topic Re: Dyanmic crypto map in Network Security

Dyanmic crypto map

whiteford — Mon, 11 Mar 2019 16:13:48 GMT

Hello,

I have a VPN that will connect using one of 3 public IP addresses, is it possibel to setup a VPN like this? Normally I setup VPN's with a peer having a single static IP not a pool of IP's?

Thanks

Re: Dyanmic crypto map

andrew.prince — Wed, 09 Sep 2009 14:55:38 GMT

crypto map <> <> set peer 0.0.0.0 - will allow ANY VPN to connect.

HTH>

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 06:21:04 GMT

Thanks Andrew,

I was thinking this must be a bit of a security risk allowing any IP, but I guess it isn't any different to the Cisco VPN client as the public IP for our user can be any IP really?

Also I just tried setting up a VPn via the wizard in the ASDM and it says 0.0.0.0 can't be used. Is this a CLI option only?

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 06:55:26 GMT

Have a look at the below

http://www.cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 08:06:23 GMT

I think this is the only article related to my situation:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

Normally to add a VPN to the ASA I would add something like this:

access-list outside_MYcryptomap_15 line 1 extended permit ip 0.0.0.0 0.0.0.0 172.18.1.0 255.255.255.0

crypto map outside_map 17 match address outside_MYcryptomap_1

crypto map outside_map 17 set pfs group5

crypto map outside_map 17 set security-association lifetime seconds 86400

crypto map outside_map 17 set peer 81.14.1.1

crypto map outside_map 17 set transform-set ESP-AES-256-SHA

tunnel-group 81.14.1.1 type ipsec-l2l

tunnel-group 81.14.1.1 general-attributes

default-group-policy My-L2L

tunnel-group 81.149.1.1 ipsec-attributes

pre-shared-key 123456789

isakmp keepalive threshold 10 retry 2

Possible to manipulate the above to be dynamic?

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 08:09:34 GMT

If you read the config, the dynamic L2L is:-

tunnel-group DefaultL2LGroup type ipsec-l2l

tunnel-group DefaultL2LGroup general-attributes

authentication-server-group none

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key *

no IP address - just a psk.

And a normal crypto map - but no IP.

HTH>

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 08:23:37 GMT

I would

1) Set the PSK tom something a little more secure

2) Enable PFS and set the time to about an hour or so

3) Enable reverse route injection (require if you don't know what the remote end IP subnet will be

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 09:06:18 GMT

This is what I'm going to add to the ASA:

crypto ipsec transform-set dynset1 esp-AES 128 esp-sha-hmac

crypto dynamic-map cisco 1 set transform-set dynset1

crypto map dyn-map 20 ipsec-isakmp dynamic cisco

crypto map dyn-map interface outside

tunnel-group DefaultL2LGroup type ipsec-l2l

tunnel-group DefaultL2LGroup general-attributes

authentication-server-group none

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key 123456789

Does it look ok to you?

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 09:09:52 GMT

I can understand that - but to some minds to rest.....even if the phase 1/2 encryption key was captured in a man in the middle attack, the hacker would need to decrypt it and use it.....in the time frame it takes for the session to establish - as anti replay is a major factor in IPSEC.

So this means the hacker needs to break an 128bit AES encrypted key, the last time I checked no computer exists on the planet earth that can compute or even brute force it in under 50 million years.

If you use PFS as I suggested, this means the ecnryption key is re-negotiated anyway so the same encryption key's are never used more thant the specific time period.

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 09:15:06 GMT

Thanks for spending some of you time on this btw.

1) Sorry that was just an example psk (123456789) normally I use 10 chars leters,numbers, symbols, uppercase.

2) Where would I put this in my config example? I guess I would use "set pfs group5" somewhere and what about the timeout?

3) I will be setting the remote IP subnets so will will no, so I guess I can miss this out?

Thanks

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 09:25:57 GMT

Sure - no problem

1) 😉 I would for a "dyanamic" used something a little longer, the likely hood that someone would guess or capture it is low - but just to be sure 32 or 64 charactures.

2) crypto map <> set pfs group5

3) You can miss it out, or have it in - belt a braces approach!

HTH>

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 09:39:33 GMT

I will try this after lunch. My boss is worried it's insecure, but I said it's the same as VPN client really as we don't know their public IP to lock the tunnel down with, would you agree?

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 09:53:30 GMT

Can you check this (not sure if my maps are right) and see what you think before I add?

crypto ipsec transform-set dynset1 esp-AES 128 esp-sha-hmac

crypto dynamic-map aw-dyn-map 1 set transform-set dynset1

crypto map dyn-map 1 ipsec-isakmp dynamic aw-dyn-map

crypto map dyn-map interface outside

crypto map dyn-map 1 set pfs group 5

tunnel-group DefaultL2LGroup type ipsec-l2l

tunnel-group DefaultL2LGroup general-attributes

authentication-server-group none

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key <64 char key here>

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 10:14:42 GMT

No jumps out at me, configuring this will not affect any current VPN's if you want to do during production hours.

But you can always do it out of hours!

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 11:47:39 GMT

Andrew,

The first problem I got was:

crypto map dyn-map 1 set pfs group5

WARNING: This map entry is linked to dynamic-map: aw-dyn-map.

This attribute will be inactive!

please help

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 11:52:29 GMT

Bob,

You are creating another crypto map - you should be amending to your existing policy!

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 13:13:08 GMT

Andrew,

Sorry I'm confused (does take much does it)

I simply tried to add:

crypto ipsec transform-set dynset1 esp-AES 128 esp-sha-hmac

crypto dynamic-map cisco 1 set transform-set dynset1

crypto map dyn-map 1 ipsec-isakmp dynamic cisco

crypto map dyn-map interface outside

crypto map dyn-map 1 set pfs group 5

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 13:24:23 GMT

😉 no issues

Here is the thing, you can only have ONE crypto map configured on ONE interface at any one time.

Soooooo if you already have a crypto map configured and attached to the outside interface - then you just amend it, giving your dynamic crypto map and higher sequence number; hope this clears it up.

If not - see an example of one of my crypto maps:-

crypto ipsec transform-set ESP-3DES-SHA1

crypto dynamic-map dyno-map 10 set transform-set ESP-3DES-SHA1

crypto map vpntunnel-outside 1 match address vpn1

crypto map vpntunnel-outside 1 set peer 1.1.1.1

crypto map vpntunnel-outside 1 set transform-set ESP-3DES-SHA1

crypto map vpntunnel-outside 26 match address vpn2

crypto map vpntunnel-outside 26 set peer 2.2.2.2

crypto map vpntunnel-outside 26 set transform-set ESP-3DES-SHA1

crypto map vpntunnel-outside 60 match address vpn3

crypto map vpntunnel-outside 60 set peer 3.3.3.3

crypto map vpntunnel-outside 60 set transform-set ESP-3DES-SHA1

crypto map vpntunnel-outside 65535 ipsec-isakmp dynamic dyno-map

crypto map vpntunnel-outside interface outside

HTH>

Re: Dyanmic crypto map

whiteford — Thu, 10 Sep 2009 13:54:01 GMT

I think I do. All my VPN's went down, when I compared the config with last night, I soon realised I had to add back:

"crypto map outside_map interface outside"

so when I added

"crypto map dyn-map interface outside"

bang! They all went down

If I get it I must leave "crypto map outside_map interface outside" as it is?

based on my example in the previous post how should that look? That way it shoudl click for me.

Thanks again Andrew.

Re: Dyanmic crypto map

andrew.prince — Thu, 10 Sep 2009 13:57:38 GMT

Post your current config, remove sensitive info