Pages

▼

Pages

▼

What is IPsec NAT Exemption? How to configure IPsec tunnel with NAT Exempt?

 IPsec NAT Exemption


NAT (Network Address Translation) is used to translate private IP addresses into public IP addresses. NAT changes the source and destination IP addresses and ports. NAT Address translation reduces the need for IPv4 public addresses and it also hides private network address ranges. 


Internet protocol security (IPsec) is a framework that helps us to protect our IP traffic on the network layer. IPsec allows two or more hosts to communicate in a secure manner by authenticating and encrypting each IP packet of a communication session.


The nature of NAT and IPsec is different, NAT manipulates an IP packet and IPsec preserves the IP packets. IPsec does not work with NAT. we have to exclude (bypass NAT) the traffic to be encrypted from the NAT operation. Nat must not occur for proper IPsec network communication but NAT should be for inside hosts in order to access the internet. 


NAT exemption is a method that excludes traffic from being translated with NAT. NAT exemption is preferred when bypassing traffic flowing over a VPN tunnel.

R1(config)#ip access-list extended NAT-TRAFFIC

R1(config-ext-nacl)#5 deny ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255

NAT exemption is usually used in the following scenarios: 

Legacy policy-based IPsec VPNs

Remote access VPNs

Site-to-site VPN tunnels

When we have a lot of VPN tunnels with customers and we don't want to conflict with IPs on their network


let's see the configuration for a better understanding:


topology:-



Goal:
  1. First, configure the IP addresses as per the topology above 
  2. Configure the default route and static routes
  3. verify the Default and static routing with ping from pc 192.168.10.2 to 192.168.30.2 and vice versa 
  4. enable crypto isakmp on both sites
  5. configure extended ACL to tell the router which traffic is to encrypt.
  6. configure Crypto isakmp policy on both sites
  7. configure the crypto key on both sites make sure its identical 
  8. configure IPsec transform-set name will be IPsec-tunnel for both sites
  9. configure IPsec security association timer 1800 on both sites 
  10. configure crypto map name of the map will be map on both sites
  11. apply the crypto map on interface serial 4/0 on router 1 and serial 4/1 on router 2


First configure the IP addresses as per the topology above 


R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastEthernet 1/0
R1(config-if)#ip address 192.168.20.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface serial 4/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#do show ip int br
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            192.168.10.1    YES manual up                    up
FastEthernet1/0            192.168.20.1    YES manual up                    up
Serial4/0                  192.168.1.1     YES manual up                    up

             .....................................................................................................................


R2(config)#interface fastEthernet 0/0
R2(config-if)#ip address 100.100.100.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface serial 4/0
R2(config-if)#ip address 192.168.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config-if)#interface serial 4/1
R2(config-if)#ip address 192.168.3.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit



R2#show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0       100.100.100.2   YES manual up                    up
Serial4/0                  192.168.1.2     YES manual up                    up
Serial4/1                  192.168.3.2     YES manual up                    up

                .......................................................................................................................

R3(config)#interface fastEthernet 0/0
R3(config-if)#interface fastEthernet 0/0
R3(config-if)#ip address 192.168.30.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit

R3(config)#interface fastEthernet 1/0
R3(config-if)#ip address 192.168.40.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit

R3(config)#interface serial 4/1
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit



R3(config)#do show ip int br
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            192.168.30.1    YES manual up                    up
FastEthernet1/0            192.168.40.1    YES manual up                    up
Serial4/1                       192.168.3.1     YES manual up                    up


                     .......................................................................................



server (pc)> show ip

NAME        : server (pc)
IP/MASK     : 100.100.100.1/24
GATEWAY     : 100.100.100.2
DNS         :
MAC         : 00:50:79:66:68:00
LPORT       : 10048
RHOST:PORT  : 127.0.0.1:10049
MTU:        : 1500


PC2> show ip

NAME        : PC2[1]
IP/MASK     : 192.168.10.2/24
GATEWAY     : 192.168.10.1
DNS         :
MAC         : 00:50:79:66:68:01
LPORT       : 10050
RHOST:PORT  : 127.0.0.1:10051
MTU:        : 1500


