Category Archives: Cisco Systems

IPsec Site-to-Site VPN Palo Alto <-> Cisco Router w/ VTI

Cisco Systems, IPsec/VPN, Palo Alto Networks, , ,

One more VPN article. Even one more between a Palo Alto firewall and a Cisco router. But this time I am using a virtual tunnel interface (VTI) on the Cisco router which makes the whole VPN set a “route-based VPN”. That is: Both devices decide their traffic flow merely based on the routing table and not on access-list entries. In my opinion, this is the best way to build VPNs, because there is a single instance (the routing table) on which a network admin must rely on in order to investigate the traffic flow.

Note that I also wrote a blog post about the “policy-based VPN” between a Cisco router and the Palo Alto firewall. This here is mostly the same on the Palo Alto side while some other commands are issued on the Cisco router.

Continue reading IPsec Site-to-Site VPN Palo Alto <-> Cisco Router w/ VTI →

IPsec Site-to-Site VPN Cisco Router <-> AVM FRITZ!Box

Cisco Systems, FRITZ!Box, IPsec/VPN, Template, , ,

Der Titel sagt eigentlich schon alles: Es geht um das Herstellen eines S2S-Tunnels zwischen einem Cisco Router (statische IPv4) und einer FRITZ!Box (dynamische IP). Ich liste nachfolgend alle Befehle für den IOS Router sowie die Konfigurationsdatei für die FRITZ!Box auf. Für eine etwas detaillierte Beschreibung des VPNs für die FRITZ!Box verweise ich auf diesen Artikel von mir, bei dem ich zwar ein VPN zu einem anderen Produkt hergestellt habe, aber etwas mehr auf die Schritte der Konfiguration eingegangen bin.

Continue reading IPsec Site-to-Site VPN Cisco Router <-> AVM FRITZ!Box →

IPsec Site-to-Site VPN Juniper ScreenOS <-> Cisco Router

Cisco Systems, IPsec/VPN, Juniper Networks, , , ,

Similar to all my other site-to-site VPN articles, here are the configurations for a VPN tunnel between a Juniper ScreenOS SSG firewall and a Cisco IOS router. Due to the VPN Monitor of the SSG firewall, the tunnel is established directly after the configuration and stays active all the time without the need of “real” traffic.

I am using the policy-based VPN solution on the Cisco router and not the virtual tunnel interface (VTI) approach. That is: No route is needed on the router while the Proxy IDs must be set on the Juniper firewall. (However, I also documented the route-based VPN solution between a ScreenOS firewall and a Cisco router here.)

Continue reading IPsec Site-to-Site VPN Juniper ScreenOS <-> Cisco Router →

IPsec Site-to-Site VPN Palo Alto <-> Cisco Router

Cisco Systems, IPsec/VPN, Palo Alto Networks, , ,

This time I configured a static S2S VPN between a Palo Alto firewall and a Cisco IOS router. Here comes the tutorial:

I am not using a virtual interface (VTI) on the Cisco router in this scenario, but the classical policy-based VPN solution. That is, no route entry is needed on the Cisco machine. However, the Palo Alto implements all VPNs with tunnel interfaces. Hence, a route to the tunnel and Proxy IDs must be configured. (I also wrote a guide for a route-based VPN between a Cisco router and a Palo Alto firewall here.)

Continue reading IPsec Site-to-Site VPN Palo Alto <-> Cisco Router →

Cisco Router: Disable DNS Rewrite ALG for Static NATs

Cisco Systems, Memorandum, NAT, , ,

I am using a Cisco router for my basic ISP connection with a NAT/PAT configuration that translates all client connections to the IPv4 address of the outside interface of the router. Furthermore,  I am translating all my static public IPv4 addresses to private ones through static NAT entries. I basically thought, that only the IPv4 addresses in the mere IPv4 packet header would be translated. However, this was not true since I immediately discovered that public DNS addresses are translated to my private IPv4 addresses, too. This was a bit confusing since I have not explicitly configured an application layer gateway (ALG) on that router.

“Google is my friend” and helped me one more time to find out the appropriate solution: The “no ip nat service alg udp dns” keyword to disable the DNS rewrite. (The synonym from Cisco for DNS rewrite is: DNS doctoring.) Here comes a basic example:

Continue reading Cisco Router: Disable DNS Rewrite ALG for Static NATs →

Basic ISP Load Balancing with a Cisco Router

Cisco Systems, Internet Access, Routing, Tutorial/Howto, ,

“We have two independent DSL connections to the Internet and want to share the bandwidth for our users.” This was the basic requirement for a load balancing solution at the customer’s site. After searching a while for dedicated load balancers and thinking about a Do-It-Yourself Linux router solution, I used an old Cisco router (type 2621, about 40,- € on eBay at the time of writing) with two default routes, each pointing to one of the ISP routers. That fits. ;)

