Secure interface using IPSEC

[louis0001]

Hi,

we have 2 routers connected to each other via an IPSec tunnel. Both routers are on private networks so there is no natting going on.

The IPSec tunnel is fine and traffic is flowing between the local networks (crypto map/access lists are fine) via the tunnel.

I know I need to secure the outside interface but unsure what sort of ACL is needed so that only IPSec traffic is allowed both in and out and no other traffic enters/leaves the router unless it is via the IPSec tunnel.

[Francesco Molino]

Hi

The outside interface is also using private subnets?
On your acl inbound, default IPsec needs to be allowed (ah, esp, udp-500/4500 if nat).
When it comes to secure a router, i always user zbf instead of simple asked acls (zbf requires security features and it's binded with a specific license or specific ios image depending on the router you're using). Here a link that can help for zbf:
https://www.cisco.com/c/en/us/support/docs/routers/3800-series-integrated-services-routers/112051-zbf-vpn-access-config.html

You're going to see also the acl for inbound.

For outbound, you don't usually limit the traffic to only ipsec, except if you only have this traffic going through.

[louis0001]

Yes, the routers are on private subnets as they are internal routers. This particular one requires IPSec between the endoints to secure the traffic so basically all traffic from the lan needs to go through the vpn with nothing going through the outside interface.

[Francesco Molino]

Did you try the acl on the outside interface as mentioned and/or the zbf feature?

[louis0001]

Hi,

yes I applied an ACL for IPSec on the outside interface in the IN direction and it appears to be working. All other lan traffic is listed as interesting traffic for the vpn.

Is this enough to prevent any traffic leaving the router unencrypted?

[Francesco Molino]

This is for incoming traffic only. You need to have another acl for outgoing traffic limiting ipsec ports (like the one on the inbound) but this time port are source ports and not destination

[aa321123]

When configuring the Client SSH authentication using RAS , pasted at the box indicated for SG350 , caught error , "Key header expected " where from the show CLI , none such inform listed ?

YES, FROM <...> HEADER INCLUDED LATER, IT CONFIGURED THROUGH.

[aa321123]

Would SSL L2TP, such vpn setting  block,   LAG group lan.port.Router(s)'  connection ?