Security threat in IPSec with dynamic IP address. (Cisco ASA/FPR)

[eduard.hoffmann]

Hi all, I want to ask the community if my understanding is correct.

Waht we have:

1. Centrale ASA with static Public-IP.
IP-Address in LAN - 10.0.10.0/24

2. Remote FW-1 with dynamic Public-IP.
IP-Address in LAN - 10.0.20.0/24
ISAKMP-ID : fw-id-1
PSK: xxxxx

3. Remote FW-2 with dynamic Public-IP.
IP-Address in LAN - 10.0.30.0/24
ISAKMP-ID : fw-id-2
PSK: yyyyy

4. FW-1 and FW-2 have IPsec-Tunnel to Central-ASA.
5. On Central-ASA we standart config for this case:
crypto ikev2 policy 1
  encryption aes-256
  integrity sha512 sha384 sha256
  group 21 19 15
  prf sha512 sha384 sha256
  lifetime seconds 28800
!
access-list outside-1_cryptomap extended permit ip object LAN-MainOffice_10.0.10.0-24 object LAN-Remote_10.0.20.0_24
access-list outside-1_cryptomap_1 extended permit ip object LAN-MainOffice_10.0.10.0-24 object LAN-Remote_10.0.30.0-24
!
crypto ipsec ikev2 ipsec-proposal IKEv2-Proposal
  protocol esp encryption aes-256
  protocol esp integrity sha-512 sha-384 sha-256
!
crypto dynamic-map ifw-id-1 1 match address outside-1_cryptomap
crypto dynamic-map fw-id-1 1 set pfs
crypto dynamic-map fw-id-1 1 set ikev2 ipsec-proposal IKEv2-Proposal
crypto dynamic-map fw-id-2 2 match address outside-1_cryptomap_1
crypto dynamic-map fw-id-2 2 set pfs
crypto dynamic-map fw-id-2 2 set ikev2 ipsec-proposal Proposal2 IKEv2-Proposal
!
crypto map Outside_Map 1 ipsec-isakmp dynamic fw-id-1
crypto map Outside_Map 2 ipsec-isakmp dynamic fw-id-2
crypto map Outside_Map 65535 ipsec-isakmp dynamic Dynamic_CryptoMap_VPN
crypto map Outside_Map interface outside-1
!
crypto ikev2 enable outside-1
!
group-policy GroupPolicy-IKEv2 internal
  group-policy GroupPolicy-IKEv2 attributes
  vpn-tunnel-protocol ikev2
!
tunnel-group fw-id-1 type ipsec-l2l
tunnel-group fw-id-1 general-attributes
  default-group-policy GroupPolicy-IKEv2
tunnel-group fw-id-1 ipsec-attributes
  ikev2 remote-authentication pre-shared-key *****
  ikev2 local-authentication pre-shared-key *****
tunnel-group fw-id-2 type ipsec-l2l
tunnel-group fw-id-2 general-attributes
  default-group-policy GroupPolicy-IKEv2
tunnel-group fw-id-2 ipsec-attributes
  ikev2 remote-authentication pre-shared-key *****
  ikev2 local-authentication pre-shared-key *****

Question:
In this configuration, FW-1 can easily establish an IPsec Tunnel using the IP address of FW-2's LAN.
In other words, a planned configuration:
  - VPN-1  FW-1 (LAN-10.0.20.0/24) - ASA (LAN-10.0.10.0/24)
  - VPN-2  FW-2 (LAN-10.0.30.0/24) - ASA (LAN-10.0.10.0/24)
Unwanted configuration is allowed in this case:
  - VPN-1  FW-1 (LAN-10.0.30.0/24) - ASA (LAN-10.0.10.0/24)
or
  - VPN-2  FW-2 (LAN-10.0.20.0/24) - ASA (LAN-10.0.10.0/24)
Because when searching for matches in 'crypto dynamic-map' it does not take into account with which ISAKMP-ID the authorization occurred.

Maybe I missed something and there is a possibility to fix this security problem?

[Sheraz.Salim]

Yes, your understanding is correct. In the provided configuration, the ASA's dynamic crypto maps do not differentiate between the two remote firewalls based on their ISAKMP-ID. As a result, it is possible for FW-1 to establish a VPN tunnel with its LAN IP (10.0.30.0/24) instead of its designated LAN IP (10.0.20.0/24), and similarly for FW-2.

To address this security concern and ensure that each firewall only establishes VPN tunnels with its designated LAN IP, you can utilize separate crypto maps for each tunnel with specific access lists matching the correct source and destination subnets.

Here's how you can modify your configuration:

access-list outside-1_cryptomap_fw-id-1 extended permit ip object LAN-MainOffice_10.0.10.0-24 object LAN-Remote_10.0.20.0_24
access-list outside-1_cryptomap_fw-id-2 extended permit ip object LAN-MainOffice_10.0.10.0-24 object LAN-Remote_10.0.30.0_24
!
crypto dynamic-map ifw-id-1 1 match address outside-1_cryptomap_fw-id-1
crypto dynamic-map fw-id-2 1 match address outside-1_cryptomap_fw-id-2

With this modification, each firewall will only match its designated access list, ensuring that FW-1 will only establish a VPN tunnel with LAN IP 10.0.20.0/24 and FW-2 with LAN IP 10.0.30.0/24. This prevents the unwanted configuration scenarios you described

[eduard.hoffmann]

Hi Sheraz,

thank you for your answer. But in my configuration I also use separate crypto maps:
  crypto dynamic-map ifw-id-1 1 match address outside-1_cryptomap
  crypto dynamic-map fw-id-2 2 match address outside-1_cryptomap_1
But it don't resolve the problem. I have tested it in my labor.
Another 'crypto dynamic-map' will not help us.

