Site-to-Site IPSEC VPN Between Two Cisco ASA – one with Dynamic IP

isco ASA 5500 Series appliances deliver IPsec and SSL VPN, firewall, and several other networking services on a single platform. Cisco ASA 5520, a member of the Cisco ASA 5500 Series, is shown in Figure 1 below.

Figure 1 Cisco Adaptive Security Appliance (ASA)

In this article, we will focus on site-to-site IPsec implementation between two Cisco ASA 5520 appliances, as shown in Figure 2. The outside interface of ASA1 is assigned a dynamic IP addressby the service provider over DHCP, while the outside interface of ASA2 is configured with astatic IP address. Basic IP address configuration and connectivity exists and we will build IPsec configuration on top of this. Although this tutorial was tested on ASA5520, the configuration commands are exactly the same for the other ASA models with no difference.

Figure 2  Cisco ASA-ASA IPsec Implementation

IP Security (IPsec) can use Internet Key Exchange (IKE) for key management and tunnel negotiation. IKE involves a combination of ISAKMP/Phase 1 and IPsec/Phase 2 attributes that are negotiated between peers. If any one of the attributes is misconfigured, the IPsec tunnel fails to establish. Therefore, it is mandatory to make sure that all these parameters are identical on the two appliances we are using as IPsec peers.

We will start with a preconfiguration checklist to make our life easier. This checklist would serve as a reference for configuration and troubleshooting.

Table 1   Configuration Checklist: ISAKMP/Phase-1 Attributes

Attribute	Value
Encryption	AES 128-bit
Hashing	SHA-1
Authentication method	Preshared keys
DH group	Group 2 1024-bit field
Lifetime	86,400 seconds

After discussing Phase 1 attributes, it is important to highlight Phase 2 attributes of the IPsec VPN connection, that are used to encrypt and decrypt the actual data traffic.

Table 2   Configuration Checklist: IPsec/Phase-2 Attributes

Attribute	Value
Encryption	AES 128-bit
Hashing	SHA-1
Lifetime	28,800 seconds4,608,000 kB
Mode	Tunnel
PFS group	None

Now that we have determined what Phase 1 and Phase 2 attributes to use, we’re ready to configure the site-to-site IPsec tunnel between ASA1 and ASA2.

Let’s start with configuring ASA1:

! ISAKMP Phase 1

crypto ikev1 policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
!
crypto ikev1 enable outside
tunnel-group 173.199.183.2 type ipsec-l2l
tunnel-group 173.199.183.2 ipsec-attributes
ikev1 pre-shared-key Cisc0

! IPsec Phase 2

access-list RED permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0
crypto ipsec ikev1 transform-set ESP-AES128-SHA esp-aes esp-sha-hmac
crypto map VPN-MAP 10 match address RED
crypto map VPN-MAP 10 set peer 173.199.183.2
crypto map VPN-MAP 10 set ikev1 transform-set ESP-AES128-SHA
crypto map VPN-MAP interface outside

Here goes the configuration for ASA2:

! Create ISAKMP policy

crypto ikev1 policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 enable outside

! Define the pre-shared key within the dynamic map tunnel group

tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key Cisc0
!
crypto ipsec ikev1 transform-set ESP-AES128-SHA esp-aes esp-sha-hmac

access-list BLUE permit ip 10.0.0.0 255.255.255.0 192.168.1.0 255.255.255.0

! Create a dynamic-map

crypto dynamic-map DYN-MAP 20 match address BLUE (OPTIONAL)
crypto dynamic-map DYN-MAP 20 set ikev1 transform-set ESP-AES128-SHA

! Assign the dynamic-map to crypto map

crypto map VPN-MAP 10 ipsec-isakmp dynamic DYN-MAP
crypto map VPN-MAP interface outside

The above commands conclude the IPSEC VPN configuration. However, if we have NAT in our network (which is true most of the times), we still have some way to go. We must configure NAT exemption for VPN traffic. That is, traffic that will pass through the VPN tunnel (i.e traffic between the LAN networks 192.168.1.0/24 10.0.0.0/24) must be excluded from NAT operation.

Configure NAT Exemption on ASA1

ASA1(config)# object network obj-local 
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0 
ASA1(config-network-object)# exit

ASA1(config)# object network obj-remote 
ASA1(config-network-object)# subnet 10.0.0.0 255.255.255.0
ASA1(config-network-object)# exit

ASA1(config)# object network internal-lan 
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0 
ASA1(config-network-object)# exit

! Exclude traffic from LAN1 to LAN2 from NAT operation

ASA1(config)# nat (inside,outside) source static obj-local obj-local destination static obj-remote obj-remote

! Configure Port Address Translation (PAT) using the outside ASA interface. This will perform dynamic NAT on internal LAN hosts so that they can access the Internet.

