Mac OS X Lion and Cisco IPSEC VPN Pitfalls

The Mac OS X Lion, Native VPN client, with Cisco IPSEC EasyVPN Server was NOT working properly for myself. The problem I faced was that traffic was NOT passed to the remote LAN when connected to VPN. Split-tunnel and normal EasyVPN setups did NOT work.

1)  When presented with a split-tunnel ACL the Apple client will create a proxy pair for each line.
                        i.e.  VPN IP address of A
                                    split ACL of:
                                                            permit B
                                                            permit C
                                                            permit D

                        You would see an ipsec sa from A to B, A to C, and A to D.

2)  When presented with a split-tunnel ACL the Cisco client will crete a single ipsec sa:
                        i.e. A to any

            However the client will only route traffic to B, C, D over the tunnel.

This is fine and has no problems when using a crypto map style setup for ezvpn.

However when you configure the use of dVTI this becomes difficult.  This is because the VTI can only support 1 ipsec sa built to it.  As a results when the Apple client tries to propose the proxy pair for the A to C entry it is rejected.

This leaves you with two options here:

1)  Switch to a tunnel-all configuration
2)  Switch back to the crypto map configuration rather than the virtual-template configuration.

Reference: https://supportforums.cisco.com/thread/2095921

I chose to take the "old" crypto map style setup. Here's how I made it work on a Cisco 877 DSL router:

ip nat inside source route-map NAT interface Dialer0 overload

route-map NAT permit 10
match ip address 111
exit

access-list 101  remark ----------------------------------------------
access-list 101  remark *****VPN Access-list*****
access-list 101  permit ip 172.16.20.0 0.0.0.255 172.16.40.0 0.0.0.15
!
access-list 111  remark ----------------------------------------------
access-list 111  remark *****DENY Local LAN to VPN Traffic*****
access-list 111  deny ip 172.16.20.0 0.0.0.255 172.16.40.0 0.0.0.15 
access-list 111  remark ----------------------------------------------
access-list 111  remark *****PERMIT Networks Internet Access*****
access-list 111  permit ip 172.16.20.0 0.0.0.255 any
access-list 111  permit ip any any

aaa new-model
aaa authentication login userauth local
aaa authorization network groupauth local

username myusername password 0 mypassword

crypto isakmp policy 3
encryption 3des
authentication pre-share
group 2
lifetime 86400
exit

crypto isakmp client configuration group my_vpn
key mysecretgroupkey
dns 172.16.20.1 8.8.8.8
domain my.domain
pool my_vpn_pool
acl 101
max-logins 10
max users 10
save-password
split-dns my.domain
include-local-lan
exit

crypto ipsec transform-set my_set esp-3des esp-md5-hmac
exit

crypto dynamic-map dynmap 10
set transform-set my_set
set security-association idle-time 900
reverse-route
exit

crypto map clientmap client authentication list userauth
crypto map clientmap isakmp authorization list groupauth
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap

ip local pool my_vpn_pool 172.16.40.2 172.16.40.8

interface Dialer0
ip nat outside
crypto map clientmap

interface vlan1
no autostate
ip nat inside 

I have tested this setup with Mac OS X Lion VPN client and with iPhone IOS 5.0.1. All is working well now. Yeeaay!

Cisco IOS DNS server configuration

Most users will probably only need to do the following to enable the Cisco IOS DNS server for name lookups:

Router01(config)#ip dns server
Router01(config)#ip host Router02 192.168.1.2
Router01(config)#ip host Router03 192.168.1.3
Router01(config)#ip host Router04 192.168.1.4

And then on the client routers:

Router02(config)#ip name-server 192.168.1.1 (where 192.168.1.1 is the IP address of the router acting as DNS server)

For a more advanced DNS server configuration, I will create two primary domains, mywebsite1.com and mywebsite2.com. Under each I will add 3 ISP nameservers, 2 MX mail records and 1 host record to make the www work.

