The document outlines how to set up a GRE tunnel between two RAPTORs.
The tunnel traffic is encrypted with IPSEC. The routing table will be learnt automatically with OSPF.
A sample working configuration of a GRE tunnel between two RAPTORs is as follows.
Type the following:
iSCom# configure terminaliSCom(config)# set security enableiSCom(config)# vlan 5iSCom(config-vlan)# vlan activeiSCom(config-vlan)# name "Protected Network"iSCom(config-vlan)# exitiSCom(config)# vlan 3iSCom(config-vlan)# vlan activeiSCom(config-vlan)# name "Protected Network"iSCom(config-vlan)# exitiSCom(config)# interface gigabit 0/16iSCom(config-if)# switchport mode trunkiSCom(config-if)# description "Connected to Local Network"iSCom(config-if)# description "Connected to Local Network"iSCom(config-if)# exitiSCom(config-if)# interface vlan 5iSCom(config-if)# ip address 172.16.50.1 255.255.255.0iSCom(config-if)# no shutdowniSCom(config-if)# exitiSCom(config-if)# interface vlan 3iSCom(config-if)# ip address 172.16.51.1 255.255.255.0iSCom(config-if)# no shutdowniSCom(config-if)# description "Protected Network"iSCom(config-if)# exitiSCom(config-if)# interface loop 1iSCom(config-if)# no shutdowniSCom(config-if)# ip address 1.1.1.1 255.255.255.255iSCom(config-if)# description "Router ID"iSCom(config-if)# exitiSCom(config)# interface gigabit 0/24iSCom(config-if)# shutdowniSCom(config-if)# no switchportiSCom(config-if)# set wan enableiSCom(config-if)# ip add 170.50.31.1 255.255.255.0 cybseciSCom(config-if)# no shutdowniSCom(config-if)# description "WAN Port"iSCom(config-if)# exitiSCom(config)# vlan 50iSCom(config-vlan)# vlan activeiSCom(config-vlan)# name "Connect iBiome to Linux"iSCom(config)# exitiSCom(config)# interface vlan 50iSCom(config-if)# ip address 192.168.50.1 255.255.255.0iSCom(config-if)# ip address 192.168.50.2 255.255.255.0 cybseciSCom(config-if)# ip proxy-arp cybseciSCom(config-if)# no shutdowniSCom(config-if)# description "Connect iBiome to Linux"iSCom (config-if)# exitiSCom(config)# interface tunnel 1iSCom(config-if)# tunnel mode gre source 170.50.31.1 dest 180.50.21.2iSCom(config-if)# ip address 21.21.21.1 255.255.255.0 cybseciSCom(config-if)# no shutdowniSCom(config)# set vpn enableiSCom(config)# crypto map VPN-TEST-1iSCom(config-crypto-map)# set local 170.50.31.1iSCom(config-crypto-map)# isakmp local identity ipv4 170.50.31.1iSCom(config-crypto-map)# set peer 180.50.21.2iSCom(config-crypto-map)# isakmp peer identity ipv4 180.50.21.2iSCom(config-crypto-map)# access-list source gre destination greiSCom(config-crypto-map)# crypto key mode preshared psk iSCom+iSCom(config-crypto-map)# isakmp policy encryption aes hash md5 dh group1 exch main lifetime secs 3600iSCom(config-crypto-map)# crypto ipsec mode tunneliSCom(config-crypto-map)# crypto map ipsec encryption esp aes authentication esp md5 pfs group2 lifetime secs 3600iSCom(config-crypto-map)# set tunnel enableiSCom(config-crypto-map)# exitiSCom(config)# ip route 0.0.0.0 0.0.0.0 192.168.50.2iSCom(config)# ip route 0.0.0.0 0.0.0.0 170.50.31.3 cybseciSCom(config)# router ospf cybseciSCom(config-router)# router-id 11.11.11.11iSCom(config-router)# network 21.21.21.1 area 0.0.0.0iSCom(config-router)# network 192.168.50.2 area 0.0.0.0iSCom(config)# router ospf iSCom(config-router)# router-id 1.1.1.1iSCom(config-router)# network 1.1.1.1 area 0.0.0.0iSCom(config-router)# network 172.16.50.1 area 0.0.0.0iSCom(config-router)# network 172.16.51.1 area 0.0.0.0iSCom(config-router)# network 192.168.50.1 area 0.0.0.0Type the following:
