CLI: Example for Configuring an IPSec Tunnel Through IKE Negotiation When a NAT Device Is Deployed Between Two Gateways (When the Peer IP Address Is Not Specified on the Headquarters Gateway)
Networking Requirement
The network environment of Figure 1 is as follows:
The headquarters network (10.1.1.0/24) is connected to FW_A through interface GigabitEthernet 0/0/1.
The branch network (10.1.2.0/24) is connected to FW_C through interface GigabitEthernet 0/0/1.
- FW_B serves as a NAT gateway. Branch users must pass through FW_B to access the headquarters network.
Data on the headquarters server is confidential and therefore cannot be transmitted on the Internet without protection. To ensure data security, an IPSec tunnel needs to be established between the headquarters and branch to encrypt the data when the branch employees access the headquarters server.
Data Plan
Item |
Data |
|---|---|
FW_A |
Interface number: GigabitEthernet 0/0/1 IP address: 10.1.1.1/24 Security zone: Trust |
FW_A |
Interface number: GigabitEthernet 0/0/2 IP address: 1.1.2.1/24 Security zone: Untrust |
FW_A |
IPSec configuration Authentication type: pre-shared key Pre-shared key: Test!1234 Local ID type: IP address Peer ID type: any |
FW_B |
Interface number: GigabitEthernet 0/0/1 IP address: 1.1.5.1/24 Security zone: Untrust |
FW_B |
Interface number: GigabitEthernet 0/0/2 IP address: 10.1.5.1/24 Security zone: Trust |
FW_B |
NAT configuration Easy IP |
FW_C |
Interface number: GigabitEthernet 0/0/1 IP address: 10.1.2.1/24 Security zone: Trust |
FW_C |
Interface number: GigabitEthernet 0/0/2 IP address: 10.1.5.2/24 Security zone: Untrust |
FW_C |
IPSec configuration Peer IP address: 1.1.2.1 Authentication type: pre-shared key Pre-shared key: Test!1234 Local ID type: IP address Peer ID type: any |
Configuration Roadmap
- If a NAT device exists between the headquarters and the branch, configure an IPSec policy using an IPSec policy template at the headquarters. Do not specify the peer IP address when you configure the IKE peer.
When configuring an IPSec proposal, set the security protocol to Encapsulation Security Payload (ESP). ESP is the default security protocol and therefore requires no configuration.
Procedure
- Perform basic configurations on FW_A.
- Configure interzone security policies.
Configure the security policies between the Trust and Untrust zones.
[FW_A] security-policy [FW_A-policy-security] rule name policy1 [FW_A-policy-security-rule-policy1] source-zone trust [FW_A-policy-security-rule-policy1] destination-zone untrust [FW_A-policy-security-rule-policy1] source-address 10.1.1.0 24 [FW_A-policy-security-rule-policy1] destination-address 10.1.2.0 24 [FW_A-policy-security-rule-policy1] action permit [FW_A-policy-security-rule-policy1] quit
[FW_A-policy-security] rule name policy2 [FW_A-policy-security-rule-policy2] source-zone untrust [FW_A-policy-security-rule-policy2] destination-zone trust [FW_A-policy-security-rule-policy2] source-address 10.1.2.0 24 [FW_A-policy-security-rule-policy2] destination-address 10.1.1.0 24 [FW_A-policy-security-rule-policy2] action permit [FW_A-policy-security-rule-policy2] quit
Configure the security policies between the Local and Untrust zones.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_A-policy-security] rule name policy3 [FW_A-policy-security-rule-policy3] source-zone local [FW_A-policy-security-rule-policy3] destination-zone untrust [FW_A-policy-security-rule-policy3] source-address 1.1.2.1 32 [FW_A-policy-security-rule-policy3] destination-address 1.1.5.1 32 [FW_A-policy-security-rule-policy3] action permit [FW_A-policy-security-rule-policy3] quit
[FW_A-policy-security] rule name policy4 [FW_A-policy-security-rule-policy4] source-zone untrust [FW_A-policy-security-rule-policy4] destination-zone local [FW_A-policy-security-rule-policy4] source-address 1.1.5.1 32 [FW_A-policy-security-rule-policy4] destination-address 1.1.2.1 32 [FW_A-policy-security-rule-policy4] action permit [FW_A-policy-security-rule-policy4] quit [FW_A-policy-security] quit
Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.
