John,
One question at the time:
1) I noticed that I never set an isakmp pre-share key
- Remember that for a VPN client connection, ISAKMP or Phase I is
established using aggressive mode in this case and due the remote
connection would come from any place on the Internet; a pre-share key is not
used like in a L2L tunnel isakmp key etc... This is not a security
risk but if you want to be a little more specific, you can use digital
certificates, (rsa-signatures), so that will give you the opportunity to
trust more in the people getting connected. CRLs will be definitely
something I will suggest. For more details check this link:
http://www.cisco.com/warp/public/471/configipsecsmart.html
...you can avoid the eToken part
2) In testing I tried to get all traffic to flow through the VPN but I
think the pix prevents traffic coming in on the outside interface to leave
on that same interface
- The PIX firewall will never re-direct packets to the same interface they
have just arrived and this is in order to prevent IP spoofing, (that how ASA
works on the PIX). In the other hand, another interface is the solution for
this, but the 501 only comes with outside/inside, the four ports you see on
the back are all inside, (this is an embedded switch for SOHO users). But
remember that if you have another interface on the PIX, (a 515 or 525), that
interface should be connected to another ISP and you'll need another default
gateway; another default gateway is something you cannot achieve unless you
are running 6.3.1 and enable OSPF for that device but then again, this is a
design I will not recommend.
Summarizing, go with split-tunneling or use a IOS router or VPN
concentrator and that will do the trick for you.
Finally and in regards with the config, everything looks ok, no need to have
more than one isakmp polices but if you wish you can leave things the way
they are. Hope this helps a little.
My two cents,
Frank
Costa Rica
Original Message -
From: John Cianfarani
To:
Sent: Monday, August 25, 2003 6:25 PM
Subject: PIX VPN Setup [7:74369]
I'm setting up a small VPN just for home use so me and a few friends can
log in remotely via a PIX 501 w/ 3DES over my cable connection.
Now I've got it working, but found a few strange things I had questions
about. I have each user setup with the VPNGROUP config lines. (I will
post config below), everyone uses the Cisco VPN client to connect. Now
I noticed that I never set an isakmp pre-share key and there is no spot
to add one in the Cisco client only user/pass I would think that should
be needed for secure connectivety. The other setup I did was have a
split-tunnel applied to the user when they connect to only encrypt
traffic destined for the local network and any regular internet traffic
would still go out the persons internet connection. In testing I tried
to get all traffic to flow through the VPN but I think the pix prevents
traffic coming in on the outside interface to leave on that same
interface (as it would with internet traffic) . Any way to do this or do
you need another interface?
Also just wondering if there is a better way to write this config or any
other tips are appreciated.
Here is an edited config with only the relevant portions.
Thanks for any help
John
PIX Version 6.3(1)
!
access-list 80 permit ip any host 192.168.1.75
access-list 80 permit ip any host 192.168.1.76
access-list 80 permit ip any host 192.168.1.77
access-list 80 permit ip any host 192.168.1.78
access-list 80 permit ip any host 192.168.1.79
!
access-list 90 permit ip 192.168.1.0 255.255.255.0 host 192.168.1.75
access-list 90 permit ip 192.168.1.0 255.255.255.0 host 192.168.1.76
access-list 90 permit ip 192.168.1.0 255.255.255.0 host 192.168.1.77
access-list 90 permit ip 192.168.1.0 255.255.255.0 host 192.168.1.78
access-list 90 permit ip 192.168.1.0 255.255.255.0 host 192.168.1.79
!
ip address outside dhcp setroute
ip address inside 192.168.1.254 255.255.255.0
ip local pool REMOTEUSER 192.168.1.75-192.168.1.79
!
global (outside) 1 interface
nat (inside) 0 access-list 80
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
floodguard enable
!
crypto ipsec transform-set TRANSFORM esp-3des esp-md5-hmac
crypto dynamic-map DYNOMAP 10 set transform-set TRANSFORM
crypto map MYMAP 100 ipsec-isakmp dynamic DYNOMAP
crypto map MYMAP interface outside
!
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash sha
isakmp policy 20 group 1
isakmp policy 20 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash md5
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
isakmp policy 40 authentication