iSCom# configure terminaliSCom(config)# set security enableiSCom(config)# vlan 6iSCom(config-vlan)# vlan activeiSCom(config-vlan)# name "Protected Network"iSCom(config-vlan)# exitiSCom(config)# vlan 4iSCom(config-vlan)# vlan activeiSCom(config-vlan)# name "Protected Network"iSCom(config-vlan)# exitiSCom(config)# interface gigabit 0/16iSCom(config-if)# switchport mode trunkiSCom(config-if)# description "Connected to Local Network"iSCom(config-if)# exitiSCom(config-if)# interface vlan 6iSCom(config-if)# ip address 172.16.60.1 255.255.255.0iSCom(config-if)# no shutdowniSCom(config-if)# description "Protected Network"iSCom(config-if)# exitiSCom(config-if)# interface vlan 4iSCom(config-if)# ip address 172.16.61.1 255.255.255.0iSCom(config-if)# no shutdowniSCom(config-if)# description "Protected Network"iSCom(config-if)# exitiSCom(config-if)# interface loop 1iSCom(config-if)# no shutdowniSCom(config-if)# ip address 2.2.2.2 255.255.255.255iSCom(config-if)# description "Router ID”iSCom(config-if)# exitiSCom(config)# interface gigabit 0/24iSCom(config-if)# shutdowniSCom(config-if)# no switchportiSCom(config-if)# set wan enableiSCom(config-if)# ip add 180.50.21.2 255.255.255.0 cybseciSCom(config-if)# no shutdowniSCom(config-if)# description "WAN Port"iSCom(config-if)# exitiSCom(config)# vlan 80iSCom(config-vlan)# vlan activeiSCom(config-vlan)# name "Connect iBiome to Linux"iSCom(config)# exitiSCom(config)# interface vlan 80iSCom(config-if)# ip address 192.168.80.1 255.255.255.0iSCom(config-if)# ip address 192.168.80.2 255.255.255.0 cybseciSCom(config-if)# ip proxy-arp cybseciSCom(config-if)# no shutdowniSCom(config-if)# description "Connect iBiome to Linux"iSCom(config-if)# exitiSCom(config)# interface tunnel 1iSCom(config-if)# tunnel mode gre source 180.50.21.2 dest 170.50.31.1iSCom(config-if)# ip address 21.21.21.2 255.255.255.0 cybseciSCom(config-if)# no shutdowniSCom(config)# set vpn enableiSCom(config)# crypto map VPN-TEST-2iSCom(config-crypto-map)# set local 180.50.21.2iSCom(config-crypto-map)# isakmp local identity ipv4 180.50.21.2iSCom(config-crypto-map)# set peer 170.50.31.1iSCom(config-crypto-map)# isakmp peer identity ipv4 170.50.31.1iSCom(config-crypto-map)# access-list source gre destination greiSCom(config-crypto-map)# crypto key mode preshared psk iSCom+iSCom(config-crypto-map)# isakmp policy encryption aes hash md5 dh group1 exch main lifetime secs 3600iSCom(config-crypto-map)# crypto ipsec mode tunneliSCom(config-crypto-map)# crypto map ipsec encryption esp aes authentication esp md5 pfs group2 lifetime secs 3600iSCom(config-crypto-map)# set tunnel enabliSCom(config-crypto-map)# exitiSCom(config)# ip route 0.0.0.0 0.0.0.0 