VPN With Pre-Shared Keys
In this final installment from the Cisco Press book, Cisco Secure Internet Security Solutions, you will learn all about the usage and configuration of pre-shared keys, certificate authorities, and PIX-to_PIX firewall configuration.
Cisco Secure Internet Security Solutions - Chapter 4
by Andrew Mason, Mark Newcomb
Cisco Secure PIX Firewall - Part 9
VPN with Preshared Keys
Using preshared keys is easy, once you understand the concepts presented in the previous example. The difference between this configuration and the previous one is that you are now relying on the Internet Security Association and Key Management Protocol (ISAKMP) for exchanging keys. This section presents the configuration before exploring how it has changed. The main office's configuration is as follows:
hostname chicago domain-name bigcompany.com isakmp enable outside isakmp policy 15 authentication pre-share isakmp policy 15 encr 3des crypto isakmp key isakmpkey address 172.30.1.2 crypto ipsec transform-set strong esp-sha-hmac esp-3des access-list myaccesslist permit ip 10.1.2.0 255.255.255.0 crypto map seattletraffic 29 ipsec-isakmp crypto map seattletraffic 29 match address myaccesslist crypto map seattletraffic 29 set transform-set strong crypto map seattletraffic 29 set peer 172.30.1.2 crypto map seattletraffic interface outside sysopt connection permit-ipsecThe branch PIX Firewall configuration looks like this:
hostname seattle domain-name bigcompany.com isakmp enable outside isakmp policy 21 authentication pre-share isakmp policy 21 encryption 3des crypto isakmp key isakmpkey address 172.30.1.1 crypto ipsec transform-set strong esp-3des esp-sha-hmac access-list chicagolist permit ip 10.1.1.0 255.255.255.0 crypto map chicagotraffic 31 ipsec-isakmp crypto map chicagotraffic 31 match address chicagolist crypto map chicagotraffic 31 set transform-set strong crypto map chicagotraffic 31 set peer 172.30.1.1 crypto map chicagotraffic interface outside sysopt connection permit-ipsec
isakmp Commands
Before explaining the example, review Table 4-8 concerning the isakmp commands. The isakmp commands are very similar in syntax to the vpdn commands. As with most commands, using the no form of the command removes the configuration.
| Command | Description |
| isakmp client configuration address-pool local localpoolname | This command assigns a VPN client an address from within the addresses set aside by the ip local pool command. |
| isakmp enable interfacename | This enables ISAKMP on the interface specified by the parameter interfacename. |
| isakmp identity address | hostname | This identifies the system for IKE participation. |
| isakmp key keystring address peer-address | The keystring specifies the preshared key. The peer-address specifies the IP address of the peer. |
| isakmp peer fqdn fqdn no-xauth no-configmode |
The fqdn (fully qualified domain name) is the full DNS name of the peer. This is used to identify a peer that is a security gateway. The no-xauth option is to used if you enabled the Xauth feature and you have an IPSec peer that is a gateway. The no-config-mode option is used if you enabled the IKE Mode Configuration feature and you have an IPSec peer that is a security gateway. |
| isakmp policy priority authentication preshare | rsa-sig | This sets the priority for the authentication and defines whether you are using pre-shared keys or RSA signatures. | isakmp policy priority group1 | group2 | group1 and group2 are optionally used to specify whether a 768-bit Diffie-Hillman /prime modulus group (group1) or a 1024-bit Diffie-Hillman prime modulus group (group2) will be used on new exchanges. |
| isakmp policy priority hash md5 | sha | Specifies MD5 or SHA as the hash algorithm to be used in the IKE policy. |
| isakmp policy priority lifetime seconds | Specifies how many seconds each SA should exist before expiring. |