- Configure interzone security policies.
- Configure an IPSec policy on FW_A.
- Perform basic configurations on FW_C.
- Configure interzone security policies.
Configure the security policies between the Trust and Untrust zones.
[FW_C] security-policy [FW_C-policy-security] rule name policy1 [FW_C-policy-security-rule-policy1] source-zone trust [FW_C-policy-security-rule-policy1] destination-zone untrust [FW_C-policy-security-rule-policy1] source-address 10.1.2.0 24 [FW_C-policy-security-rule-policy1] destination-address 10.1.1.0 24 [FW_C-policy-security-rule-policy1] action permit [FW_C-policy-security-rule-policy1] quit
[FW_C-policy-security] rule name policy2 [FW_C-policy-security-rule-policy2] source-zone untrust [FW_C-policy-security-rule-policy2] destination-zone trust [FW_C-policy-security-rule-policy2] source-address 10.1.1.0 24 [FW_C-policy-security-rule-policy2] destination-address 10.1.2.0 24 [FW_C-policy-security-rule-policy2] action permit [FW_C-policy-security-rule-policy2] quit
Configure the security policies between the Local and Untrust zones.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_C-policy-security] rule name policy3 [FW_C-policy-security-rule-policy3] source-zone local [FW_C-policy-security-rule-policy3] destination-zone untrust [FW_C-policy-security-rule-policy3] source-address 10.1.5.2 32 [FW_C-policy-security-rule-policy3] destination-address 1.1.2.1 32 [FW_C-policy-security-rule-policy3] action permit [FW_C-policy-security-rule-policy3] quit
[FW_C-policy-security] rule name policy4 [FW_C-policy-security-rule-policy4] source-zone untrust [FW_C-policy-security-rule-policy4] destination-zone local [FW_C-policy-security-rule-policy4] source-address 1.1.2.1 32 [FW_C-policy-security-rule-policy4] destination-address 10.1.5.2 32 [FW_C-policy-security-rule-policy4] action permit [FW_C-policy-security-rule-policy4] quit [FW_C-policy-security] quit
Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.
- Configure interzone security policies.
- Configure an IPSec policy on FW_C.
- Configure FW_B (NAT gateway).
Verification
After the configuration is complete, PC2 initiates the access. Then PC1 and PC2 can access each other, and PC2 can access the public network.
PC2 can ping through 1.1.2.1, which is the IP address of an interface on FW_A. In addition, you can view NAT session entries on FW_B.
<FW_B> display firewall session table Current Total Sessions : 2 udp VPN:public --> public 10.1.5.2:500[1.1.5.1:2048]-->1.1.2.1:500 udp VPN:public --> public 10.1.5.2:4500[1.1.5.1:2048]-->1.1.2.1:4500On FW_A, you can view IKE SA information.
<FW_A> display ike sa IKE SA information : Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID ----------------------------------------------------------------------------- 83887864 1.1.5.1:500 RD|A v2:2 IP 1.1.5.1 83887652 1.1.5.1:500 RD|A v2:1 IP 1.1.5.1 Number of IKE SA : 2 ------------------------------------------------------------------------------- Flag Description: RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATINGOn FW_C, you can view the IKE SA whose peer end is the headquarters. FW_C is the initiator and the flag bit is ST.