PC6> show ip

NAME        : PC6[1]
IP/MASK     : 192.168.30.2/24
GATEWAY     : 192.168.30.1
DNS         :
MAC         : 00:50:79:66:68:03
LPORT       : 10054
RHOST:PORT  : 127.0.0.1:10055
MTU:        : 1500

verify the Default and static routing with ping from pc 192.168.10.2 to 192.168.30.2 and vice versa 


PC2> show ip
NAME        : PC2[1]
IP/MASK     : 192.168.10.2/24
GATEWAY     : 192.168.10.1
DNS         :
MAC         : 00:50:79:66:68:01
LPORT       : 10050
RHOST:PORT  : 127.0.0.1:10051
MTU:        : 1500

PC2> ping 192.168.30.2
84 bytes from 192.168.30.2 icmp_seq=1 ttl=62 time=90.305 ms
84 bytes from 192.168.30.2 icmp_seq=2 ttl=62 time=90.064 ms
84 bytes from 192.168.30.2 icmp_seq=3 ttl=62 time=90.262 ms
84 bytes from 192.168.30.2 icmp_seq=4 ttl=62 time=90.758 ms
84 bytes from 192.168.30.2 icmp_seq=5 ttl=62 time=91.022 ms

 PC6> show ip
NAME        : PC6[1]
IP/MASK     : 192.168.30.2/24
GATEWAY     : 192.168.30.1
DNS         :
MAC         : 00:50:79:66:68:03
LPORT       : 10054
RHOST:PORT  : 127.0.0.1:10055
MTU:        : 1500

PC6> ping 192.168.10.2
84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=91.472 ms
84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=91.446 ms
84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=91.430 ms
84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=91.040 ms
84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=90.697 ms


 

Configure the default route and static routes

 



R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.2

R1#show ip route

Gateway of last resort is 192.168.1.2 to network 0.0.0.0

C    192.168.10.0/24 is directly connected, FastEthernet0/0
C    192.168.20.0/24 is directly connected, FastEthernet1/0
C    192.168.1.0/24 is directly connected, Serial4/0
S*   0.0.0.0/0 [1/0] via 192.168.1.2



R2(config)#ip route 192.168.10.0 255.255.255.0 192.168.1.1
R2(config)#ip route 192.168.20.0 255.255.255.0 192.168.1.1
R2(config)#ip route 192.168.30.0 255.255.255.0 192.168.3.1
R2(config)#ip route 192.168.40.0 255.255.255.0 192.168.3.1

R2#show ip route static
S    192.168.30.0/24 [1/0] via 192.168.3.1
S    192.168.10.0/24 [1/0] via 192.168.1.1
S    192.168.40.0/24 [1/0] via 192.168.3.1
S    192.168.20.0/24 [1/0] via 192.168.1.1


R3(config)#ip route 0.0.0.0 0.0.0.0 192.168.3.2
R3(config)#end

R3#show ip route static
S*   0.0.0.0/0 [1/0] via 192.168.3.2




enable crypto isakmp on both sites


R1(config)#crypto isakmp enable
R3(config)#crypto isakmp enable


configure extended ACL to tell the router which traffic is to encrypt. 


R1(config)#ip access-list extended interest-traffic
R1(config-ext-nacl)#permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
R1(config-ext-nacl)#exit

R1#show access-lists
Extended IP access list interest-traffic
    10 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 (436 matches)


R3(config)#ip access-list extended interest-traffic
R3(config-ext-nacl)#permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
R3(config-ext-nacl)#exit

R3#show access-lists
Extended IP access list interest-traffic
    10 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255 



configure Crypto isakmp policy on both sites



R1(config)#crypto isakmp policy ?
  <1-10000>  Priority of protection suite

R1(config)#crypto isakmp policy 100
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#encryption aes 256
R1(config-isakmp)#hash sha
R1(config-isakmp)#group 5
R1(config-isakmp)#lifetime 3600
R1(config-isakmp)#exit
R1(config)#end

R1#show crypto isakmp policy

Global IKE policy
Protection suite of priority 100
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               3600 seconds, no volume limit