192.168.80.2iSCom(config)# ip route 0.0.0.0 0.0.0.0 180.50.21.3 cybseciSCom(config)# router ospf cybseciSCom(config-router)# router-id 22.22.22.22iSCom(config-router)# network 21.21.21.2 area 0.0.0.0iSCom(config-router)# network 192.168.50.2 area 0.0.0.0iSCom(config)# router ospf iSCom(config-router)# router-id 2.2.2.2iSCom(config-router)# network 2.2.2.2 area 0.0.0.0iSCom(config-router)# network 172.16.60.1 area 0.0.0.iSCom(config-router)# network 172.16.61.1 area 0.0.0.iSCom(config-router)# network 192.168.80.1 area 0.0.0.0Perform the following
RAPTOR 1:
#Create Private Key On the RAPTOR
crypto pki keygen client rsa4096 CA ON MISSISSAUGA iSCom DOC 1.1.1.1
#Create a CSR on the RAPTOR
crypto pki csrgen client
#Importing Signed Certificate to the RAPTOR
crypto pki import cert clientSingedCert.pem private-key clientKey.pem
#Importing CA Certificate to the RAPTOR
crypto pki import ca-cert CA.pem
iSCom#show crypto pki------------------------------------------------------------
Name Type
------------------------------------------------------------
clientKey.pem Private Key
clientCert.pem Certificate
clientSingedCert.pem Certificate
CA.pem CA Certificate
clientCsr.pem CSR
-----------------------------------------------------------
en
conf t
set security enable
vlan 5
vlan active
Name "Protected Network"
exit
vlan 3
vlan active
Name "Protected Network"
exit
inter gig 0/16
sw mo trunk
description "Connected to Local Network"
exit
inter vlan 5
ip address 172.16.50.1 255.255.255.0
no shut
description "Protected Network"
exit
inter vlan 3
ip address 172.16.51.1 255.255.255.0
no shut
description "Protected Network"
exit
inter loop 1
no shut
ip add 1.1.1.1 255.255.255.255
description "Router ID"
exit
inter gig 0/24
shu
no sw
set wan enable
ip add 170.50.31.1 255.255.255.0 cybsec
no shut
description "WAN Port"
exit
vlan 50
vlan active
name "Connect iBiome to Linux"
exit
int vlan 50
ip addr 192.168.50.1 255.255.255.0
ip addr 192.168.50.2 255.255.255.0 cybsec
ip proxy-arp cybsec
no shut
description "Connect iBiome to Linux"
exit
!
#Configuring GRE Tunnel
interface tunnel 1 tunnel mode gre source 170.50.31.1 dest 180.50.21.2 ip address 21.21.21.1 255.255.255.0 cybsec
no shutdown
!
#configuring GRE Over IPSec
set vpn enable
crypto map VPN-TEST-1
set local 170.50.31.1
isakmp Local identity ipv4 "C=CA, ST=ON, L=MISSISSAUGA, O=iSCom, OU=DOC, CN=1.1.1.1"
set peer 180.50.21.2
isakmp peer identity ipv4 "C=CA, ST=ON, L=MISSISSAUGA, O=iSCom, OU=DOC, CN=2.2.2.2"
access-list source gre destination gre
crypto key mode cert certificate-File clientSingedCert.pem PrivateKey-File clientKey.pem
isakmp policy encryption aes hash md5 dh group1 exch main lifetime secs 3600
crypto ipsec mode tunnel
crypto map ipsec encryption esp aes authentication esp md5 pfs group2 lifetime secs 3600
set Tunnel enable
exit
!
#Configuring Default Routes on Linux and iBiome
ip route 0.0.0.0 0.0.0.0 192.168.50.2
ip route 0.0.0.0 0.0.0.0 170.50.31.3 cybsec
!
#Configuring OSPF on the Linux
router ospf cybsec
router-id 11.11.11.11
network 21.21.21.1 area 0.0.0.0
network 192.168.50.2 area 0.0.0.0
!
