cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1237
Views
5
Helpful
7
Replies

Secure interface using IPSEC

louis0001
Participant
Participant

Hi,

we have 2 routers connected to each other via an IPSec tunnel. Both routers are on private networks so there is no natting going on.

The IPSec tunnel is fine and traffic is flowing between the local networks (crypto map/access lists are fine) via the tunnel.

I know I need to secure the outside interface but unsure what sort of ACL is needed so that only IPSec traffic is allowed both in and out and no other traffic enters/leaves the router unless it is via the IPSec tunnel.

 

7 Replies 7

Francesco Molino
VIP Mentor VIP Mentor
VIP Mentor
Hi

The outside interface is also using private subnets?
On your acl inbound, default IPsec needs to be allowed (ah, esp, udp-500/4500 if nat).
When it comes to secure a router, i always user zbf instead of simple asked acls (zbf requires security features and it's binded with a specific license or specific ios image depending on the router you're using). Here a link that can help for zbf:
https://www.cisco.com/c/en/us/support/docs/routers/3800-series-integrated-services-routers/112051-zbf-vpn-access-config.html

You're going to see also the acl for inbound.

For outbound, you don't usually limit the traffic to only ipsec, except if you only have this traffic going through.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

Yes, the routers are on private subnets as they are internal routers. This particular one requires IPSec between the endoints to secure the traffic so basically all traffic from the lan needs to go through the vpn with nothing going through the outside interface.

Did you try the acl on the outside interface as mentioned and/or the zbf feature?

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

Hi,

yes I applied an ACL for IPSec on the outside interface in the IN direction and it appears to be working. All other lan traffic is listed as interesting traffic for the vpn.

Is this enough to prevent any traffic leaving the router unencrypted?

This is for incoming traffic only. You need to have another acl for outgoing traffic limiting ipsec ports (like the one on the inbound) but this time port are source ports and not destination

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

When configuring the Client SSH authentication using RAS , pasted at the box indicated for SG350 , caught error , "Key header expected " where from the show CLI , none such inform listed ?

YES, FROM <...> HEADER INCLUDED LATER, IT CONFIGURED THROUGH.

 

 

 

 

aa321123
Beginner
Beginner

Would SSL L2TP, such vpn setting  block,   LAG group lan.port.Router(s)'  connection ?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers