Cisco Ipsec VPN

I have seen some discussion regarding IPSEC VPN's on Cisco devices. Below is a quick tutorial on Cisco IPSEC VPN's. This tutorial is written for 12.4 versions of the IOS.

When creating these connections, you must consider:

• Crypto settings
• ACL's
• Outside interfaces

You can have many SA (security associations) for a crypto map, and inside of a specific SA you can have multiple peers in the list. The VPN engine will process the peers in the order they are listed. This is useful when you are using tracking objects for failover and therefore may have the remote peer coming from multiple IP addresses.

ACL's will be used to control which traffic will be forwarded through the IPSec connection. This will read as "allow all traffic on my local side to send to any local ip address at the remote side". This can be adjusted as you see fit. Assume that I am connection two class C networks via an IPSec VPN. My access list may read as:

• 10 permit ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255

I am sure there is a way to connect when both subnets are the same using NAT; however I feel that this is bad form. In those cases where I have found that both ranges are the same, I will change one of the ranges. This can be a pain in the ass, but in the long run is a best practice.

As you can see from the sample configurations, this is a peer relationship. Regardless of speed or hardware, there is not Master or Secondary. Cisco calls these configurations Mirrors. The configurations are the same with certain variables reversed.

I cannot recommend enough; DO NOT use the SDM for this. Unless you enjoy 400 line ACL's, you will have a much more pleasurable experience creating these manually. The process is simple and very quick once you get used to it.

I hope this helps you. Please let me know if you spot any typos or mistakes that I made during the creation of this.

LEGEND

• our_key = a key which will be used on both sides. This can be any string of characters.
• Side_A_IP = the public IP address of Side A. This will be the ip address for the interface which has the crypto map attached to it.
• Side_B_IP = the public IP address of Side B. This will be the ip address for the interface which has the crypto map attached to it.
• Crypto_map_name = this is the name of the crypto map. It can be any string of characters.
• Crypto_integer = this is an integer which attaches an ipsec connection to the crypto map.
• ACL_To_Site_B = this is an ACL which will exist at site A to connect to site B.
• ACL_Tp_Site_A = this is an ACL which will exist at site B to connect to site A.
• Public_Interface = this is the public interface which the VPN will be connecting through.
• Site_A_Internal_IP_Range = this is the internal ip range at site A. In the config i am assuming a class C.
• Site_B_Internal_IP_Range = this is the internal ip range at site B. In the config i am assuming a class C.

EXAMPLE Side A 
Crypto isakmp policy 1   encr 3des   authentication pre-share 
group 2 Crypto isakmp key our_key address Side_B_IP no-xauth 
crypto ipsec transform-set trans esp-3des esp-sha-hmac 
Crypto map crypto_map_name crypto_integer ipsec-isakmp 
set peer Side_B_IP 
set transform set trans   match address ACL_To_Site_B 
Interface Public_Interface 
crypto map crypto_map_name  
ip access-list extended ACL_To_Site_B 
10 permit ip Site_A_Internal_
IP_Range 0.0.0.255 Site_B_Internal_IP_Range 0.0.0.255 
EXAMPLE Side B   Crypto isakmp policy 1   encr 3des 
authentication pre-share   group 2
Crypto isakmp key our_key address Side_A_IP no-xauth 
crypto ipsec transform-set trans esp-3des esp-sha-hmac 
Crypto map crypto_map_name crypto_integer ipsec-isakmp 
set peer Side_A_IP   set transform set trans  
match address ACL_To_Site_A 
Interface Public_Interface   crypto map crypto_map_name 
ip access-list extended ACL_To_Site_A 
10 permit ip Site_B_Internal_IP_Range 0.0.0.255
Site_A_Internal_IP_Range 0.0.0.255 

Wireless Network and Router Security Tips

Reminded by the latest Cisco security alert, many network managers do not realize that their routers can be the jump point to attack. Router operating systems are just as vulnerable to hacker mischief as network operating systems. Most medium to small sized companies do not employ router engineers, or outsource this function on a need to do basic. And because of this, network administrators, and managers, either do not know enough to secure the router or do not have time. Listed below are the 10 basic router security tips.

1. Update your router's OS. Just like network operating systems, router operating systems need to be updated to correct programming oversights, flaws, and buffer overflow issues. Always check with your router manufacture for current updates and OS versions.

2. Change the default password. As much as 80 % of security incidents are caused by weak or default passwords, (This is according to CERT at Carnegie Mellon University) Avoid using common passwords and use mixed case letters as a stronger password policy .

3. Disable HTTP configuration and SNMP. The HTTP configuration part of your router may be easier to configure for a busy network admin, but it is also a security problem for routers. If your router has a command line configuration, disable the HTTP config mode and use it. If you are not using SNMP on your router, then there is no need to have it enabled. Cisco has a SNMP vulnerability with GRE tunnel attacks.

4. Block ICMP ping requests. Ping and other ICMP functions are useful tools for both the network admin and the hacker. ICMP enabled on your router can be used by hacker to identify information to target your network for attack.

5. Disable Telnet use from the Internet. In most cases you do not need an active telnet session from an Internet interface. Access to your router's configuration is more secure if accessed internally.

