cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

216
Views
0
Helpful
5
Replies
Participant

Secure interface using IPSEC

Hi,

we have 2 routers connected to each other via an IPSec tunnel. Both routers are on private networks so there is no natting going on.

The IPSec tunnel is fine and traffic is flowing between the local networks (crypto map/access lists are fine) via the tunnel.

I know I need to secure the outside interface but unsure what sort of ACL is needed so that only IPSec traffic is allowed both in and out and no other traffic enters/leaves the router unless it is via the IPSec tunnel.

 

5 REPLIES 5
VIP Advisor

Re: Secure interface using IPSEC

Hi

The outside interface is also using private subnets?
On your acl inbound, default IPsec needs to be allowed (ah, esp, udp-500/4500 if nat).
When it comes to secure a router, i always user zbf instead of simple asked acls (zbf requires security features and it's binded with a specific license or specific ios image depending on the router you're using). Here a link that can help for zbf:
https://www.cisco.com/c/en/us/support/docs/routers/3800-series-integrated-services-routers/112051-zbf-vpn-access-config.html

You're going to see also the acl for inbound.

For outbound, you don't usually limit the traffic to only ipsec, except if you only have this traffic going through.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Participant

Re: Secure interface using IPSEC

Yes, the routers are on private subnets as they are internal routers. This particular one requires IPSec between the endoints to secure the traffic so basically all traffic from the lan needs to go through the vpn with nothing going through the outside interface.

VIP Advisor

Re: Secure interface using IPSEC

Did you try the acl on the outside interface as mentioned and/or the zbf feature?

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Participant

Re: Secure interface using IPSEC

Hi,

yes I applied an ACL for IPSec on the outside interface in the IN direction and it appears to be working. All other lan traffic is listed as interesting traffic for the vpn.

Is this enough to prevent any traffic leaving the router unencrypted?

VIP Advisor

Re: Secure interface using IPSEC

This is for incoming traffic only. You need to have another acl for outgoing traffic limiting ipsec ports (like the one on the inbound) but this time port are source ports and not destination

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question