IPSec over GRE between Cisco UC540 Series and Linux

Stefano Pilla · ‎05-03-2012

Hi all,

I've a problem with an IPSec ove GRE Tunnel between a Cisco Router and a Linux Server with Racoon

My goal is that all the traffic that transit from the subnet behind our server that need to reach our Lan should be encrypted (and viceversa, from our LAN to the Server's LAN).

I've tried to configure an IPSec Tunnel but I've some problems and I'm not be able to identify the causes.

I've this logical situation:

The UC540 configuration is:

crypto keyring SRV

description Keys for Server

pre-shared-key address 10.1.1.2 key <key>

!

crypto isakmp policy 2

encr 3des

authentication pre-share

group 2

crypto isakmp profile Server

keyring SRV

match identity address 10.1.1.2 255.255.255.255

crypto ipsec transform-set srvtransform esp-3des esp-sha-hmac

crypto map srv-cryptomap 1 ipsec-isakmp

set peer 10.1.1.2

set transform-set srvtransform

set pfs group2

set isakmp-profile Server

match address SERVER_VPN

interface Tunnel1

description Connection to Server

ip address 10.1.1.1 255.255.255.252

tunnel source FastEthernet0/0

tunnel destination <Public_IP_SERVER>

crypto map srv-cryptomap

ip access-list extended SERVER_VPN

permit gre host 192.168.75.2 host <Public_IP_SERVER>

permit ip host 10.1.1.1 host 10.1.1.2

permit ip host 10.1.1.1 192.168.198.0 0.0.0.255

permit ip 192.168.200.0 0.0.0.255 host 10.1.1.2

permit ip 10.168.200.0 0.0.0.255 host 10.1.1.2

permit ip 192.168.75.0 0.0.0.255 host 10.1.1.2

permit ip 192.168.200.0 0.0.0.255 192.168.198.0 0.0.0.255

permit ip 10.168.200.0 0.0.0.255 192.168.198.0 0.0.0.255

permit ip 192.168.75.0 0.0.0.255 192.168.198.0 0.0.0.255

deny ip any any

ip access-list extended NONAT-IPSEC

deny ip 10.168.200.0 0.0.0.255 host 10.1.1.2

deny ip 192.168.75.0 0.0.0.255 host 10.1.1.2

deny ip 192.168.200.0 0.0.0.255 host 10.1.1.2

deny ip host 10.1.1.1 host 10.1.1.2

permit ip 192.168.200.0 0.0.0.255 any

permit ip 10.168.200.0 0.0.0.255 any

permit ip 192.168.75.0 0.0.0.255 any

deny ip any any

ip nat inside source route-map NO_NAT interface FastEthernet0/0 overload

route-map NO_NAT permit 10

match ip address NONAT-IPSEC

For completeness I also show you the Racoon configuration that is relative simple. It is composed by two files:

/etc/racoon/racoon.conf : the configuration file used to configure various aspects of the IPsec connection, including authentication methods and encryption algorithms used in the connection

/etc/ipsec-tools.conf : SetKey daemon configuration file that manipulates the key management and security attributes of IPsec in the kernel. This executable is controlled by the racoon key management daemon

/etc/racoon/racoon.conf

path pre_shared_key "/etc/racoon/psk.txt";

path certificate "/etc/racoon/certs";

listen

{

isakmp 10.1.1.2[500];

adminsock disabled;

}

timer

{

natt_keepalive 10 sec;

}

remote 10.1.1.1 {

#Exchange mode for IKE

exchange_mode main;

#When a new key should be generated

lifetime time 86400 sec;

proposal {

encryption_algorithm 3des;

hash_algorithm sha1;

authentication_method pre_shared_key;

dh_group 2;

}

#Everybody can initialize the tunnel

sainfo anonymous {

### Diffie-HellMan Group 2 - Key Exchange Protocol

pfs_group 2;

### Encryption algorithms

encryption_algorithm 3des;

#### Authentication algorithms

authentication_algorithm hmac_sha1;

#### Compression for faster trasmission

compression_algorithm deflate;

###When a new key should be generated

lifetime time 86400 sec;

}

/etc/ipsec-tools.conf

#!/usr/sbin/setkey -f

flush;

spdflush;

spdadd 10.1.1.2/32[any] 10.1.1.1/32[any] any -P out ipsec