Purpose:
1. Use GNS3 to simulate a Remote access VPN environment.
2. Practice to install ASDM 603 in PIX version 802
3. Install ASDM client and configure Remote access VPN.
4. Use Cisco VPN client to connect to inside network.
Tools:
1. Dynamips 0.2.8, http://www.ipflow.utc.fr/blog/
2. GNS3 V0.6, http://www.gns3.net/
3. Virtual PC Simulator 01.6a: http://wiki.freecode.com.cn/doku.php?id=wiki:vpcs
4. PuTTY 0.6: http://www.chiark.greenend.org.uk/~sgtatham/putty/
5. Battle Encoder Shirase (BES1.3.8): http://mion.faireal.net/BES/
6. PIX802.bin and ASDM603.bin.
7. Java 6 update 7 (Don’t use Java 6 update 10 or 11, it is incompatible with ASDM603. If you intent to use these versions, you have to chose higher ASDM version. Please refer to my Blog: http://jhuang8.blogspot.com/2009/01/cisco-asdm-unconnected-sockets-not.html)
Topological:
Requires:
1. Outside PCs use Cisco VPN client to connect to the Inside network.
2. Outside PCs IP range: 76.77.0.0/16.
3. Inside PCs IP range: 10.10.10.0/24
4. VPN IP Pool: 10.10.10.100 --- 10.10.10.200
5. Dns server is 208.67.222.222
6. The ranger of IP that can be distributed is 172.20.0.0/16
7. Outside network connect to e0
8. We are going to use the real Pc to simulate the Outside PC, and use “Virtual PC Simulator” to simulate the Inside PC.
Procedure:
1. Install Microsoft Loopback virtual networking card. In order to install ASDM client and VPN client, we have to connect GNS3 to a real PC. It is good to install a virtual networking interface for this purpose, with this way, we don’t need to change the configuration of the real networking card which could cause some networking connection problems.
1.1 Open “control panel”-> “Add Hardware”
1.2 Follow the “Add Hardware Wizard”.
1.3 Select “Yes, I have already connected the hardware” in “Is the hardware connected” window.
1.4 In “hardware list” window, click “Add a new hardware device” on the bottom of the list.
1.5 Select “install the hardware that I manually select from a list”.
1.6 Select “ Network adapters”
1.7 Select “Microsoft Loopback Adapter”.
1.8 After some files are copied, we’ve done the installation.
1.9 Open “Network connections” window.
1.10 Change the Adapter name to “MS Loopback”
Click here to watch the video 1: Install MS Loopback adapter
2. If this is the first time that you are running GNS3, you need to do some settings:
2.1 GNS3 will open a “Setup wizard” window to guide you through the settings. Click the big “1” button, or you can click the menu “Edit”-> “Preferences” to open the same window.
2.2 In “General” window, Setup the “Terminal command”, Project directory and IOS/PIX directory.
2.3 In “Dynamips” window, setup the “working directory”, then click “test” button to check if Dynamips works.
2.4 In “Pemu” window, setup the “working directory”, the pix image location, key and serial number.
2.5 Click the big “2” button to setup the IOS images, or you can click the menu “Edit” -> “IOS images and hypervisors” to open the same window.
2.6 Setup the image file, platform, model, default RAM for each router. You can check the default RAM value from Cisco website.
2.7 Setup the router Idle value to reduce the CPU usage. Draw the router icon to the topologic panel
2.8 Right click the icon, click “start” to start the router.
2.9 Right click the icon again, and click “console”, a Putty window will open up.
2.10 Press enter until the “>” prompt appears, if there is a question:” Would you like to enter the initial configuration dialog?” answer “no”.
2.11 Right click the icon again and click “Idle PC”, and select an idle pc value from the pop up window, choose one of the values with an asterisk.
2.12 Calculate other routers’ Idle PC value.
Click here to watch the video 2: Configure GNS3
3.1 Run virtual PC simulator. Double click “vpcs.exe”, it will open a command line window. Wait until the “VPSC 1>” prompt appears. It is better to run vpcs before running GNS3.
