IPSEC VPN between Cisco 2901 and Sonicwall

Kris McCormick · ‎06-12-2013

Our existing Cisco 2901 is already doing a DMVPN between our locations and is using a zone-based firewall. I've been asked to configure a VPN to a Sonicwall from that same 2901. The Sonicwall does not support DMVPN so I'd need to do an IPSEC VPN. Is it possible for both to co-exist on the 2901? I've started adding some of the IPSEC config to my 2901 and pasted the config below (I've removed any identifying public IP addresses) but the VPN to the Sonicwall is not operational.

Using 15540 out of 262136 bytes

!

! Last configuration change at 14:05:21 PDT Wed Jun 12 2013 by SiteTech

! NVRAM config last updated at 14:05:48 PDT Wed Jun 12 2013 by SiteTech

version 15.1

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname rtr-xxx-pd-01

!

boot-start-marker

boot-end-marker

!

security authentication failure rate 3 log

security passwords min-length 6

logging buffered 51200 warnings

enable secret 4 nqDHNNAboQs3pRtIt7QPcjUYTEPSRmg5GiHQcIb3Uq2

!

no aaa new-model

!

clock timezone PST -8 0

clock summer-time PDT recurring

!

no ipv6 cef

ip source-route

ip cef

!

no ip dhcp use vrf connected

ip dhcp excluded-address 10.48.25.1 10.48.25.63

ip dhcp excluded-address 10.48.26.1 10.48.26.63

ip dhcp excluded-address 10.48.27.1 10.48.27.63

!

ip dhcp pool voice

network 10.48.26.0 255.255.255.0

default-router 10.48.26.1

option 42 ip 10.48.255.9 10.48.255.254

option 2 hex ffff.8f80

option 156 ascii "ftpservers=10.48.2.16, country=1, language=1, layer2tagging=1, vlanid=102"

dns-server 64.60.0.17

!

ip dhcp pool data

network 10.48.25.0 255.255.255.0

default-router 10.48.25.1

option 156 ascii "ftpservers=10.48.2.16, country=1, language=1, layer2tagging=1, vlanid=102"

dns-server 64.60.0.17

!

ip dhcp pool chartwell

network 10.48.27.0 255.255.255.0

default-router 10.48.27.1

option 156 ascii "ftpservers=10.48.2.16, country=1, language=1, layer2tagging=1, vlanid=102"

dns-server 64.60.0.17

!

no ip bootp server

ip domain lookup source-interface Loopback0

ip domain name xxx.intra

ip name-server 64.60.0.17

ip name-server 64.60.0.18

ip inspect log drop-pkt

!

multilink bundle-name authenticated

!

parameter-map type inspect global

log dropped-packets enable

parameter-map type ooo global

tcp reassembly queue length 64

tcp reassembly memory limit 4096

!

crypto pki token default removal timeout 0

!

crypto pki trustpoint TP-self-signed-4286009541

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-4286009541

revocation-check none

rsakeypair TP-self-signed-4286009541

!

crypto pki certificate chain TP-self-signed-4286009541

certificate self-signed 01 nvram:IOS-Self-Sig#1.cer

license udi pid CISCO2901/K9 sn FTX1622Y01L

!

username sitetech privilege 15 secret 4 nqDHNNAboQs3pRtIt7QPcjUYTEPSRmg5GiHQcIb3Uq2

!

redundancy

!

ip tcp synwait-time 10

ip ssh time-out 60

ip ssh authentication-retries 2

ip ssh version 1

!