86400 = 24 hours Refresh time
3600 = 1 hour Refresh retry time
1209600 = 14 days Authority expire time
86400 = 24 hours Minimum TTL for zone info

Router01(config)#ip dns server

For the www.mywebsite1.com domain:

Router01(config)#ip dns primary mywebsite1.com soa isp.ns1.mywebsite1.com admin@mywebsite1.com 86400 3600 1209600 86400
Router01(config)#ip host mywebsite1.com ns isp.ns1.mywebsite1.com
Router01(config)#ip host mywebsite1.com ns isp.ns2.mywebsite1.com
Router01(config)#ip host mywebsite1.com ns isp.ns3.mywebsite1.com
Router01(config)#ip host mywebsite1.com mx 1 mail.mywebsite1.com
Router01(config)#ip host mywebsite1.com mx 2 mail2.mywebsite1.com
Router01(config)#ip host mail.mywebsite1.com 192.168.1.40
Router01(config)#ip host mail2.mywebsite1.com 192.168.1.50
Router01(config)#ip host www.mywebsite1.com 192.168.1.30

For the www.mywebsite2.com domain:

Router01(config)#ip dns primary mywebsite2.com soa isp.ns1.mywebsite2.com admin@mywebsite2.com 86400 3600 1209600 86400
Router01(config)#ip host mywebsite2.com ns isp.ns1.mywebsite2.com
Router01(config)#ip host mywebsite2.com ns isp.ns2.mywebsite2.com
Router01(config)#ip host mywebsite2.com ns isp.ns3.mywebsite2.com
Router01(config)#ip host mywebsite2.com mx 1 mail.mywebsite2.com
Router01(config)#ip host mywebsite2.com mx 2 mail2.mywebsite2.com
Router01(config)#ip host mail.mywebsite2.com 192.168.1.70
Router01(config)#ip host mail2.mywebsite2.com 192.168.1.80
Router01(config)#ip host www.mywebsite2.com 192.168.1.60

Verify the DNS setup:

Router01(config)#show hosts

Cisco site-to-site IPSEC encrypted VPN

The following will be assumed:

Router01 inside IP address = 192.168.0.1 255.255.255.0
Router01 outside IP address = 192.168.255.1 255.255.255.252
Router02 inside IP address = 192.168.1.1 255.255.255.0
Router02 outside IP address = 192.168.255.2 255.255.255.252
mysecretkey = can be anything, must be the same on both routers.
mytransform = can be anything, must be the same on both routers.
mycryptomap = can be anything, must be the same on both routers.
12345 = any number between 1-65535, sequence to insert into crypto map entry

Router01 setup:

Router01(config)#crypto isakmp policy 1
Router01(config-isakmp)#encryption 3des
Router01(config-isakmp)#authentication pre-share
Router01(config-isakmp)#group 2
Router01(config-isakmp)#exit
Router01(config)#crypto isakmp key mysecretkey address 192.168.255.2 no-xauth
Router01(config)#crypto ipsec transform-set mytransform esp-3des esp-sha-hmac
Router01(cfg-crypto-trans)#exit
Router01(config)#crypto map mycryptomap 12345 ipsec-isakmp
Router01(config-crypto-map)#set peer 192.168.255.2
Router01(config-crypto-map)#set transform-set mytransform
Router01(config-crypto-map)#match address ACL2Router02
Router01(config-crypto-map)#exit
Router01(config)#int s1/0
Router01(config-if)#crypto map mycryptomap
Router01(config-if)#no shut
Router01(config-if)#exit
Router01(config)#ip access-list extended ACL2Router02
Router01(config-ext-nacl)#20 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
Router01(config-ext-nacl)#exit
Router01(config)#exit

Router02 setup:

Router02(config)#crypto isakmp policy 1
Router02(config-isakmp)#encryption 3des
Router02(config-isakmp)#authentication pre-share
Router02(config-isakmp)#group 2
Router02(config-isakmp)#exit
Router02(config)#crypto isakmp key mysecretkey address 192.168.255.1 no-xauth
Router02(config)#crypto ipsec transform-set mytransform esp-3des esp-sha-hmac
Router02(cfg-crypto-trans)#exit
Router02(config)#crypto map mycryptomap 12345 ipsec-isakmp
Router02(config-crypto-map)#set peer 192.168.255.1
Router02(config-crypto-map)#set transform-set mytransform
Router02(config-crypto-map)#match address ACL2Router01
Router02(config-crypto-map)#exit
Router02(config)#int s1/0
Router02(config-if)#crypto map mycryptomap
Router02(config-if)#no shut
Router02(config-if)#exit
Router02(config)#ip access-list extended ACL2Router01
Router02(config-ext-nacl)#20 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
Router02(config-ext-nacl)#exit
Router02(config)#exit

Verfify setup on both routers:

Router#show crypto isakmp policy
Router#show crypto map
Router#show crypto ipsec transform-set

Cisco PPP with authentication

Cisco use HDLC encapsulation by default for point-to-point serial links. This is to setup PPP encapsulation with authentication, but note that there is no encryption on this link.