R3(config)#crypto isakmp policy ?
  <1-10000>  Priority of protection suite

R3(config)#crypto isakmp policy 100
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#encryption aes 256
R3(config-isakmp)#hash sha
R3(config-isakmp)#group 5
R3(config-isakmp)#lifetime 3600
R3(config-isakmp)#exit
R3(config)#end






configure the crypto key on both sites make sure its identical 

R1(config)#crypto isakmp key 6 internetworks address 192.168.3.1

R3(config)#crypto isakmp key 6 internetworks address 192.168.1.1

 R3#show crypto isakmp key
Keyring      Hostname/Address                            Preshared Key
default      192.168.1.1                                 (encrypted)

configure IPsec transform-set name will be ipsec-tunnel for both sites


R1(config)#crypto ipsec transform-set ipsec-tunnel esp-aes 256 esp-sha-hmac

R1#show crypto ipsec transform-set ipsec-tunnel
Transform set ipsec-tunnel: { esp-256-aes esp-sha-hmac  }
   will negotiate = { Tunnel,  },


R2(config)#crypto ipsec transform-set ipsec-tunnel esp-aes 256 esp-sha-hmac

R3#show crypto ipsec transform-set ipsec-tunnel
Transform set ipsec-tunnel: { esp-256-aes esp-sha-hmac  }
   will negotiate = { Tunnel,  },



configure IPsec security association timer 1800 on both sites 

 

R1(config)#crypto ipsec security-association lifetime seconds 1800
R2(config)#crypto ipsec security-association lifetime seconds 1800

R1#show crypto ipsec security-association lifetime
Security association lifetime: 4608000 kilobytes/1800 seconds

R2#show crypto ipsec security-association lifetime
Security association lifetime: 4608000 kilobytes/1800 seconds


configure crypto map name of the map will be map on both sites


R1(config)#crypto map map 100 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R1(config-crypto-map)#match address interest-traffic
R1(config-crypto-map)#set peer 192.168.3.1
R1(config-crypto-map)#set transform-set ipsec-tunnel
R1(config-crypto-map)#exit










\

*Oct 18 20:35:35.135: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON


R3(config)#crypto map map 100 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R3(config-crypto-map)#match address interest-traffic
R3(config-crypto-map)#set peer 192.168.1.1
R3(config-crypto-map)#set transform-set ipsec-tunnel
R3(config-crypto-map)#exit

R3#show crypto map
Crypto Map "map" 100 ipsec-isakmp
        Peer = 192.168.1.1
        Extended IP access list interest-traffic
            access-list interest-traffic permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
        Current peer: 192.168.1.1
        Security association lifetime: 4608000 kilobytes/1800 seconds
        Responder-Only (Y/N): N
        PFS (Y/N): N
        Transform sets={
                ipsec-tunnel:  { esp-256-aes esp-sha-hmac  } ,
        }
        Interfaces using crypto map map:
                Serial4/1


*Oct 18 20:35:35.135: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON


apply the crypto map on interface serial 4/0 on router 1 and serial 4/1 on router 2


R1(config-if)#crypto map map
R1(config-if)#exit

R1#show crypto map interface serial 4/0
Crypto Map "map" 100 ipsec-isakmp
        Peer = 192.168.3.1
        Extended IP access list interest-traffic
            access-list interest-traffic permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
        Current peer: 192.168.3.1
        Security association lifetime: 4608000 kilobytes/1800 seconds
        Responder-Only (Y/N): N
        PFS (Y/N): N
        Transform sets={
                ipsec-tunnel:  { esp-256-aes esp-sha-hmac  } ,
        }
        Interfaces using crypto map map:
                Serial4/0



R3(config-if)#crypto map map
R3(config-if)#exit






now send the ICMP ping packets from PC2 192.168.10.2 to PC6 192.168.20.2 and make sure the data must be encrypt, encapsualte by IPsec.