[MHM Cisco World]

In this configuration, FW-1 can easily establish an IPsec Tunnel using the IP address of FW-2's LAN.!!

1- If FW-1 have ASA central IP only under crypto map then it can not establish vpn to FW-2' same for FW-2

2-You can use one supernet in ASA use for ACL for both FW-1/2

3- You can add vpn filter (if you want) in ASA filter traffic of FW-1 toward ASA LAN only and deny other and do same for FW-2

MHM

[eduard.hoffmann]

>> In this configuration, FW-1 can easily establish an IPsec Tunnel using the IP address of FW-2's LAN.!!
That's exactly what I wrote in the description of my question

Regarding your notes 1,2,3. My question is not about how to configure the FW-1 or FW-2, it's about how to configure the central FW(ASA).
FW-1 and FW-2 may be out of your administrative control. For example, if FW-1/FW-2 are business partners who need to provide access to certain servers on your network. Seems like in this case you just have to hope they are honest and that they don't get hacked.

[MHM Cisco World]

Sorry I make you wait 
I run lab and test the config you share and it not work, it work only when remove match address from the dynamic-map 

MHM

[eduard.hoffmann]

Can you show the konfig from Central ASA?

[MHM Cisco World]

Sure, I am out home now after 2 hours config of asa and both IPsec Spoke will share here

MHM

[MHM Cisco World]

ASA

hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
nameif OUT
security-level 0
ip address 100.0.0.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif IN
security-level 100
ip address 5.0.0.1 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address

ftp mode passive
access-list VPN extended permit ip 5.0.0.0 255.255.255.0 10.0.0.0 255.255.255.0
access-list VPN extended permit ip 5.0.0.0 255.255.255.0 20.0.0.0 255.255.255.0
pager lines 23
mtu OUT 1500
mtu IN 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
router ospf 100
network 5.0.0.0 255.255.255.0 area 0
network 100.0.0.0 255.255.255.0 area 0
log-adj-changes
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set mhm esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map MAP 10 set ikev1 transform-set mhm
crypto dynamic-map MAP 10 set reverse-route
crypto map MAP 65535 ipsec-isakmp dynamic MAP
crypto map MAP interface OUT
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
crypto ikev1 enable OUT
crypto ikev1 policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400

crypto ikev1 policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ip-options
inspect netbios
inspect rtsp
inspect sunrpc
inspect tftp
inspect xdmcp
inspect icmp
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect esmtp
inspect sqlnet
inspect sip
inspect skinny
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
!
service-policy global_policy global
prompt hostname context

MHM

[MHM Cisco World]

crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 100.0.0.1
!
!
crypto ipsec transform-set mhm esp-des esp-md5-hmac
!
!
!
crypto map MAP 10 ipsec-isakmp
set peer 100.0.0.1
set transform-set mhm
match address VPN
!
!
!
!
!
interface Ethernet0/0
duplex auto
!
interface Ethernet0/1
no switchport
ip address dhcp
ip ospf 100 area 0
duplex auto
crypto map MAP
!
interface Ethernet0/2
duplex auto
!
interface Ethernet0/3
no switchport
ip address 20.0.0.3 255.255.255.0
ip ospf 100 area 0
duplex auto
!
router ospf 100
!
!
no ip http server
!
!
ip access-list extended VPN
permit ip 20.0.0.0 0.0.0.255 5.0.0.0 0.0.0.255

MHM

[MHM Cisco World]

crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 100.0.0.1
!
!
crypto ipsec transform-set mhm esp-des esp-md5-hmac
!
!
!
crypto map MAP 10 ipsec-isakmp
set peer 100.0.0.1
set transform-set mhm
match address VPN
!
!
!
!
!
interface Ethernet0/0
no switchport
ip address dhcp
ip ospf 100 area 0
duplex auto
crypto map MAP
!
interface Ethernet0/1
duplex auto
!
interface Ethernet0/2
duplex auto
!
interface Ethernet0/3
no switchport
ip address 10.0.0.2 255.255.255.0
ip ospf 100 area 0
duplex auto
!
router ospf 100
!
!
no ip http server
!
!
ip access-list extended VPN
permit ip 10.0.0.0 0.0.0.255 5.0.0.0 0.0.0.255
!

MHM

[MHM Cisco World]

R4 (connect all spoke and Hub)
ip dhcp pool MHM
network 110.0.0.0 255.255.255.0
default-router 110.0.0.4
!
ip dhcp pool MHMMHM
network 120.0.0.0 255.255.255.0
default-router 120.0.0.4
!
!
no ipv6 cef
ipv6 multicast rpf use-bgp
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
no switchport
ip address 110.0.0.4 255.255.255.0
duplex auto
!
interface Ethernet0/1
no switchport
ip address 120.0.0.4 255.255.255.0
duplex auto
!
interface Ethernet0/2
no switchport
ip address 100.0.0.4 255.255.255.0
duplex auto

router ospf 100
network 100.0.0.0 0.0.0.255 area 0
network 110.0.0.0 0.0.0.255 area 0
network 120.0.0.0 0.0.0.255 area 0

MHM