ASA1(config)# object network internal-lan 
ASA1(config-network-object)# nat (inside,outside) dynamic interface

Configure NAT Exemption on ASA2

ASA2(config)# object network obj-local 
ASA2(config-network-object)# subnet 10.0.0.0 255.255.255.0 
ASA2(config-network-object)# exit

ASA2(config)# object network obj-remote 
ASA2(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA2(config-network-object)# exit

ASA2(config)# object network internal-lan 
ASA2(config-network-object)# subnet 10.0.0.0 255.255.255.0 
ASA2(config-network-object)# exit

! Exclude traffic from LAN2 to LAN1 from NAT operation

ASA2(config)# nat (inside,outside) source static obj-local obj-local destination static obj-remote obj-remote

! Configure Port Address Translation (PAT) using the outside ASA interface. This will perform dynamic NAT on internal LAN hosts so that they can access the Internet.

ASA2(config)# object network internal-lan 
ASA2(config-network-object)# nat (inside,outside) dynamic interface

At this point our IPsec configuration is complete. We can generate some traffic from a host in subnet 192.168.1.0/24 connected to ASA1 to a host in subnet 10.0.0.0/24 connected to ASA2. An easy way to generate such traffic is the good old ping utility. If ping is successful between the two subnets, an IPsec tunnel is also likely to have established successfully. The same can be verified using command show crypto ipsec stats:

ASA1# show crypto ipsec stats

IPsec Global Statistics
———————–
Active tunnels: 1
Previous tunnels: 1
Inbound
Bytes: 400
Decompressed bytes: 400
Packets: 4
Dropped packets: 0
Replay failures: 0
Authentications: 4
Authentication failures: 0
Decryptions: 4
Decryption failures: 0
Decapsulated fragments needing reassembly: 0

Outbound
Bytes: 400
Uncompressed bytes: 400
Packets: 4
Dropped packets: 0
Authentications: 4
Authentication failures: 0
Encryptions: 4
Encryption failures: 0
Fragmentation successes: 0
Pre-fragmentation successses: 0
Post-fragmentation successes: 0
Fragmentation failures: 0
Pre-fragmentation failures: 0
Post-fragmentation failures: 0
Fragments created: 0
PMTUs sent: 0
PMTUs rcvd: 0
Protocol failures: 0
Missing SA failures: 0
System capacity failures: 0

You can get your hands dirty with several other show crypto commands available to verify configuration and view statistics. For example, show crypto isakmp sa detail command can be used to verify ISAKMP/Phase 1 attributes, while show crypto ipsec sa command can be used to verify IPsec/Phase 2 attributes. We have shown here the output for show crypto isakmp sa detailcommand:

ASA1# show crypto isakmp sa detail

Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 173.199.183.2

Type    : L2L             Role    : initiator
Rekey   : no              State   : MM_ACTIVE
Encrypt : aes             Hash    : SHA
Auth    : preshared       Lifetime: 86400
Lifetime Remaining: 85998

How To: Emulate Cisco ASA in GNS3

In this article, I will show you how to emulate Cisco ASA using Qemu. Once again, please note that ASA is not provided and will not be. So please don’t ask. Also be aware that ASA does not 100% work in Qemu but that’s enough to play with it.

Installation
First compile and patch Qemu as you would do for running JunOS. This will give us pcap, lcap and UDP tunnels (i.e. GNS3/Dynamips connections) capabilities.
Then obtain ASA itself. If you are smart and patient you will find it. I used asa802-k8.bin for my installations. As far as I know, nobody has been able to run ASA > version 8.2 (ASA keeps rebooting).
The next step is to get an initrd and a Linux kernel (inside the initrd) from your ASA image to use them with Qemu and also fix the initrd for our needs. The initrd is zipped and archived in the ASA image, we have to extract it.
There are 2 ways, manually or using a tool I created.

Manual method

Create an hexadecimal dump of your image:

hexdump -C asa802-k8.bin > asa802-k8.hex

Search for the ZIP header:

grep “1f 8b 08 00 1d” asa802-k8.hex 001228b0 1f 8b 08 00 1d 3d 73 46 00 03 ec 3a 6d 54 14 57 |…..=sF…:mT.W|

We can see that the ZIP file starts at offset 1228b0.

Let’s find the image size:

ls -la asa802-k8.bin -rwxr-xr-x  1 root  staff  14524416 26 Nov 20:14 asa802-k8.bin 14524416 bytes.

Now we need to find out where in the file we can start extracting the ZIP part.

echo "14524416 ; ibase=16 ; last - 1228B0" | bc | tail -n 1 13334352

Extract the zipped part of the ASA image:

tail -c 13334352 asa802-k8.bin > asa802-k8.gz

Decompress it with gzip:

gzip -d asa802-k8 gzip: asa802-k8.gz: decompression OK, trailing garbage ignored

Make a temp directory and go into it so we can extract the files contained in the uncompressed archive file (the initrd):

mkdir tmp ; cd tmp

Now extract the archive with cpio (you must have the administrator rights to successfully extract device files).

cpio -i --no-absolute-filenames --make-directories < ../asa802-k8

Copy the Linux kernel to your previous directory:

cp vmlinuz ../asa802-k8.kernel

Before compressing back the initrd, create the following script in asa/scripts/first_start.sh
This script formats the 256 MB flash on first start to be used by ASA. Loads the network drivers modules for Intel e100 (i82559er in Qemu) and Intel e1000 cards and activates the network interfaces to be used in ASA. I noticed that if we immediately start ASA after this first boot, it freezes (don’t really know why but it seems the system do something and slow down during the first minute …). The next time you start the system, the script will still load the activate the network interfaces and automatically start ASA.