3.2 Run GNS3, click the menu “Edit”-> “Symbol Manager”, add 3 symbols:
| Symbol | Name | Type |
| Computer | Computer | Cloud |
| Cloud | Internet | Ethernet switch |
| Server | Server | cloud |
Click “ok” to exit “Symbol Manager”
3.3 Draw the Icons to topological panel, put notes for every icon (refer to the topologic graph).
3.4 Setup “OutsidePC” using MS loopback adapter.
3.5 Setup “InsidePC” using vpc
3.6 Connect the equipments, remember in PIX, e0 is usually for outside network, e1 for inside network.
3.7 Add notes for the connection.
3.8 Save the topologic design.
Click here to watch the video 3: Create topological graph.
4. Configure the outside and inside network:
4.1 Run “Windows Task Manager” to monitor the CPU usage.
4.2 Run BES1.3.8
4.3 Right click the Firewall Icon “FW0”, choose “start”.
4.4 Right click Icon “FW0” again, and choose “console”, a Putty window pops up.
4.5 Wait until the firewall initializing finished, the “>” prompt appears.
4.6 The CPU usage rise to 100%, we need to limit it. Open BES window, click “Target” button, choose “pemu.exe” process, click “Limit/Watch”, click “Yes” to confirm. Click “Control” button, choose a percentage. For this example, I choose -50%
4.7 Back to Putty window.
4.8 Enter commands in PIX CLI:
pixfirewall> en
Password:
pixfirewall# show version
4.9 Check the “show version” output, if the VPN-DES and VPN-3DES-AES” are disabled, “ac
4.10 Use “show version” command again, now the VPN-DES feature should be enabled.
4.11 Configure outside connection IP address and network zone.
pixfirewall# show ip address
pixfirewall# show interface ip brief
pixfirewall# conf t
pixfirewall(config)# interface e0
pixfirewall(config-if)# ip address 76.77.78.1 255.255.0.0
pixfirewall(config-if)# nameif outside
pixfirewall(config-if)# security-level 0
pixfirewall(config-if)# speed 100
pixfirewall(config-if)# duplex full
pixfirewall(config-if)# no shut
pixfirewall(config-if)# show run
4.12 Minimize the GNS3 window. Open the “Network Connections” window, Right click the MS Loopback Adapter Icon, click “Properties” to open the Adapter’s properties window; In “General” tab, select “Internet Protocol(TCP/IP), click “Properties” button. Change the IP settings: IP address: 76.77.78.79, Subnet mask: 255.255.0.0, Default gateway: 76.77.78.1. Click “ok” to exit the setting.
4.13 Click “Start” -> “Run”-> “cmd”, open a command line windows,
> ipconfig ;Verify the MS Loopback adapter IP address
> ping 76.77.78.1 ; Check the connection between the outside pc and firewall.
4.14 Return to GNS3, Putty window:
pixfirewall(config-if)# ping 76.77.78.79
;Check the connection between the outside pc and firewall.
pixfirewall(config-if)# exit
4.15 Configure the inside zone:
pixfirewall(config)# interface e1
pixfirewall(config-if)# nameif inside
pixfirewall(config-if)# security-level 100
pixfirewall(config-if)# speed 100
pixfirewall(config-if)# duplex full
pixfirewall(config-if)# no shut
pixfirewall(config-if)# ip address 10.10.10.1 255.255.255.0
pixfirewall(config-if)# show ip address
pixfirewall(config-if)# show interface ip brief
4.16 Minimize the GNS3 window, active the vpcs window,
VPCS 1>show ip address
VPCS 1> ip 10.10.10.11 10.10.10.1 24
VPCS 1> ping 10.10.10.1 ; Check the connection between the inside pc and firewall.
4.17 Return to GNS3, Putty window:
pixfirewall(config-if)# ping 10.0.1.11 ; Check the connection between the inside pc and firewall.
pixfirewall(config-if)# wr ;Save the configuration
Click here to watch the video 4: Configure ip address and network zone.