Encapsulation must be the same on both routers. Note how the hostname of the reverse router was used as the username. Passwords must be the same on both routers. PAP or CHAP authentication can be enabled.

Router 01 setup:

Router(config)#hostname Router01
Router01(config)#username Router02 password mypassword
Router01(config)#int s1/0
Router01(config-if)#ip address 192.168.1.1 255.255.255.0
Router01(config-if)#encapsulation ppp
Router01(config-if)#ppp authentication chap
Router01(config-if)#no shut

Router 02 setup:

Router(config)#hostname Router02
Router02(config)#username Router01 password mypassword
Router02(config)#int s1/0
Router02(config-if)#ip address 192.168.1.2 255.255.255.0
Router02(config-if)#encapsulation ppp
Router02(config-if)#ppp authentication chap
Router02(config-if)#no shut

Verify:

Router01#sh int s1/0
Router02#sh int s1/0

Logging events on Cisco routers

Log events to your Syslog server:

Router(config)#logging 192.168.1.1 (your syslog server ip)
Router(config)#logging trap ?
  <0-7>          Logging severity level
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)
  <cr>

Router(config)#logging trap notifications
Router(config)#logging source-interface fa0/0 (logging packets from a specific interface)
exit

Log events locally to the router memory buffer:

Router(config)#logging buffered
Router#show log

Cisco IOS VPN Server and Client config

Allowing VPN Clients to Connect IPsec and still allow Internet access using Split Tunneling configuration.

This configuration assumes the following:

VPN Client Username: myusername
VPN Client Password: mypassword
VPN Group authentication name: mygroupname
VPN Group authentication password: mygroupkey
Your internal DNS: 192.168.1.100
Your domain: mydomain
IPs to be assigned to VPN clients: 192.168.1.5 to 192.168.1.10/24
FastEthernet0/0 is the router's outside interface

Router configuration:

Router(config)#aaa new-model
Router(config)#aaa authentication login userauth local-case
Router(config)#aaa authorization network groupauth local
Router(config)#username myusername password 0 mypassword
Router(config)#crypto isakmp policy 3
Router(config-isakmp)#encryption 3des
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#group 2
Router(config-isakmp)#exit
Router(config)#crypto isakmp client configuration group mygroupname
Router(config-isakmp-group)#key mygroupkey
Router(config-isakmp-group)#dns 192.168.1.100
Router(config-isakmp-group)#domain mydomain
Router(config-isakmp-group)#pool myvpnpool
Router(config-isakmp-group)#acl 101
Router(config-isakmp-group)#exit
Router(config)#crypto ipsec transform-set myset esp-3des esp-md5-hmac
Router(cfg-crypto-trans)#exit
Router(config)#crypto dynamic-map dynmap 10
Router(config-crypto-map)#set transform-set myset
Router(config-crypto-map)#reverse-route
Router(config-crypto-map)#exit
Router(config)#crypto map clientmap client authentication list userauth
Router(config)#crypto map clientmap isakmp authorization list groupauth
Router(config)#crypto map clientmap client configuration address respond
Router(config)#crypto map clientmap 10 ipsec-isakmp dynamic dynmap
Router(config)#int fa0/0
Router(config-if)#ip address <outside_IP_address> <subnet_mask>
Router(config-if)#no shut
Router(config-if)#ip nat outside
Router(config-if)#crypto map clientmap
Router(config-if)#exit
Router(config)#ip local pool myvpnpool 192.168.1.5 192.168.1.10
Router(config)#ip nat inside source list 111 interface FastEthernet0/0 overload
Router(config)#access-list 111 deny ip <local_network_IP> <inverted mask> 192.168.1.0 0.0.0.255
Router(config)#access-list 111 permit ip any any
Router(config)#access-list 101 permit ip <local_network_IP> <inverted mask> 192.168.1.0 0.0.0.255

Remember to save your config!

Install the Cisco VPN client. Restart your computer. Open the VPN client and click "New". Fill out the details you just configured on your router:

NOTE: Still getting Error 2738 with Windows 7 install?
Bring up an administrative terminal:
Start --> Run --> Type "cmd" hold ctrl+shift and press ENTER
Re-register VBScript engine:
reg delete "HKCU\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}" /f
%systemroot%\system32\regsvr32 vbscript.dll

Click "Save". Double click your new Connection entry and supply your configured Username and Password.

