Joy of Networking: VPN (GRE+IPSec)

Cisco VPN (GRE+IPSec)

IMPORTANT: Disable GRE keepalive on the Tunnel (they will be sent without encryption and dropped on the other end. As a consequence the tunnel will go down). IPSec has it's own keepalive.

Parameters to consider/agree upon

Phase 1 IKE/ISAKMP
- Authentication : RSA
- Mode : Main
- Key Exchange Encryption: AES-25
- Hash: SHA1
- Diffie-Hellman Group: 2
- Lifetime: 86400 seconds

Phase 2 IPSec
- Encryption: AES-128
- Hash: SHA1
- PFS Diffie-Hellman group: 2
- Lifetime: 36000

Phase 1 config
crypto keyring kr-acme
rsa-pubkey address
key-string
HEXHEXHEX
quit
!
crypto isakmp policy 10
encr aes 256
hash sha256
group 2
!
crypto isakmp profile isa-acme
   keyring kr-acme
   match identity address 23.0.0.3 255.255.255.255

Phase 2 config
crypto ipsec transform-set ts-acme esp-aes 256 esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile ipsec-acme
set security-association replay disable
set transform-set ts-acme
set isakmp-profile isa-acme

Phase 1 Troubleshooting
#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
12.0.0.1        23.0.0.3        MM_KEY_EXCH       1019 ACTIVE
23.0.0.3        12.0.0.1        MM_KEY_EXCH       1020 ACTIVE

#show crypto isakmp diagnose error
...
Error(103): Failed to find public key. (address is missing in keyring)
Error(2): Failed to verify signature. (signature is corrupt)

Phase 2 Troubleshooting

R1#sh crypto ipsec transform-set
...
Transform set ts-acme: { esp-256-aes esp-sha-hmac }
   will negotiate = { Tunnel, },

R1#sh crypto ipsec profile
...
IPSEC profile ipsec-acme
    ISAKMP Profile: isa-acme
    Security association lifetime: 4608000 kilobytes/3600 seconds
    Responder-Only (Y/N): N
    PFS (Y/N): N
    Mixed-mode : Disabled
    Transform sets={
       ts-acme: { esp-256-aes esp-sha-hmac } ,
    }
    Antireplay window disabled

R1#sh crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 12.0.0.1

   protected vrf: (none)
   local ident (addr/mask/prot/port): (12.0.0.1/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (23.0.0.3/255.255.255.255/47/0)
   current_peer 23.0.0.3 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 12.0.0.1, remote crypto endpt.: 23.0.0.3
     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
     current outbound spi: 0xC288357(203981655)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x89A123AF(2309039023)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 1, flow_id: SW:1, sibling_flags 80000040, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4235169/3427)
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xC288357(203981655)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 2, flow_id: SW:2, sibling_flags 80000040, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4235169/3427)
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

R1# show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
R - IKE Auto Reconnect, U - IKE Dynamic Route Update

Interface: Tunnel0
Profile: isa-acme
Uptime: 00:05:51
Session status: UP-ACTIVE
Peer: 23.0.0.3 port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 23.0.0.3
      Desc: (none)
Session ID: 0
IKEv1 SA: local 12.0.0.1/500 remote 23.0.0.3/500 Active
          Capabilities:(none) connid:1021 lifetime:23:54:08
IPSEC FLOW: permit 47 host 12.0.0.1 host 23.0.0.3
        Active SAs: 2, origin: crypto map
        Inbound: #pkts dec'ed 5 drop 0 life (KB/Sec) 4235169/3248
        Outbound: #pkts enc'ed 5 drop 0 life (KB/Sec) 4235169/3248

Wireshark
(AH instead of ESP is used as transform-set so no encryption of the payload)

ping interface 12.0.0.1->23.0.0.3 no IPSec