Application Notes SL1000/SL500 VPN with Cisco PIX 501

Version 1.0

Copyright 2006, ASUSTek Computer, Inc.

Revision History

Version 1.0 Author Martin Su Date 2006/5/4 Initial draft Status

Table of Contents

Revision History.... ii Table of Contents.... iii List of Figures.... iii 1 Introduction.... Network Setup.... 1 2.1 Setup Description.... 1 2.2 Setup CISCO PIX Firewall.... 1 2.2.1 Setup IP address of LAN interface... 1 2.2.2 Setup IP address of WAN interface.. 1 2.2.3 Setup Routing Table.... 2 2.3 Setup SL1000/SL500 system.... 2 2.3.1 Setup IP address of LAN interface... 2 2.3.2 Setup IP address of WAN interface.. 2 2.3.3 Setup Routing Table.... Establish VPN Tunnel using Automatic Keying... 3 3.1 Configure VPN Policy on PIX 501.... 3 3.2 Configure VPN Policy on SL1000/SL500... 6 3.3 Verify VPN Tunnel Establishment.... 7

List of Figures

Figure 2.1 Network Connections.... 1 Figure 2.2 Setup LAN port IP address on the PIX firewall... 1 Figure 2.3 Setup WAN port IP address on the PIX firewall... 1 Figure 2.4 Setup a default route to the PIX firewall... 2 Figure 2.5 Setup LAN port IP address on the SL1000/SL500... 2 Figure 2.6 Setup IP address of WAN interface on the SL1000/SL500... 2 Figure 2.7 Verify WAN interface configurations on the SL1000/SL500.. 3 Figure 2.8 Setup a default route to the SL1000/SL500... 3 Figure 3.1 Setup VPN policy on the PIX firewall... 4 Figure 3.2 Verify VPN configurations on the PIX firewall.. 5 Figure 3.3 Configure VPN policy on the SL1000/SL500... 6 Figure 3.4 Verify VPN configurations on the SL1000/SL500... 6 Figure 3.5 Verify VPN tunnel establishment on the PIX firewall... 8 Figure 3.6 Verify the VPN tunnel establishment on the SL1000/SL500.. 8

1 Introduction

This application note details the steps for creating an IPSec VPN tunnel between an ASUS Internet Security Router and a CISCO PIX Firewall device. It is assumed that both devices have static IP address on the WAN interface, and a default route configured. All settings and screen dumps contained in this document are taken from a CISCO PIX 501 device running firmware PIX Firewall Version 6.3(4), and an ASUS SL1000/SL500 running firmware 1.1.72A.410.

2 Network Setup

This section describes how to setup the network to carry out the SL1000/SL500 and CISCO PIX 501 Network Configuration as illustrated in Figure 2.1.
Cross Ethernet Cable WAN: 10.64.2.145 WAN: 10.64.2.130

LAN: 10.64.3.1

Internet Security Router

LAN: 192.168.30.1

CISCO PIX501

PC2: 10.64.3.11

PC1: 192.168.30.2
Figure 2.1 Network Connections

2.1 Setup Description

PC1 and PC2 are hosts in protected networks running Windows NT/98/2000/XP or Redhat Linux. Both SL1000/SL500 and PIX Firewall will protect their traffic from external network. NAT is not required for traffic between the two intranets, which can be transmitted using a VPN tunnel over the public Internet (in this setup example, a direct connection between two WAN interfaces serves as public network). However, NAT is required for connections to public Internet.
2.2 Setup CISCO PIX Firewall
2.2.1 Setup IP address of LAN interface
pixfirewall# configure terminal pixfirewall(config)# ip address inside 192.168.30.1 255.255.255.0 Figure 2.2 Setup LAN port IP address on the PIX firewall
Setup IP address of WAN interface
pixfirewall(config)# interface ethernet0 auto pixfirewall(config)# ip address outside 10.64.2.130 255.255.255.0 Figure 2.3 Setup WAN port IP address on the PIX firewall

Page 1

Setup Routing Table
Figure 2.4 Setup a default route to the PIX firewall
pixfirewall(config)# route outside 0.0.0.0 0.0.0.0 10.64.2.145
2.3 Setup SL1000/SL500 system
2.3.1 Setup IP address of LAN interface
Figure 2.5 Setup LAN port IP address on the SL1000/SL500

Figure 2.6 Setup IP address of WAN interface on the SL1000/SL500

Page 2

Figure 2.7 Verify WAN interface configurations on the SL1000/SL500
Figure 2.8 Setup a default route to the SL1000/SL500
3 Establish VPN Tunnel using Automatic Keying
3.1 Configure VPN Policy on PIX 501
Step: 1 Configure access list rule and VPN policy pixfirewall(config)# access-list SL1000 permit ip 192.168.30.0 255.255.255.0 10.64.3.0 255.255.255.0 pixfirewall(config)# nat (inside) 0 access-list SL1000 pixfirewall(config)# sysopt connection permit-ipsec pixfirewall(config)# crypto ipsec transform-set set1 esp-3des esp-sha-hmac pixfirewall(config)# crypto ipsec security-association lifetime seconds 3600 pixfirewall(config)# crypto map toSLipsec-isakmp pixfirewall(config)# crypto map toSLmatch address SL1000 pixfirewall(config)# crypto map toSLset peer 10.64.2.145 pixfirewall(config)# crypto map toSLset transform-set set1 pixfirewall(config)# crypto map toSL1000 interface outside pixfirewall(config)# isakmp enable outside pixfirewall(config)# isakmp key cwtest address 10.64.2.145 netmask 255.255.255.0 pixfirewall(config)# isakmp identity address pixfirewall(config)# isakmp policy 20 authentication pre-share pixfirewall(config)# isakmp policy 20 encryption 3des pixfirewall(config)# isakmp policy 20 hash sha pixfirewall(config)# isakmp policy 20 group 2 pixfirewall(config)# isakmp policy 20 lifetime 3600

Page 3

Figure 3.1 Setup VPN policy on the PIX firewall Step 2: Verify Configurations pix-firewall# show config : Saved : Written by enable_15 at 14:22:39.654 UTC Thu May PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pix-firewall domain-name asus.com.tw fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 hfixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list SL1000 permit ip 192.168.30.0 255.255.255.0 10.64.3.0 255.255.255.0 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside 10.64.2.130 255.255.255.0 ip address inside 192.168.30.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 192.168.1.10 255.255.255.255 inside pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list SL1000 route outside 0.0.0.0 0.0.0.0 10.64.2.timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute

inbound ah sas:

inbound pcp sas:
outbound esp sas: spi: 0x5f4579cf(1598388687) transform: esp-3des esp-sha-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2, crypto map: toSL1000
Copyright 2006, ASUSTek Computer, Inc. Page 7
sa timing: remaining key lifetime (k/sec): (74999/3463) IV size: 8 bytes replay detection support: Y

outbound ah sas:

outbound pcp sas:
Figure 3.5 Verify VPN tunnel establishment on the PIX firewall
Figure 3.6 Verify the VPN tunnel establishment on the SL1000/SL500

Page 8