Check that all is working:

Router#show crypto isakmp sa

Shows all current IKE Security Associations (SAs) at a peer.

Router#show crypto ipsec sa

Shows the settings used by current SAs.

Reference: http://www.cisco.com/en/US/products/hw/routers/ps274/products_configuration_example09186a0080819289.shtml#vpn405

Cisco, enable SSH server

This is with normal "Username/Password" authentication. Apparently IOS 15.0M and up is supporting public/private key authentication...

Router# show ip ssh   
Router(config)#hostname myhostname    
myhostname(config)#ip domain-name mydomain    
myhostname(config)#crypto key generate rsa modulus 2048    
myhostname(config)#ip ssh time-out 120    
myhostname(config)# ip ssh authetication-retries 3    
myhostname(config)# ip ssh port 1234    
myhostname(config)#ip ssh version 2    
myhostname(config)#username myusername secret mypassword    
myhostname(config)#line vty 0 4    
myhostname(config)# transport input ssh    
myhostname(config-line)#login local

...and remember to save your changes!

SNMP on Cisco routers

snmp-server community mysecret ro 60
access-list 60 permit 192.168.1.1 255.255.255.0

The first command enables SNMP on the router with read-only access and a community secret of mysecret. The second command tells the router that only 192.168.1.1 are allowed to view SNMP data of this router. If you want to configure SNMP traps on the router, you can do the following:

snmp-server host 192.168.1.1 mysecret

Once again, 192.168.1.1 will be the IP address of your server that receives the SNMP traps and mysecret will be the SNMP secret that is configured on the trap server.

DHCP server on Cisco routers

Router(config)#ip dhcp pool <any-dhcp-pool-name>
Router(dhcp-config)#network <my-network-ip> <my-network-subnetmask>
Router(dhcp-config)#dns-server <my-dns-server-ip>
Router(dhcp-config)#default-router <my-gateway-ip>
Router(dhcp-config)#domain-name <my-domain-name>
Router(dhcp-config)#lease DAYS HOURS MINUTES
Router(config)#ip dhcp excluded-address <ip-address-to-exclude-from-pool>
Router(config)#service dhcp

To show current leases:

Router#show ip dhcp binding

To see some DHCP server stats:

Router#show ip dhcp server statistics

Should you choose, you can exclude a range of addresses from being assigned:

Router(config)#ip dhcp excluded-address <start-ip-to-exclude> <end-ip-to-exclude>

You can also make your ip address leases never expire:

Router(dhcp-config)#lease infinite

Routing between VLANs, Cisco router and 3COM 4500 switch

Using a Cisco router to do the routing and a 3COM 4500 Superstack III switch for the VLANs, 802.1Q trunk setup. I'm not going to use port 1 on the switch, as this belongs to the native VLAN1. Also remember that all the other ports on the switch, not assigned to their own VLANs, will also by default belong to VLAN1. In other words, all devices plugged into any of the VLAN1 ports, will be able to see each other by default!

Setup on the Cisco router:

interface fa0/1
description Trunk to 3COM Switch
no ip address
no shut

interface FastEthernet0/1.13
description Finance to switch port 13
encapsulation dot1Q 13
ip address 192.168.1.1 255.255.255.0

interface FastEthernet0/1.14
description Legal to switch port 14
encapsulation dot1Q 14
ip address 192.168.2.1 255.255.255.0

interface FastEthernet0/1.15
description HR to switch port 15
encapsulation dot1Q 15
ip address 192.168.3.1 255.255.255.0

interface FastEthernet0/1.16
description QC to switch port 16
encapsulation dot1Q 16
ip address 192.168.4.1 255.255.255.0

interface FastEthernet0/1.17
description Management to switch port 17
encapsulation dot1Q 17
ip address 192.168.5.1 255.255.255.0

Remember to save your changes!