#Configuring OSPF on the iBiome
router ospf
router-id 1.1.1.1
network 1.1.1.1 area 0.0.0.0
network 172.16.50.1 area 0.0.0.0
network 172.16.51.1 area 0.0.0.0
network 192.168.50.1 area 0.0.0.0
!
RAPTOR 2:
#Create Private Key On the RAPTOR
crypto pki keygen client rsa4096 CA ON MISSISSAUGA iSCom DOC 2.2.2.2
#Create a CSR on the RAPTOR
crypto pki csrgen client
#Importing Signed Certificate to the RAPTOR
crypto pki import cert clientSingedCert.pem private-key clientKey.pem
#Importing CA Certificate to the RAPTOR
crypto pki import ca-cert CA.pem
iSCom#show crypto pki
------------------------------------------------------------
Name Type
------------------------------------------------------------
clientKey.pem Private Key
clientCert.pem Certificate
clientSingedCert.pem Certificate
CA.pem CA Certificate
clientCsr.pem CSR
------------------------------------------------------------
en
conf t
set security enable
vlan 6
vlan active
Name "Protected Network"
exit
vlan 4
vlan active
Name "Protected Network"
exit
inter gig 0/16
sw mo trunk
description "Connected to Local Network"
exit
inter vlan 6
ip address 172.16.60.1 255.255.255.0
no shut
description "Protected Network"
exit
inter vlan 4
ip address 172.16.61.1 255.255.255.0
no shut
description "Protected Network"
exit
inter loop 1
no shut
ip add 2.2.2.2 255.255.255.255
description "Router ID"
exit
inter gig 0/24
shu
no sw
set wan enable
ip add 180.50.21.2 255.255.255.0 cybsec
no shut
description "WAN Port"
exit
vlan 80
vlan active
name "Connect iBiome to Linux"
exit
int vlan 80
ip addr 192.168.80.1 255.255.255.0
ip addr 192.168.80.2 255.255.255.0 cybsec
ip proxy-arp cybsec
no shut
description "Connect iBiome to Linux"
exit
!
#Configuring GRE Tunnel
interface tunnel 1
tunnel mode gre source 180.50.21.2 dest 170.50.31.1
ip address 21.21.21.2 255.255.255.0 cybsec
no shutdown
!
#configuring GRE Over IPSec
set vpn enable
crypto map VPN-TEST-2
set local 180.50.21.2
isakmp local identity ipv4 "C=CA, ST=ON, L=MISSISSAUGA, O=iSCom, OU=DOC, CN=2.2.2.2"
set peer 170.50.31.1
isakmp peer identity ipv4 "C=CA, ST=ON, L=MISSISSAUGA, O=iSCom, OU=DOC, CN=1.1.1.1"
access-list source gre destination gre
crypto key mode cert certificate-File clientSingedCert.pem PrivateKey-File clientKey.pem
isakmp policy encryption aes hash md5 dh group1 exch main lifetime secs 3600
crypto ipsec mode tunnel
crypto map ipsec encryption esp aes authentication esp md5 pfs group2 lifetime secs 3600
set Tunnel enable
exit
!
#Configuring Default Routes on Linux and iBiome
ip route 0.0.0.0 0.0.0.0 192.168.80.2
ip route 0.0.0.0 0.0.0.0 180.50.21.3 cybsec
!
#Configuring OSPF on the Linux
router ospf cybsec
router-id 22.22.22.22
network 21.21.21.2 area 0.0.0.0
network 192.168.80.2 area 0.0.0.0
!
#Configuring OSPF on the iBiome
router ospf
router-id 2.2.2.2
network 2.2.2.2 area 0.0.0.0
network 172.16.60.1 area 0.0.0.0
network 172.16.61.1 area 0.0.0.0
network 192.168.80.1 area 0.0.0.0
!