R1#show crypto ipsec sa
interface: Serial4/0
    Crypto map tag: map, local addr 192.168.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.30.0/255.255.255.0/0/0)
   current_peer 192.168.3.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 192.168.1.1, remote crypto endpt.: 192.168.3.1
     path mtu 1500, ip mtu 1500, ip mtu idb Serial4/0
     current outbound spi: 0x0(0)
     PFS (Y/N): N, DH group: none

R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
IPv6 Crypto ISAKMP SA

 

as of now no packet is encrypt let's send some packets. 

from pc2


 PC6> show ip
NAME        : PC6[1]
IP/MASK     : 192.168.30.2/24
GATEWAY     : 192.168.30.1
DNS         :
MAC         : 00:50:79:66:68:03
LPORT       : 10054
RHOST:PORT  : 127.0.0.1:10055
MTU:        : 1500

PC6> ping 192.168.10.2
192.168.10.2 icmp_seq=1 timeout
192.168.10.2 icmp_seq=2 timeout
84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=134.144 ms
84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=94.150 ms
84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=105.917 ms

PC6> ping 192.168.10.2
84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=98.854 ms
84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=92.000 ms
84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=118.293 ms
84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=123.813 ms
84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=93.092 ms

R3#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
192.168.3.1     192.168.1.1     QM_IDLE           1004 ACTIVE
IPv6 Crypto ISAKMP SA

R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
192.168.3.1     192.168.1.1     QM_IDLE           1004 ACTIVE
IPv6 Crypto ISAKMP SA




R3#show crypto ipsec sa

interface: Serial4/1
    Crypto map tag: map, local addr 192.168.3.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.30.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
   current_peer 192.168.1.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 266, #pkts encrypt: 266, #pkts digest: 266
    #pkts decaps: 265, #pkts decrypt: 265, #pkts verify: 265
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 0

     local crypto endpt.: 192.168.3.1, remote crypto endpt.: 192.168.1.1
     path mtu 1500, ip mtu 1500, ip mtu idb Serial4/1
     current outbound spi: 0x4B17CB78(1259850616)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x207351FF(544428543)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 15, flow_id: SW:15, sibling_flags 80000046, crypto map: map
        sa timing: remaining key lifetime (k/sec): (4458065/61)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE
      spi: 0x4E7BC766(1316734822)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 17, flow_id: SW:17, sibling_flags 80000046, crypto map: map
        sa timing: remaining key lifetime (k/sec): (4601703/1796)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

   

now lets configure NAT on both sites first configure the ACL extended

R1(config)#ip  access-list extended NAT-TRAFFIC
R1(config-ext-nacl)#permit ip 192.168.10.0 0.0.0.255 any
R1(config-ext-nacl)#permit ip 192.168.20.0 0.0.0.255 any
R1(config-ext-nacl)#exit

R1#show access-lists
Extended IP access list NAT-TRAFFIC
    10 permit ip 192.168.10.0 0.0.0.255 any
    20 permit ip 192.168.20.0 0.0.0.255 any
Extended IP access list interest-traffic
    10 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 (534 matches)


 R3(config)#ip access-list extended NAT-TRAFFIC
R3(config-ext-nacl)#permit ip 192.168.30.0 0.0.0.255 any
R3(config-ext-nacl)#permit ip 192.168.40.0 0.0.0.255 any
R3(config-ext-nacl)#exit

R3#show access-lists
Extended IP access list NAT-TRAFFIC
    10 permit ip 192.168.30.0 0.0.0.255 any
    20 permit ip 192.168.40.0 0.0.0.255 any
Extended IP access list interest-traffic
    10 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255 (532 matches)



now configure NAT overload on boths routers serial interface.

R1(config)#ip nat inside source list NAT-TRAFFIC interface serial 4/0 overload
R1(config)#exit

R3(config)#ip nat inside source list NAT-TRAFFIC interface serial 4/1 overload
R3(config)#exit


R1(config)#interface fastEthernet 0/0
R1(config-if)#ip nat inside
R1(config-if)#exit

R1(config)#interface serial 4/0
R1(config-if)#ip nat outside
R1(config-if)#exit


R3(config)#interface fastEthernet 0/0
R3(config-if)#ip nat inside
R3(config-if)#exit

R3(config)#interface serial 4/1
R3(config-if)#ip nat outside
R3(config-if)#exit


now send some ICMP packets from PC2 to Server 





PC2> ping 100.100.100.1
84 bytes from 100.100.100.1 icmp_seq=1 ttl=62 time=125.825 ms
84 bytes from 100.100.100.1 icmp_seq=2 ttl=62 time=72.721 ms
84 bytes from 100.100.100.1 icmp_seq=3 ttl=62 time=155.640 ms
84 bytes from 100.100.100.1 icmp_seq=4 ttl=62 time=152.201 ms
84 bytes from 100.100.100.1 icmp_seq=5 ttl=62 time=64.047 ms


