peers. ESP is used to provide confidentiality, integrity, and authenticity of the data, i.e. secure data via encryption and authentication. Additionally, ESP also provides anti-replay protection services. ESP does not provide any kind of protection for the outer IP header
- AH, is an IP-based protocol that uses IP port 51 for communication between IPsec peers. AH is used to protect the integrity and authenticity of data, and also offers anti-replay protection; however, AH does not provide confidentiality protection. In other words, AH does not provide encryption like ESP. AH does provide protection to the IP header; however, it should be noted that not all fields in the IP header, e.g. TTL, are protected
Final Router Configurations
R1
|
R1#term len 0 Current configuration : 1475 bytes R1# |
R2
|
R2#term len 0 Current configuration : 973 bytes R2# |
R3
|
R3#term len 0 Current configuration : 1290 bytes R3# |
R4
|
R4#term len 0 Current configuration : 1545 bytes R4# |