VPN With Pre-Shared Keys

In this final installment from the Cisco Press book, Cisco Secure Internet Security Solutions, you will learn all about the usage and configuration of pre-shared keys, certificate authorities, and PIX-to_PIX firewall configuration.

By Cisco Press | Posted Oct 30, 2001
Page 1 of 6
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

Cisco Secure Internet Security Solutions - Chapter 4
by Andrew Mason, Mark Newcomb

Cisco Secure PIX Firewall - Part 9
VPN with Preshared Keys

Cisco Secure Internet Security Solutions - click to go to publisher's site

Using preshared keys is easy, once you understand the concepts presented in the previous example. The difference between this configuration and the previous one is that you are now relying on the Internet Security Association and Key Management Protocol (ISAKMP) for exchanging keys. This section presents the configuration before exploring how it has changed. The main office's configuration is as follows:

 hostname chicago
 domain-name bigcompany.com
 isakmp enable outside
 isakmp policy 15 authentication pre-share
 isakmp policy 15 encr 3des
 crypto isakmp key isakmpkey address 172.30.1.2
 crypto ipsec transform-set strong esp-sha-hmac esp-3des
 access-list myaccesslist permit ip 10.1.2.0 255.255.255.0
 crypto map seattletraffic 29 ipsec-isakmp
 crypto map seattletraffic 29 match address myaccesslist
 crypto map seattletraffic 29 set transform-set strong
 crypto map seattletraffic 29 set peer 172.30.1.2
 crypto map seattletraffic interface outside
 sysopt connection permit-ipsec
The branch PIX Firewall configuration looks like this:
 hostname seattle
 domain-name bigcompany.com
 isakmp enable outside
 isakmp policy 21 authentication pre-share
 isakmp policy 21 encryption 3des
 crypto isakmp key isakmpkey address 172.30.1.1
 crypto ipsec transform-set strong esp-3des esp-sha-hmac
 access-list chicagolist permit ip 10.1.1.0 255.255.255.0
 crypto map chicagotraffic 31 ipsec-isakmp
 crypto map chicagotraffic 31 match address chicagolist
 crypto map chicagotraffic 31 set transform-set strong
 crypto map chicagotraffic 31 set peer 172.30.1.1
 crypto map chicagotraffic interface outside
 sysopt connection permit-ipsec

isakmp Commands
Before explaining the example, review Table 4-8 concerning the isakmp commands. The isakmp commands are very similar in syntax to the vpdn commands. As with most commands, using the no form of the command removes the configuration.

Table 4-8: isakmp Commands
`
CommandDescription
isakmp client configuration address-pool local localpoolname This command assigns a VPN client an address from within the addresses set aside by the ip local pool command.
isakmp enable interfacenameThis enables ISAKMP on the interface specified by the parameter interfacename.
isakmp identity address | hostnameThis identifies the system for IKE participation.
isakmp key keystring address peer-address The keystring specifies the preshared key. The peer-address specifies the IP address of the peer.
isakmp peer fqdn fqdn no-xauth no-configmode

The fqdn (fully qualified domain name) is the full DNS name of the peer. This is used to identify a peer that is a security gateway.

The no-xauth option is to used if you enabled the Xauth feature and you have an IPSec peer that is a gateway.

The no-config-mode option is used if you enabled the IKE Mode Configuration feature and you have an IPSec peer that is a security gateway.

isakmp policy priority authentication preshare | rsa-sigThis sets the priority for the authentication and defines whether you are using pre-shared keys or RSA signatures.
isakmp policy priority group1 | group2group1 and group2 are optionally used to specify whether a 768-bit Diffie-Hillman /prime modulus group (group1) or a 1024-bit Diffie-Hillman prime modulus group (group2) will be used on new exchanges.
isakmp policy priority hash md5 | shaSpecifies MD5 or SHA as the hash algorithm to be used in the IKE policy.
isakmp policy priority lifetime secondsSpecifies how many seconds each SA should exist before expiring.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter