IPSec configuration between routers and Cisco firewalls

This document describes the IPSec configuration between the router and the Cisco firewall. The traffic between the headquarters and the branch office uses the private IP address, when the branch's local area network user accesses the Internet, needs to carry on the address conversion.

Network topology

Configuration

Define the traffic to the router:

Access-list IPSec permit IP 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

!---traffic to the router does not address conversion

Access-list Nonat Permit IP 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

IP address outside 172.17.63.213 255.255.255.240

IP address inside 10.1.1.1 255.255.255.0

Global (outside) 1 172.17.63.210

!---traffic to the router does not address conversion

Nat (inside) 0 access-list Nonat

Nat (inside) 1 10.1.1.0 255.255.255.0 0 0

Conduit permit ICMP any

Route outside 0.0.0.0 0.0.0.0 172.17.63.209 1

!---IPSEC Policy:

Sysopt Connection Permit-ipsec

Crypto IPSec Transform-set avalanche esp-des Esp-md5-hmac

Crypto IPSec security-association lifetime seconds 3600

Crypto map Forsberg IPSEC-ISAKMP

Crypto map Forsberg match address IPSec

Crypto map Forsberg set peer 172.17.63.230

Crypto map Forsberg set Transform-set avalanche

Crypto map Forsberg interface outside

!---IKE Policy:

ISAKMP enable outside

ISAKMP key westernfinal2000 address 172.17.63.230 netmask 255.255.255.255

ISAKMP Identity Address

ISAKMP Policy Authentication Pre-share

ISAKMP Policy Encryption des

ISAKMP Policy Hash MD5

ISAKMP Policy Group 1

: End

Branch Router

Hostname Branch_router

!---IKE Policy:

Crypto ISAKMP Policy 11

Hash MD5

Authentication Pre-share

Crypto ISAKMP key westernfinal2000 address 172.17.63.213

!---IPSec Policy:

Crypto IPSec Transform-set Sharks esp-des Esp-md5-hmac

Crypto map Nolan IPSEC-ISAKMP

Set Peer 172.17.63.213

Set Transform-set Sharks

Match Address 120

!

Interface Ethernet0

IP address 172.17.63.230 255.255.255.240

IP Nat Outside

Crypto map Nolan

!

Interface Ethernet1

IP address 10.2.2.1 255.255.255.0

IP nat Inside

!

IP NAT Pool Branch 172.17.63.230 172.17.63.230 netmask 255.255.255.240

IP nat inside source route-map Nonat Pool branch overload

IP Route 0.0.0.0 0.0.0.0 172.17.63.225

Access-list Permit IP 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Access-list 130 deny IP 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Access-list 130 Permit IP 10.2.2.0 0.0.0.255 any

Route-map Nonat Permit 10

Match IP address 130

End