5. Upload ASDM803.bin to flash.
5.1 pixfirewall(config-if)# end
pixfirewall# show flash
If you couldn’t find “asdm-603.bin” in the flash files list, you need to upload the file from tftp server
5.2 Run SolarWinds TFTP Server, click the menu “File”-> “Configure”. In “General” tab, select the bin file directory in “Storage” section. Click “Security” tab, make sure “Send and Receive files” option is selected. Back to “General” tab, Click “Start”.
5.3 Back to Putty window.
pixfirewall# copy tftp://76.77.78.79/asdm-603.bin flash:
pixfirewall# show flash ;Check if the bin file has already been uploaded
5.4 Enable the http server
pixfirewall# conf t
pixfirewall(config)# http server enable
pixfirewall(config)# http 10.10.10.0 255.255.255.0 inside
pixfirewall(config)# http 76.77.0.0 255.255.0.0 outside
pixfirewall(config)# asdm image flash:asdm-603.bin
pixfirewall(config)# asdm history enable
pixfirewall(config)# username cisco password test1234 privilege 15
pixfirewall(config)# ping 76.77.78.79
pixfirewall(config)# end
pixfirewall# wr
Click here to watch the video: 5. Upload ASDM803.bin to flash
6. Install ASDM.
6.1 pixfirewall# show run ;Double check the settings
6.2 Run IE browser, enter the address: https://76.77.78.1
6.3 Click “Continue to this website”
6.4 Click “Install ASDM Launcher and Run ASDM
6.5 Enter username and password
6.6 Click “Run” button to install ASDM
6.7 When the ASDM Launcher window pops up, enter the ip address, username and password.
6.8 If there is a warning message: “The web site’s certificate cannot be verified. Do you want to continue?” Choose “Always trust content from this publisher.” Click “Yes” to continue.
6.9 Now you will be able to see the main window of ASDM
Click here to watch the video 6: Install ASDM
7. Use “IPsec VPN Wizard” to setup Remote access VPN
7.1 Click the menu “Wizards”-> “IPsec VPN Wizard”
7.2 Choose “Remote Access”.
7.3 Choose “Cisco VPN Client”
7.4 Enter the Pre-Shared Key and Group name
7.5 Choose “Authenticate using the local user database”
7.6 Add some username and password
7.7 Create IP Pool: start from 10.10.10.100, end with 10.10.10.200, subnet mask is 255.255.255.0
7.8 Enter default Domain name (optional)
7.9 Choose 3des and SHA as the encryption and authentication algorithm
7.10 NAT setting
7.11 Click “finish” button, return to main window
7.12 Click “save” button to save the current configuration
Click here to watch the video 7: IPsec VPN Wizard
8. Connect VPN with Cisco VPN Client
8.1 Run Cisco VPN Client.
8.2 Click “New” button to define a new VPN connection
8.3 Enter the host ip, group name, password etc.
8.4 Click “save” button.
8.5 Double click the VPN connection that you just defined
8.6 Enter username and password
8.7 In ASDM window, you could see that there is one VPN connection.
8.8 Right click the VPN icon that located on the system tray (the right down side of the screen), choose “Statistics”, you’ll be able to see the Tunnel Details and Route Details.
8.9 Open a command line window, enter “ipconfig” to check the ip address. You’ll be able to see the ip address of the VPN adapter is 10.10.10.100.
Click here to watch the video 8: Cisco VPN Client
Congratulations! You’ve done everything!
= = = = ================================================================
Video List:
1. Click here to watch the video 1: Install MS Loopback adapter
2. Click here to watch the video 2: Configure GNS3
3. Click here to watch the video 3: Create topological graph.
4. Click here to watch the video 4: Configure ip address and network zone.
5. Click here to watch the video: 5. Upload ASDM803.bin to flash
6. Click here to watch the video 6: Install ASDM
7. Click here to watch the video 7: IPsec VPN Wizard
8. Click here to watch the video 8: Cisco VPN Client
Thanks for Your Lab. It seems you are working on CCSP or Security side.
ReplyDelete