#!/bin/sh   ## ## Author: Jeremy Grossmann (2009) ## Contributor: J. Pedro Flor (28 january 2010) ##   FIRST_START=no if test ! -e /mnt/disk0/lina_monitor then cd /asa/scripts/ echo "d" > /asa/scripts/fdisk.pf.in echo "o" >> /asa/scripts/fdisk.pf.in echo "n" >> /asa/scripts/fdisk.pf.in echo "p" >> /asa/scripts/fdisk.pf.in echo "1" >> /asa/scripts/fdisk.pf.in echo "1" >> /asa/scripts/fdisk.pf.in echo ""  >> /asa/scripts/fdisk.pf.in echo "t" >> /asa/scripts/fdisk.pf.in echo "4" >> /asa/scripts/fdisk.pf.in echo "w" >>/asa/scripts/fdisk.pf.in   echo "" echo -n "Initializing partition..." /sbin/fdisk /dev/hda < /asa/scripts/fdisk.pf.in > /dev/null 2> /dev/null echo "done"   echo "" echo -n "Formating and mounting partition..." mkdosfs -F 16 /dev/hda1 > /dev/null 2> /dev/null mount -t vfat -o umask=0000,noatime,check=s,shortname=mixed /dev/hda1 /mnt/disk0 > /dev/null 2> /dev/null echo "done" echo ""   cp /asa/bin/lina /mnt/disk0/lina cp /asa/bin/lina_monitor /mnt/disk0/lina_monitor FIRST_START=yes fi   # load drivers modprobe e100 modprobe e1000 ifconfig eth0 up ifconfig eth1 up ifconfig eth2 up ifconfig eth3 up ifconfig eth4 up ifconfig eth5 up   if test $FIRST_START = yes then echo "" echo "          Cisco ASA with Multiple Security Contexts" echo "          ==============================================" echo "" echo "This is your first boot, please wait about 2 minutes for 'disk0' creation" echo "and then execute the following commands inside the Linux prompt:" echo "" echo " # cd /mnt/disk0" echo " # /mnt/disk0/lina_monitor" echo "" echo "" echo "" echo "Please note to use the following command under ASA to save your configs:" echo "" echo " ciscoasa(config)# boot config disk0:/.private/startup-config" echo " ciscoasa(config)# copy running-config disk0:/.private/startup-config" echo "" echo "" echo "" echo "To get webvpn working, execute the following commands:" echo "" echo " ciscoasa# mkdir disk0:/var" echo " ciscoasa# mkdir disk0:/var/log" echo " ciscoasa# mkdir disk0:/csco_config" echo " ciscoasa# mkdir disk0:/csco_config/97" echo " ciscoasa# mkdir disk0:/csco_config/97/webcontent" echo "" echo "          ( Powered by Pedro Flor )" echo "          ( pedro.flor@gmail.com  )" echo "" exit fi   echo "" echo "" echo "Starting Cisco ASA with Multiple Security Contexts..." echo ""   cd /mnt/disk0 /mnt/disk0/lina_monitor

In order for the script to be loaded at startup, edit etc/init.d/rcS and change /asa/bin/lina_monitor by /asa/scripts/first_start.sh

Change first_start.sh permissions:

chmod 755 first_start.sh

Now you can compress all the file and have the initrd ready to use in Qemu:

find . | cpio -o -H newc | gzip -9 > ../asa802-k8.initrd.gz

Automated extraction method

TODO

Using ASA with Qemu

Create a FLASH (this is a virtual hard disk).

qemu-img create FLASH 256M

Then you can start Qemu.

qemu -hda FLASH -kernel asa802-k8.kernel -hdachs 980,16,32 \ -initrd asa802-k8.initrd.gz -m 512 -no-kqemu -nographic -append \ "console=ttyS0,9600n8 hda=980,16,32 bigphysarea=16384 auto nousb ide1=noprobe"

TODO: networking of ASA. Very similar with JunOS emulation.

Using ASA with GNS3

To be completed:

In Preferences -> Qemu -> Qemuwrapper section:

Set the path to Qemuwrapper (can be found in the GNS3 package)

Set the working directory (e.g. /tmp).

Set the path to your patched Qemu in “Path to Qemu”

In ASA section:

Set the paths to your initrd and kernel.

Drag and Drop an ASA symbol on the scene, start the firewall and telnet to it.