topic Re: IPSec Site-to-Site in Network Security

IPSec Site-to-Site

paltel — Fri, 21 Feb 2020 08:23:22 GMT

I have configured IPSec site-to-site tunnel btw. cisco router and Cisco VPN Concentrator and everythink OK. I have a question, now if the clients behind Cisco router wants to access private site behind VPN Concentrator, they will use its name, but they can't because they need first to establish a tunnel, but this tunnel will not be established cause no public DNS server will resolve this private web server. How can we solve this issue?

Thanks in advance

Re: IPSec Site-to-Site

rating_is_vital — Wed, 14 Sep 2005 23:51:02 GMT

Hi,

Just want to clarity with you that if there is a need still for this, as the user behind the router can use the lan-lan vpn between the router and the cvpn.

Re: IPSec Site-to-Site

paltel — Thu, 15 Sep 2005 10:26:21 GMT

Hi,

Yes, i read many documents but still did not find a good solution.

Re: IPSec Site-to-Site

jackko — Fri, 16 Sep 2005 00:46:44 GMT

maybe installing a dns server on the remote end is an answer

Re: IPSec Site-to-Site

paltel — Fri, 16 Sep 2005 13:32:45 GMT

No, I'm asking how the client gets the remote site ip address before establishing the IPSec site-to-site tunnel to let the ios check if this ip address is permitted to establish a tunnel or not.

Re: IPSec Site-to-Site

jackko — Fri, 16 Sep 2005 15:12:37 GMT

dns server <--> lan1 <--> router <--> www <--> concentrator <--> lan2

when a lan1 user clicks off an application that has a lan2 hostname as a destination, it sends a dns request to the local dns server. the server then responses with the a lan2 ip, which the router will be able to determine whether the tunnel should be initiated or not. making sense?

Re: IPSec Site-to-Site

paltel — Fri, 16 Sep 2005 18:20:20 GMT

No dns server at lan1, lan1 user type a hostname and the IOS must determine first (before establishing a tunnel) if this hostname ip address is permitted to establish a tunnel or not.

Do you have an idea who the IOS do this?

Re: IPSec Site-to-Site

attrgautam — Sat, 17 Sep 2005 11:12:32 GMT

Is there a DNS Server at the remote end atleast ? I have also heard you can do a local mapping but iam aint sure how

Re: IPSec Site-to-Site

paltel — Sat, 17 Sep 2005 13:44:53 GMT

sure.

Re: IPSec Site-to-Site

jackko — Mon, 19 Sep 2005 02:53:58 GMT

dns server <--> lan1 <--> router <--> www <--> concentrator <--> lan2

on the router, configure

ip name-server

ip forward-protocol udp 53

ip forward-protocol

To specify which protocols and ports the router forwards when forwarding broadcast packets, use the ip forward-protocol global configuration command.

then include the router wan ip as part of the lan-lan vpn.

in theory,

1. lan1 user kicks off the app by hostname

2. router tries to resolve the name by contacting the dns

3. since router wan ip is part of the lan-lan vpn, the vpn should be initiated

4. bingo lan1 user gets in

let me know if this works as i've never try this before

Re: IPSec Site-to-Site

attrgautam — Mon, 19 Sep 2005 10:49:31 GMT

Yeah i think that will work. Include the DNS server in your IPSec traffic, DNS request will get forwarded to the remote end DNS server. So your DNS query will trigger the tunnel. But for this , a DNS server is needed at the other end atleast

Re: IPSec Site-to-Site

paltel — Mon, 19 Sep 2005 18:02:29 GMT

Hi jackko,

Thank you. Let us say the following:

DNS public --> 1.1.1.1

DNS LAN2 ip address --> 10.5.5.5

LAN1 users configured for 1.1.1.1 DNS at this time, they must be configured for 10.5.5.5? But this will make the session active all the time since all the dns requests will be checked through this private DNS at LAN2.

I need from the IOS to check the ip address for any hostname if it is from the LAN2 ip addresses then this will trigger the site-to-site IPSec session, otherwise keep this session inactive and forward it to the internet. Is this possible?

Re: IPSec Site-to-Site

jackko — Mon, 19 Sep 2005 23:11:29 GMT

not sure if it's possible. however there are cisco experts reading this forum every seconds around the world and no one seems suggesting the ios code. so maybe it's not very straight forward.

wondering how many user are we talking about. if only a few, maybe edit the local host file on the pc is an option.

Re: IPSec Site-to-Site

jackko — Fri, 23 Sep 2005 01:24:18 GMT

just wondering how you go. figured out a workaround?

Re: IPSec Site-to-Site

paltel — Fri, 23 Sep 2005 06:13:10 GMT

Hi Jackko,

The best solution till now is to let LAN1 clients get LAN2 DNS (i configured DHCP at LAN1 router). This make the IPSec session to be active all the time.

Re: IPSec Site-to-Site

jackko — Fri, 23 Sep 2005 10:07:13 GMT

i guess one of the cons is that all the dns requests now going through the vpn and comsuming the bandwidth.

in case bandwidth is a concern, i guess you can manipulate the host file of the primary user pc.

Re: IPSec Site-to-Site

attrgautam — Fri, 23 Sep 2005 10:59:11 GMT

Wonder why should IPSec be active all the time. The IPSec is going to trigger whenever there is going to be interesting traffic to the server, in this case the traffic will be the DNS request.

Re: IPSec Site-to-Site

paltel — Fri, 23 Sep 2005 13:53:13 GMT

Hi Attrgautam,

I see this is not a good solution, but if they got a public DNS server, and a LAN1 user typed a LAN2 hostname it will not trigger the IPSec tunnel because the public DNS server will return failed DNS reply.

I tried your suggestion to use ip forward-protocol udp 53, but did not successed! I don't have another solution!

...........

Please can you give more details about "manipulate the host file of the primary user pc"?

Thank you

Re: IPSec Site-to-Site

jackko — Sat, 24 Sep 2005 10:59:46 GMT

the issue is due to the fact that lan2 pc cannot resolve the ip by the server name, since there is no dns server installed.

this issue can be resolved by adding an entry to the pc host file. windows machine looks up the host file first and then after the dsn server.

to edit the host file, open it with notepad

C:\WINDOWS\system32\drivers\etc\hosts

below is the default host file

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

# For example:

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

under the first entry, put in the lan2 ip address, hit the key and put in the server name.

e.g.

127.0.0.1 localhost

192.168.0.1 server_xxx

the catch with this workaround is that it's a manual process, so you will need to do this on every single pc. however, you may do it on the primary user pc instead. that means the lan2 office will need to depend on this primary user/pc to initiate the vpn.

Re: IPSec Site-to-Site

paltel — Sat, 24 Sep 2005 13:48:43 GMT

what r u talking about?!!!!!

I need IOS solution not Microsoft one (for every PC).