Setup on the 3COM 4500 Superstack III switch:

Select menu option (bridge/vlan): create
Select VLAN ID (2-4094)[3]: 2
Enter VLAN Name [VLAN 2]: Trunk

Select menu option (bridge/vlan): create
Select VLAN ID (2-4094)[3]: 13
Enter VLAN Name [VLAN 13]: Finance

Select menu option (bridge/vlan): create
Select VLAN ID (2-4094)[3]: 14
Enter VLAN Name [VLAN 14]: Legal

Select menu option (bridge/vlan): create
Select VLAN ID (2-4094)[3]: 15
Enter VLAN Name [VLAN 15]: HR

Select menu option (bridge/vlan): create
Select VLAN ID (2-4094)[3]: 16
Enter VLAN Name [VLAN 16]: QC

Select menu option (bridge/vlan): create
Select VLAN ID (2-4094)[3]: 17
Enter VLAN Name [VLAN 17]: Management

Select menu option (bridge/vlan/modify): add
Select VLAN ID (1-2,116,120)[1]: 13
Select bridge ports (AL1-AL4,unit:port...,?): 1:13
Enter tag type (untagged, tagged): untagged

Select menu option (bridge/vlan/modify): add
Select VLAN ID (1-2,116,120)[1]: 14
Select bridge ports (AL1-AL4,unit:port...,?): 1:14
Enter tag type (untagged, tagged): untagged

Select menu option (bridge/vlan/modify): add
Select VLAN ID (1-2,116,120)[1]: 15
Select bridge ports (AL1-AL4,unit:port...,?): 1:15
Enter tag type (untagged, tagged): untagged

Select menu option (bridge/vlan/modify): add
Select VLAN ID (1-2,116,120)[1]: 16
Select bridge ports (AL1-AL4,unit:port...,?): 1:16
Enter tag type (untagged, tagged): untagged

Select menu option (bridge/vlan/modify): add
Select VLAN ID (1-2,116,120)[1]: 17
Select bridge ports (AL1-AL4,unit:port...,?): 1:17
Enter tag type (untagged, tagged): untagged

Select menu option (bridge/vlan/modify): add
Select VLAN ID (1-2,116,120)[1]: 13-17
Select bridge ports (AL1-AL4,unit:port...,?): 1:2
Enter tag type (untagged, tagged): tagged

Once again, remember to save your changes!

GNS3, compatible Cisco IOS images

You should be able to find these with Google:

1700
c1700-advipservicesk9-mz.124-15.T7.bin

2600
c2600-ipvoicek9-mz.124-4.T1.bin
c2600-telco-mz.124-2.T.bin
c2600-adventerprisek9-mz.124-18.bin

2691
c2691-advipservicesk9-mz.124-15.T6.bin
c2691-adventerprisek9_ivs-mz.124-9.T7.bin

3640
c3640-jk9o3s-mz.124-16a.bin
c3640-a3jk9s-mz.124-16a.bin

3660
c3660-jk9o3s-mz.124-15.T5.bin
c3660-ik9o3s-mz.124-15.T6.bin

3725
c3725-adventerprisek9-mz.124-15.T5.bin

3745
c3745-advipservicesk9-mz.124-15.T6.bin

7200
c7200-adventerprisek9-mz.124-15.T6.bin
c7200-adventerprisek9-mz.124-20.T.bin
c7200-advipservicesk9-mz.124-20.T.bin
c7200p-adventerprisek9-mz.124-20.T.bin
c7200p-ipbasek9-mz.124-4.XD9.bin

ASA8.1-1 ASDM6.1-1
PIX 8.0-3 ASDM 6.0-3 ASA 8.0-3
PIX 8.0-2 ASDM 6.0-2 ASA 8.0-2
PIX 7.2-3 ASDM 5.2-3 ASA 7.2-3

Decrypt Cisco IOS type 7 passwords on a router

I saw this once on the net and thought it could come in handy... Pitty it can't be done with type-5 passwords.

Turn on type-7 encryption for local passwords and create a temp username:

Router1(config)#service password-encryption
Router1(config)#username tempuser password !@&*^&*^$#

Show the created username with the show running config command:

Router1(config)#do show run | include username username tempuser password 7 -encrypted string-

Create a key chain and enter the type-7 encrypted password as the key string:

Router1(config)#key chain decrypt
Router1(config-keychain)#key 1
Router1(config-keychain-key)#key-string 7 -encrypted string-

The show command will now do the decryption:

Router1(config-keychain-key)#do show key chain decrypt

Key-chain decrypt:
key 1 -- text "testuser:decyptedpassword"
accept lifetime (always valid) - (always valid) [valid now]
send lifetime (always valid) - (always valid) [valid now]