class-map type inspect match-any SDM_AH

match access-group name SDM_AH

class-map type inspect match-any ccp-skinny-inspect

match protocol skinny

class-map type inspect match-all SSH_ACCESS

match access-group name SSH

class-map type inspect match-any ccp-cls-insp-traffic

match protocol dns

match protocol ftp

match protocol https

match protocol icmp

match protocol imap

match protocol pop3

match protocol netshow

match protocol shell

match protocol realmedia

match protocol rtsp

match protocol smtp

match protocol sql-net

match protocol streamworks

match protocol tftp

match protocol vdolive

match protocol tcp

match protocol udp

match protocol ntp

class-map type inspect match-all ccp-insp-traffic

match class-map ccp-cls-insp-traffic

class-map type inspect match-any SDM_IP

match access-group name SDM_IP

class-map type inspect match-any SDM_GRE

match access-group name SDM_GRE

class-map type inspect match-any SDM_ESP

match access-group name SDM_ESP

class-map type inspect match-any SDM_DMVPN_TRAFFIC

match protocol isakmp

match protocol ipsec-msft

match class-map SDM_AH

match class-map SDM_GRE

match class-map SDM_ESP

class-map type inspect match-all SDM_DMVPN_PT

match access-group 101

match class-map SDM_DMVPN_TRAFFIC

class-map type inspect match-any Mon-Echo-Svc

match protocol icmp

match protocol tcp

match protocol udp

class-map type inspect match-any ccp-h323nxg-inspect

match protocol h323-nxg

class-map type inspect match-any ccp-cls-icmp-access

match protocol icmp

match protocol tcp

match protocol udp

class-map type inspect match-any ccp-h225ras-inspect

match protocol h225ras

class-map type inspect match-any out-in

match access-group name out-in

class-map type inspect match-any ccp-h323annexe-inspect

match protocol h323-annexe

class-map match-any Call-Signaling

match ip dscp cs3

match ip dscp af31

class-map match-any Voice

match ip dscp ef

match access-group 161

class-map type inspect match-all ccp-cls-ccp-permit-1

match class-map Mon-Echo-Svc

match access-group name RM-Mon-Traffic

class-map type inspect match-any ccp-h323-inspect

match protocol h323

class-map type inspect match-all ccp-invalid-src

match access-group 100

class-map type inspect match-all ccp-icmp-access

match class-map ccp-cls-icmp-access

class-map type inspect match-any ccp-sip-inspect

match protocol sip

class-map type inspect match-all ccp-protocol-http

match protocol http

!

policy-map type inspect ccp-permit-icmpreply

class type inspect ccp-icmp-access

inspect

class class-default

pass

policy-map type inspect sdm-permit-gre

class type inspect SDM_GRE

pass

class class-default

drop log

policy-map type inspect ccp-inspect

class type inspect ccp-invalid-src

drop log

class type inspect ccp-protocol-http

inspect

class type inspect ccp-insp-traffic

inspect

class type inspect ccp-sip-inspect

inspect

class type inspect ccp-h323-inspect

inspect

class type inspect ccp-h323annexe-inspect

inspect

class type inspect ccp-h225ras-inspect

inspect

class type inspect ccp-h323nxg-inspect

inspect

class type inspect ccp-skinny-inspect

inspect

class class-default

drop

policy-map type inspect out-in

class type inspect out-in

inspect

class class-default

drop

policy-map type inspect ccp-permit

class type inspect SDM_DMVPN_PT

pass

class type inspect ccp-cls-ccp-permit-1

inspect

class type inspect SSH_ACCESS

inspect

class class-default

drop log

policy-map type inspect sdm-permit-ip

class type inspect SDM_IP

pass

class class-default

drop log

policy-map WAN-EDGE

class Voice

priority percent 33

class Call-Signaling

bandwidth percent 5

class class-default

fair-queue

!

zone security dmvpn-zone

zone security in-zone

zone security out-zone

zone-pair security sdm-zp-in-gre1 source in-zone destination dmvpn-zone

service-policy type inspect sdm-permit-ip

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

zone-pair security ccp-zp-in-out source in-zone destination out-zone

service-policy type inspect ccp-inspect

zone-pair security sdm-zp-gre-in1 source dmvpn-zone destination in-zone

service-policy type inspect sdm-permit-ip

zone-pair security ccp-zp-out-gre source out-zone destination dmvpn-zone

service-policy type inspect sdm-permit-gre

zone-pair security ccp-zp-gre-out source dmvpn-zone destination out-zone

service-policy type inspect sdm-permit-gre

zone-pair security ccp-zp-self-out source self destination out-zone

service-policy type inspect ccp-permit-icmpreply

zone-pair security out-in source out-zone destination in-zone

service-policy type inspect out-in

!