R1#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.1.1:36691 192.168.10.2:36691 100.100.100.1:36691 100.100.100.1:36691
icmp 192.168.1.1:37203 192.168.10.2:37203 100.100.100.1:37203 100.100.100.1:37203
icmp 192.168.1.1:37715 192.168.10.2:37715 100.100.100.1:37715 100.100.100.1:37715
icmp 192.168.1.1:37971 192.168.10.2:37971 100.100.100.1:37971 100.100.100.1:37971
icmp 192.168.1.1:38227 192.168.10.2:38227 100.100.100.1:38227 100.100.100.1:38227
icmp 192.168.1.1:42323 192.168.10.2:42323 100.100.100.1:42323 100.100.100.1:42323
icmp 192.168.1.1:42579 192.168.10.2:42579 100.100.100.1:42579 100.100.100.1:42579
icmp 192.168.1.1:42835 192.168.10.2:42835 100.100.100.1:42835 100.100.100.1:42835
icmp 192.168.1.1:43091 192.168.10.2:43091 100.100.100.1:43091 100.100.100.1:43091
icmp 192.168.1.1:43347 192.168.10.2:43347 100.100.100.1:43347 100.100.100.1:43347


now send some ICMP packets from PC4 192.168.20.2 to PC8 192.168.40.2 


PC4> show ip

NAME        : PC4[1]
IP/MASK     : 192.168.20.2/24
GATEWAY     : 192.168.20.1
DNS         :
MAC         : 00:50:79:66:68:05
LPORT       : 10058
RHOST:PORT  : 127.0.0.1:10059
MTU:        : 1500

PC4> ping 192.168.40.2
84 bytes from 192.168.40.2 icmp_seq=1 ttl=61 time=192.024 ms
84 bytes from 192.168.40.2 icmp_seq=2 ttl=61 time=65.994 ms
84 bytes from 192.168.40.2 icmp_seq=3 ttl=61 time=105.218 ms
84 bytes from 192.168.40.2 icmp_seq=4 ttl=61 time=114.791 ms
84 bytes from 192.168.40.2 icmp_seq=5 ttl=61 time=175.063 ms
 

R1#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.1.1:5717  192.168.20.2:5717  192.168.40.2:5717  192.168.40.2:5717
icmp 192.168.1.1:6229  192.168.20.2:6229  192.168.40.2:6229  192.168.40.2:6229
icmp 192.168.1.1:6741  192.168.20.2:6741  192.168.40.2:6741  192.168.40.2:6741
icmp 192.168.1.1:6997  192.168.20.2:6997  192.168.40.2:6997  192.168.40.2:6997
icmp 192.168.1.1:7253  192.168.20.2:7253  192.168.40.2:7253  192.168.40.2:7253
icmp 192.168.1.1:8277  192.168.20.2:8277  192.168.40.2:8277  192.168.40.2:8277
icmp 192.168.1.1:8789  192.168.20.2:8789  192.168.40.2:8789  192.168.40.2:8789
icmp 192.168.1.1:9045  192.168.20.2:9045  192.168.40.2:9045  192.168.40.2:9045
icmp 192.168.1.1:9301  192.168.20.2:9301  192.168.40.2:9301  192.168.40.2:9301
icmp 192.168.1.1:9557  192.168.20.2:9557  192.168.40.2:9557  192.168.40.2:9557


(but these packets are not going through the IPsec tunnel which is configured, let's send some ICMP packets from the IPsec tunnel)

R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status

IPv6 Crypto ISAKMP SA



R1#ping 192.168.30.2 source fastEthernet 0/0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.30.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.10.1

*Oct 19 01:51:19.006: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.10.1, src_addr= 192.168.30.2, prot= 1..                                                                                                                   ...
Success rate is 0 percent (0/5)


R1#ping 192.168.30.2 source fastEthernet 0/0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.30.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.10.1
.....
Success rate is 0 percent (0/5)




here we are facing the issue because IPsec does not work with NAT, we have to exclude (bypass NAT) the traffic to be encrypted from the NAT operation. Nat must not occur for proper IPsec network communication but NAT should be for inside hosts in order to access the internet.   