6. Disable IP directed broadcast. IP directed broadcast can allow Denial of Service (DOS) attacks on your equipment. A router's memory and CPU can be maxed out from too many requests, which can result in a buffer overflow entry.

7. Disable IP source routing and IP redirects. Redirects allow packets to come in from one interface and leave by another. You don't want engineered packets to redirect to a private internal network.

8. Packet filtering. Packet filtering routes only the types of packet you want to enter your network. Many companies only allow 80 (http) and 110/25 (email). Additionally you can block and allow IP Addresses and Ranges.

9. Review Security Logs. By simply taking the time to review your log files you will see obvious patterns of attack, and or even vulnerabilities. You will be surprised to how much activity your router is subject to.

10. Unnecessary Services. Unnecessary services should always be disable, whether they are on a router, server, or workstation. By default, Cisco devices up through IOS version 11.3 offer the "small services": echo, chargen, and discard. These services, especially their UDP versions, are infrequently used for legitimate purposes, but can be used to launch denial of service and other attacks that would otherwise be prevented by packet filtering.

Linksys

Linksys by Cisco, commonly known as Linksys, was a major provider of home and small office network products, founded in 1988 and acquired by Cisco Systems in 2003[1]. Linksys manufactured broadband and wireless routers, consumer and small business grade Ethernet switching, VoIP equipment, wireless internet video camera, AV products, network storage systems, and other products. Linksys products were widely available in North America off-the-shelf from both consumer electronics stores (CompUSA and Best Buy), internet retailers, and big-box retail stores (WalMart). Linksys' significant competition as an independent firm were D-Link and NetGear, the latter for a time being a brand of Cisco competitor Nortel.

In 2007, Cisco CEO John Chambers described the longterm plan to kill the independent Linksys brand: "It will all come over time into a Cisco brand. The reason we kept Linksys' brand because it was better known in the US than even Cisco was for the consumer. As you go globally there's very little advantage in that." From 2008, all Linksys products sold were packaged and branded as "Linksys by Cisco"; some former Linksys products were merged into the "Valet" brand (albeit with a large Cisco logo and smaller Linksys name still on the product). The formerly-independent Linksys website presently redirects to Cisco's. Small-business inquiries into former Linksys products are directed to Cisco's products and reseller network.

Cisco Aironet 350 Wireless LAN Client Adapter - Cisco Systems

Wireless client adapters are the key to adding mobility and flexibility to an enterprise-increasing productivity by enabling users to have network and Internet access anywhere within a building without the limitation of wires. The Cisco Aironet 350 Series Client Adapters are a complement to Aironet 350 Series infrastructure devices, providing an enterprise-ready solution that combines mobility with the performance, security, and manageability that people have come to expect from Cisco. Wireless client adapters connect a variety of devices to a wireless network either in ad hoc peer-to-peer mode or in infrastructure mode with APs. Available in PC Card (PCMCIA) and Peripheral Component Interconnect (PCI) form factors, Cisco Aironet 350 Series Client Adapters quickly connect desktop and mobile computing devices wirelessly to all network resources. With this product, you can instantly add new employees to the network, support temporary workgroups, or enable Internet access in conference rooms or other meeting spaces.

Wireless Access for Notebooks, Desktops, and Tower PCs

Give your computer network access from anywhere in the building without the cost and hassle of running Ethernet cables. One of the Cisco Small Business Wireless Adapters, the WUSB200 Wireless-G USB Network Adapter with RangeBooster uses a single USB port give high-quality wireless access to both notebook and desktop computers. The device's RangeBooster technology nearly doubles the connection range of a typical Wireless-G product and increases throughputs by up to 35 percent.

Unlike ordinary wireless technologies that are confused by signal reflections, RangeBooster utilizes two smart receivers at each end to detect and decode reflected signals at distances where standard technologies give up.

Additional features of the Cisco WUSB200 Wireless-G Business USB Adapter include:

• Advanced wireless security supporting WEP, WPA, and WPA2 encryption
• Interoperation with standard Wireless-G and Wireless-B wireless protocols
• Wireless security monitoring that alerts you to possible intruders and network vulnerabilities when used in conjunction with a Cisco WAP200 Access Point

Wireless Networks Connect Anytime, Anywhere

The Cisco Unified Wireless Network is a unified wired and wireless network solution that cost-effectively addresses the wireless network security, deployment, management, and control issues your enterprise faces. It combines the best elements of wireless and wired networking to deliver secure, scalable wireless networks with a low total cost of ownership.

Maintain your competitive advantage through the freedom and flexibility of a Cisco Unified Wireless Network. A secure, scalable, cost-effective solution, wireless networks offer:

• Anytime, anywhere access to information, promoting collaboration with colleagues, business partners, and customers
• Real-time access to instant messaging, e-mail, and network resources, boosting productivity and speeding business decision making
• Mobility services, such as voice, guest access, advanced security, and location, that help you transform business operations
• Modular architecture that supports 802.11n, 802.11a/b/g, and enterprise wireless mesh for indoor and outdoor locations, while ensuring a smooth migration path to future technologies and services

This powerful solution delivers business-class connectivity that facilitates deployment of innovative applications to simplify business operations and improve productivity.