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

!

crypto isakmp policy 11

encr 3des

authentication pre-share

group 2

crypto isakmp key *********** address x.x.x.x

crypto isakmp key *********** address 0.0.0.0 0.0.0.0

crypto isakmp invalid-spi-recovery

crypto isakmp keepalive 10 periodic

!

crypto ipsec transform-set jag-trans esp-aes 256 esp-md5-hmac

crypto ipsec transform-set JAG-agent esp-3des esp-sha-hmac

!

crypto ipsec profile jag-agent

set transform-set JAG-agent

!

crypto ipsec profile jag-dmvpn

set transform-set jag-trans

!

crypto map vpn 11 ipsec-isakmp

description VPN tunnel to Jeff Russell Sonicwall

set peer z.z.z.z

set security-association lifetime seconds 86400

set transform-set JAG-agent

match address 102

!

interface Loopback0

description $FW_INSIDE$

ip address 10.48.255.17 255.255.255.255

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

zone-member security in-zone

load-interval 30

!

interface Tunnel0

description DMVPN via TelePacific$FW_INSIDE$

bandwidth 1000

ip address 10.255.48.18 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip mtu 1400

ip flow ingress

ip nhrp authentication DMVPN_NW

ip nhrp map 10.255.48.254 206.82.221.230

ip nhrp map multicast 206.82.221.230

ip nhrp network-id 100000

ip nhrp holdtime 30

ip nhrp nhs 10.255.48.254

zone-member security dmvpn-zone

ip tcp adjust-mss 1360

ip summary-address eigrp 1048 10.48.16.0 255.255.252.0

delay 1000

qos pre-classify

tunnel source GigabitEthernet0/0

tunnel mode gre multipoint

tunnel key 100000

tunnel protection ipsec profile jag-dmvpn

!

interface Null0

no ip unreachables

!

interface Embedded-Service-Engine0/0

no ip address

shutdown

!

interface GigabitEthernet0/0

description TelePacific Internet$FW_OUTSIDE$

ip address y.y.y.y 255.255.255.248

ip access-group MILLS in

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat outside

ip virtual-reassembly in

zone-member security out-zone

load-interval 30

duplex auto

speed auto

no cdp enable

no mop enabled

crypto map vpn

service-policy output WAN-EDGE

!

interface GigabitEthernet0/1

description Inside Trunk

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip virtual-reassembly in

load-interval 30

duplex auto

speed auto

no mop enabled

!

interface GigabitEthernet0/1.101

description PD Data$ETH-LAN$$FW_INSIDE$

encapsulation dot1Q 101

ip address 10.48.25.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

zone-member security in-zone

!

interface GigabitEthernet0/1.102

description PD Voice$ETH-LAN$$FW_INSIDE$

encapsulation dot1Q 102

ip address 10.48.26.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

zone-member security in-zone

!

interface GigabitEthernet0/1.110

description PD Chartwell$ETH-LAN$$FW_INSIDE$

encapsulation dot1Q 110

ip address 10.48.27.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

zone-member security in-zone

!

router eigrp 1048

network 10.0.0.0

network 10.48.0.0 0.0.255.255

network 10.255.48.0 0.0.0.255

network 10.255.49.0 0.0.0.255

passive-interface GigabitEthernet0/0

!

ip local policy route-map pbr-ping-monitor

no ip forward-protocol nd

no ip forward-protocol udp tftp

no ip forward-protocol udp nameserver

no ip forward-protocol udp domain

no ip forward-protocol udp time

no ip forward-protocol udp netbios-ns

no ip forward-protocol udp netbios-dgm

no ip forward-protocol udp tacacs

!

ip http server

ip http access-class 90

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip nat inside source list 1 interface GigabitEthernet0/0 overload

ip nat inside source list 110 interface GigabitEthernet0/0 overload

ip nat inside source static tcp 10.48.25.24 80 198.101.110.27 80 extendable

ip nat inside source static tcp 10.48.25.24 443 198.101.110.27 443 extendable

ip nat inside source static tcp 10.48.25.24 4000 198.101.110.27 4000 extendable

ip nat inside source static tcp 10.48.25.24 44000 198.101.110.27 44000 extendable

ip nat inside source static 10.48.25.24 198.101.110.27

ip route 0.0.0.0 0.0.0.0 198.101.110.25

ip route 10.48.4.0 255.255.252.0 10.48.13.15

!