<FW_C> display ike sa IKE SA information : Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID ----------------------------------------------------------------------------- 62887864 1.1.2.1:500 RD|ST|A v2:2 IP 1.1.2.1 62887652 1.1.2.1:500 RD|ST|A v2:1 IP 1.1.2.1 Number of IKE SA : 2 ------------------------------------------------------------------------------- Flag Description: RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATING- On FW_A, you can view a pair of IPSec SAs corresponding to FW_C.
<FW_A> display ipsec sa brief Current ipsec sa num:2 Spu board slot 1, cpu 1 ipsec sa information: Number of SAs:2 Src address Dst address SPI VPN Protocol Algorithm ------------------------------------------------------------------------------- 1.1.2.1 1.1.5.1 3923280450 ESP E:AES-256 A:SHA2_256_128 1.1.5.1 1.1.2.1 2676437093 ESP E:AES-256 A:SHA2_256_128 - On FW_C, you can view a pair of IPSec SAs.
<FW_C> display ipsec sa brief Current ipsec sa num:2 Spu board slot 1, cpu 1 ipsec sa information: Number of SAs:4 Src address Dst address SPI VPN Protocol Algorithm ------------------------------------------------------------------------------- 10.1.5.2 1.1.2.1 2179965693 ESP E:AES-256 A:SHA2_256_128 1.1.2.1 10.1.5.2 3813759530 ESP E:AES-256 A:SHA2_256_128
Configuration Files
-
# sysname FW_A # acl number 3000 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer c pre-shared-key %^%#LV|sQ=~fUQO:M$CeqaMEnwVD%^%# ike-proposal 10 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ipsec policy-template temp 1 security acl 3000 ike-peer c proposal tran1 # ipsec policy map1 10 isakmp template temp # interface GigabitEthernet0/0/1 undo shutdown ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet0/0/2 undo shutdown ip address 1.1.2.1 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/1 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/2 # ip route-static 10.1.2.0 255.255.255.0 1.1.2.2 ip route-static 10.1.5.0 255.255.255.0 1.1.2.2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.1.0 24 destination-address 10.1.2.0 24 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.2.0 24 destination-address 10.1.1.0 24 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.2.1 32 destination-address 1.1.5.1 32 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.5.1 32 destination-address 1.1.2.1 32 action permit # return
-
# sysname FW_C # acl number 3000 rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer a pre-shared-key %^%#9AGL!*(KJM2ImuCYi!QP,{6N%^%# ike-proposal 10 remote-address 1.1.2.1 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ipsec policy map1 10 isakmp security acl 3000 ike-peer a proposal tran1 # interface GigabitEthernet0/0/1 undo shutdown ip address 10.1.2.1 255.255.255.0 # interface GigabitEthernet0/0/2 undo shutdown ip address 10.1.5.2 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/1 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/2 # ip route-static 1.1.2.0 255.255.255.0 10.1.5.1 ip route-static 10.1.1.0 255.255.255.0 10.1.5.1 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.2.0 24 destination-address 10.1.1.0 24 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.1.0 24 destination-address 10.1.2.0 24 action permit rule name policy3 source-zone local destination-zone untrust source-address 10.1.5.2 32 destination-address 1.1.2.1 32 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.2.1 32 destination-address 10.1.5.2 32 action permit # return
-
# sysname FW_B # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.5.1 255.255.255.0 # interface GigabitEthernet0/0/2 undo shutdown ip address 10.1.5.1 255.255.255.0 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/2 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 10.1.1.0 255.255.255.0 1.1.5.2 ip route-static 10.1.2.0 255.255.255.0 10.1.5.2 ip route-static 1.1.2.0 255.255.255.0 GigabitEthernet 0/0/1 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.5.2 32 destination-address 1.1.2.1 32 action permit rule name policy2 source-zone untrust destination-zone trust source-address 1.1.2.1 32 destination-address 10.1.5.2 32 action permit # nat-policy rule name policy_nat1 source-zone trust destination-zone untrust source-address 10.1.5.0 24 action source-nat easy-ip # return