Continue reading Basic ISP Load Balancing with a Cisco Router →

IPsec Site-to-Site VPN Cisco ASA <-> AVM FRITZ!Box

Cisco ASA, FRITZ!Box, IPsec/VPN, Template, , ,

Mit diesem Beitrag möchte ich zeigen, wie man ein Site-to-Site VPN von der FRITZ!Box zu einer Cisco ASA Firewall aufbaut. Mein Laboraufbau entspricht dabei dem typischen Fall, bei dem die FRITZ!Box hinter einer dynamischen IP hängt (klassisch: DSL-Anschluss), während die ASA eine statische IP geNATet bekommt.

Beide Geräte habe ein policy-based VPN implementiert, so dass das hier endlich mal ein Fall ist, wo man nicht durch den Mix einer route-based VPN-Firewall und einer policy-based VPN-Firewall durcheinander kommt. Man muss bei beiden Geräten einfach das eigene sowie das remote Netzwerk eintragen, ohne weitere Routen zu ändern.

Continue reading IPsec Site-to-Site VPN Cisco ASA <-> AVM FRITZ!Box →

IPsec Site-to-Site VPN Juniper ScreenOS <-> Cisco ASA

Cisco ASA, IPsec/VPN, Juniper Networks, , , ,

This post describes the steps to configure a Site-to-Site VPN between a Juniper ScreenOS firewall and the Cisco ASA firewall. With the correct IKE and IPsec parameters as well as the correct Proxy IDs on both sides, the VPN establishment works without any problems. And since the Juniper firewall can ping an IPv4 address on the remote side through the tunnel (VPN Monitor), the VPN tunnel is established by the firewalls themselves without the need for initial traffic.

Continue reading IPsec Site-to-Site VPN Juniper ScreenOS <-> Cisco ASA →

IPsec Site-to-Site VPN Palo Alto <-> Cisco ASA

Cisco ASA, IPsec/VPN, Palo Alto Networks, , ,

I configured a static Site-to-Site IPsec VPN tunnel between the Cisco ASA firewall and the Palo Alto next-generation firewall. If the same phase 1 & 2 parameters are used and the correct Proxy IDs are entered, the VPN works without any problems though the ASA uses a policy-based VPN while the PA implements a route-based VPN.

I made a few screenshots from the VPN configuration of both firewalls which I will show here. I am also listing a few more hints corresponding to these two firewalls.

Continue reading IPsec Site-to-Site VPN Palo Alto <-> Cisco ASA →

Cisco AnyConnect: IPv6 Access through IPv4 VPN Tunnel

Cisco ASA, IPsec/VPN, IPv6, , ,

When travelling to guest Wifis, e.g., at different customers sites, hotels, or public Wifis in general, I often have only IPv4 access to the Internet. Since I do not want to use IPv6 tunnelling protocols such as Teredo, I decided to use the Cisco AnyConnect Secure Mobility Client to tunnel IPv6 between my test laboratory (Cisco ASA) and my computer. With a few changes on the ASA, my computer now gets a private IPv4 address and a global unicast IPv6 address out of my space at home. Since I am using a VPN tunnel to access the Internet from untrusted Wifis anyway, the overall process did not change that much.

In the following, I am showing a few screenshots but not a complete configuration guide for the AnyConnect Client.

Continue reading Cisco AnyConnect: IPv6 Access through IPv4 VPN Tunnel →

MRTG/Routers2: Adding a Cisco Router

Cisco Systems, MRTG/Routers2, Network, Tutorial/Howto, , , ,

This post shortly explains the process of adding a Cisco router into the monitoring system “MRTG with Routers2” as I explained it here. It gives an example on how SNMP is activated on the router and how the *.cfg file for MRTG/Routers2 is created with the additional values for CPU and memory usage.

Continue reading MRTG/Routers2: Adding a Cisco Router →

Layer 2 Redundancy with STP: Palo Alto Firewall + Cisco Switches

Cisco Systems, Palo Alto Networks, Switching, , , ,

I built a basic test laboratory with a Palo Alto Networks PA-200 firewall and two Cisco Catalyst 2950 switches in order to test the Spanning Tree Protocol (STP) for achieving Layer 2 redundancy for the physical connections to/from the firewall. This post lists the configurations, “show spanning-tree” outputs from the switches and a few other outputs after several tests. Not all tests ran without any problems so I think there must be something wrong with my configurations, the test sequences, with the STP process, or with the MAC address tables. Maybe some readers have similar experiences?

[UPDATE] Problem solved! I missed the layer 2 zones. Description at the bottom. [/UPDATE]

Continue reading Layer 2 Redundancy with STP: Palo Alto Firewall + Cisco Switches →