ip access-list extended Mon-Echo-Traffic

remark CCP_ACL Category=128

permit ip r.r.r.r 0.0.0.31 any

ip access-list extended NATIP

deny ip 10.48.0.0 0.0.255.255 10.0.0.0 0.0.0.255

permit ip 10.48.0.0 0.0.255.255 any

ip access-list extended RM-Mon-Traffic

remark CCP_ACL Category=128

permit ip 206.82.221.224 0.0.0.31 any

ip access-list extended SDM_AH

remark CCP_ACL Category=1

permit ahp any any

ip access-list extended SDM_ESP

remark CCP_ACL Category=1

permit esp any any

ip access-list extended SDM_GRE

remark CCP_ACL Category=1

permit gre any any

ip access-list extended SDM_IP

remark CCP_ACL Category=0

permit ip any any

ip access-list extended SSH

permit tcp any any eq 22

ip access-list extended natip

ip access-list extended out-in

permit tcp any host 10.48.25.24 eq 443

permit tcp any host 10.48.25.24 eq 4000

permit tcp any host 10.48.25.24 eq 44000

permit tcp any host 10.48.25.24 eq www

ip access-list extended pbr-ping-TP

permit icmp host y.y.y.y host r.r.r.r

!

access-list 1 permit 10.48.0.0 0.0.255.255

access-list 23 permit 10.10.10.0 0.0.0.7

access-list 23 permit 10.48.0.0 0.0.255.255

access-list 90 remark HTTP Server ACL

access-list 90 permit 10.255.48.0 0.0.0.255

access-list 90 permit 10.48.0.0 0.0.255.255

access-list 90 permit 10.20.0.0 0.3.255.255

access-list 90 permit 10.16.1.0 0.0.0.255

access-list 90 permit 206.82.221.224 0.0.0.15

access-list 90 deny any

access-list 100 permit ip 198.101.110.24 0.0.0.3 any

access-list 100 remark CCP_ACL Category=128

access-list 100 permit ip host 255.255.255.255 any

access-list 100 permit ip 127.0.0.0 0.255.255.255 any

access-list 100 permit ip any host 198.101.110.26

access-list 101 permit ip any host 198.101.110.26

access-list 102 permit ip 10.48.25.0 0.0.0.255 192.168.0.0 0.0.0.255

access-list 102 permit ip 10.48.26.0 0.0.0.255 192.168.0.0 0.0.0.255

access-list 102 permit ip 10.48.25.0 0.0.0.255 172.17.1.0 0.0.0.255

access-list 102 permit ip 10.48.26.0 0.0.0.255 172.17.1.0 0.0.0.255

access-list 103 remark VTY Access-class list1

access-list 103 permit ip 10.255.48.0 0.0.0.255 any

access-list 103 permit ip 10.48.0.0 0.0.255.255 any

access-list 103 permit ip 10.16.1.0 0.0.0.255 any

access-list 103 permit ip 10.20.0.0 0.3.255.255 any

access-list 103 permit ip r.r.r.r 0.0.0.31 any

access-list 103 deny ip any any

access-list 110 permit ip 10.48.0.0 0.0.255.255 any

access-list 111 permit ip 10.48.0.0 0.0.255.255 any

access-list 161 remark : ShoreTel Voice over IP Ports

access-list 161 permit udp any any eq 2427

access-list 161 permit udp any any eq 2727

access-list 161 permit udp any any range 5440 5446

access-list 161 permit udp any any eq 5004

access-list 161 permit udp any any eq 5060

access-list 161 permit tcp any any eq 5060

access-list 161 permit udp host 10.48.14.16 gt 1024 any gt 1024

access-list 161 permit udp 10.48.10.0 0.0.0.255 any

!

control-plane

!

banner login ^CCThis system is considered private and proprietary and is subject to audit. The unauthorized access, use or modification of this or any other computer systems or networks or of the data contained therein or in transit thereto/therefrom is

Disconnect IMMEDIATELY if you are not an authorized user!

^C

!

line con 0

login local

transport output telnet

line aux 0

login local

line 2

no activation-character

no exec

transport preferred none

transport input all

transport output pad telnet rlogin lapb-ta mop udptn v120 ssh

stopbits 1

line vty 0 4

privilege level 15

login local

transport input telnet ssh

line vty 5 15

privilege level 15

login local

transport input telnet ssh

!

scheduler allocate 20000 1000

ntp server 192.12.19.20

ntp server 164.67.62.194

end