R1#show access-lists
Extended IP access list NAT-TRAFFIC
    10 permit ip 192.168.10.0 0.0.0.255 any (17 matches)
    20 permit ip 192.168.20.0 0.0.0.255 any (16 matches)
Extended IP access list interest-traffic
    10 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 (544 matches)

(As you can see above ACL is checked. First NAT then interesting traffic)



R1(config)#ip access-list extended NAT-TRAFFIC
R1(config-ext-nacl)#5 deny ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
R1(config-ext-nacl)#6 deny ip 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255
R1(config-ext-nacl)#exit

R1#show access-lists
Extended IP access list NAT-TRAFFIC
    5 deny ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
    6 deny ip 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255
    10 permit ip 192.168.10.0 0.0.0.255 any (17 matches)
    20 permit ip 192.168.20.0 0.0.0.255 any (16 matches)
Extended IP access list interest-traffic
    10 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 (544 matches)



PC2> ping 192.168.30.2
192.168.30.2 icmp_seq=1 timeout
84 bytes from 192.168.30.2 icmp_seq=2 ttl=62 time=89.998 ms
84 bytes from 192.168.30.2 icmp_seq=3 ttl=62 time=90.835 ms
84 bytes from 192.168.30.2 icmp_seq=4 ttl=62 time=90.529 ms
84 bytes from 192.168.30.2 icmp_seq=5 ttl=62 time=90.260 ms

PC2> ping 192.168.40.2
192.168.40.2 icmp_seq=1 timeout
192.168.40.2 icmp_seq=2 timeout
84 bytes from 192.168.40.2 icmp_seq=3 ttl=61 time=90.150 ms
84 bytes from 192.168.40.2 icmp_seq=4 ttl=61 time=90.295 ms
84 bytes from 192.168.40.2 icmp_seq=5 ttl=61 time=90.177 ms



PC2> ping 100.100.100.1
100.100.100.1 icmp_seq=1 timeout
100.100.100.1 icmp_seq=2 timeout
84 bytes from 100.100.100.1 icmp_seq=3 ttl=62 time=60.522 ms
84 bytes from 100.100.100.1 icmp_seq=4 ttl=62 time=61.030 ms
84 bytes from 100.100.100.1 icmp_seq=5 ttl=62 time=61.211 ms




R1#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.1.1:9932  192.168.10.2:9932  100.100.100.1:9932 100.100.100.1:9932
icmp 192.168.1.1:10444 192.168.10.2:10444 100.100.100.1:10444 100.100.100.1:10444
icmp 192.168.1.1:10956 192.168.10.2:10956 100.100.100.1:10956 100.100.100.1:10956
icmp 192.168.1.1:11212 192.168.10.2:11212 100.100.100.1:11212 100.100.100.1:11212
icmp 192.168.1.1:11468 192.168.10.2:11468 100.100.100.1:11468 100.100.100.1:11468



R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
192.168.3.1     192.168.1.1     QM_IDLE           1005 ACTIVE

R1#show crypto ipsec sa

interface: Serial4/0
    Crypto map tag: map, local addr 192.168.1.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.30.0/255.255.255.0/0/0)
   current_peer 192.168.3.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 23, #pkts encrypt: 23, #pkts digest: 23
    #pkts decaps: 23, #pkts decrypt: 23, #pkts verify: 23
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 2, #recv errors 0

     local crypto endpt.: 192.168.1.1, remote crypto endpt.: 192.168.3.1
     path mtu 1500, ip mtu 1500, ip mtu idb Serial4/0
     current outbound spi: 0x1F5AD8F4(526047476)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xD8EADE65(3639271013)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 19, flow_id: SW:19, sibling_flags 80000046, crypto map: map
        sa timing: remaining key lifetime (k/sec): (4395227/1552)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x1F5AD8F4(526047476)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 20, flow_id: SW:20, sibling_flags 80000046, crypto map: map
        sa timing: remaining key lifetime (k/sec): (4395227/1552)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:




at

No comments:

Post a Comment