IPSec VPN with Dynamic Routing / Mikrotik and Cisco

This example shows how to setup an IPSec VPN using dynamic routing protocol (RIP), it can be use also another protocol. In this exaple you can find setup between Mikrotik and Cisco routers, but it can be done also just between Mikrotik routers, but to be more colorfull I decided to use Mikrotik and Cisco. Below are the steps to complete the configuration of IPSec VPN with Dynamic Routing.


[edit] Mikrotik RouterOS

If you are using ROS v3.0 or above, be sure to check the end of this list to see a list of necessary mod.

First should configure a Tunnel Interface:

/ interface ipip
add name="Tunnel1" mtu=1480 local-address=10.10.1.100 remote-address=10.10.1.200 comment="" disabled=no

After that all interfaces are configured, than should asign IP addresses for interfaces:

/ ip address
add address=10.10.1.100/24 network=10.10.1.0 broadcast=10.10.1.255 interface=WAN comment="" disabled=no
add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=LAN comment="" disabled=no
add address=172.16.0.1/30 network=172.16.0.0 broadcast=192.168.0.3 interface=Tunnel1 comment="" disabled=no

Enable Routing in Mikrotik Router, in this case RIP:

/ routing rip
set redistribute-static=no redistribute-connected=no redistribute-ospf=no redistribute-bgp=no metric-static=1 \
metric-connected=1 metric-ospf=1 metric-bgp=1 update-timer=30s timeout-timer=3m garbage-timer=2m
/ routing rip interface
add interface=Tunnel1 receive=v2 send=v2 authentication=none authentication-key="" prefix-list-in="" prefix-list-out=""
/ routing rip neighbor
add address=172.16.0.2
/ routing rip network
add address=192.168.1.0/24
add address=172.16.0.0/30

IPSec setup, here should be defined the ipsec policy, peer and proposal. Make sure that policy should not have enabled option tunnel, in this case tunel should be set to NO, because it will be used the transport mode of IPSec not the tunnel mode:

/ ip ipsec proposal
add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no
/ ip ipsec peer
add address=10.10.1.200 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes \
proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no
/ ip ipsec policy
add src-address=10.10.1.100/32:any dst-address=10.10.1.200/32:any protocol=all action=encrypt level=require \
ipsec-protocols=esp tunnel=no sa-src-address=10.10.1.100 sa-dst-address=10.10.1.200 \
proposal=IPSec manual-sa=none dont-fragment=clear disabled=no

In V3.0 the bolded line will change on:

/ routing rip interface
add interface=Tunnel1 receive=v2 send=v2 authentication=none authentication-key="" in-prefix-list="" out-prefix-list=""
/ ip ipsec proposal
add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m pfs-group=modp1024 disabled=no
/ ip ipsec peer
add address=10.10.1.200/32:500 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes \
proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no


[edit] Cisco IOS

Cisco Interfaces and addresses:

FastEthernet 0/0
description *** WAN ***
ip address 10.10.1.200 255.255.255.0
crypto map vpn

FastEthernet 0/1
description *** LAN ***
ip address 192.168.2.1 255.255.255.0

Cisco Tunnel Interface:

interface Tunnel1
description **Cisco Peer**
ip address 172.16.0.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1480
ip rip v2-broadcast
ip tcp adjust-mss 1400
load-interval 30
tunnel source 10.10.1.200
tunnel destination 10.10.1.100
tunnel mode ipip
hold-queue 1024 in
hold-queue 1024 out

Routing in Cisco:

router rip
version 2
timers basic 30 60 90 90
redistribute connected metric 1 route-map connected-to-rip
redistribute static metric 5 route-map static-to-rip
network 172.16.0.2
network 192.168.2.0
distribute-list prefix LAN out
no auto-summary

Setup the prefix-list to match the Local subnet:

ip prefix-list LAN seq 10 permit 192.168.2.0/24

Setup route-maps to match interfaces to be advertised by RIP:

route-map connected-to-rip permit 10
match interface FastEthernet0/0
!
route-map static-to-rip permit 10
match ip address prefix-list LAN

IPSec and Crypto setup in Cisco, also here trasnport mode of IPSec should be setup:

!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key ipsec address 0.0.0.0 0.0.0.0
!
crypto ipsec security-association idle-time 600
!
crypto ipsec transform-set vpn esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 1 ipsec-isakmp
description **To Mikrotik Peer**
set peer 10.10.1.100
set transform-set vpn
set pfs group2
match address mikrotik_peer
!

Setup access-list to match the IPSec peer:

ip access-list extended mikrotik_peer
permit ipinip host 10.10.1.200 host 10.10.1.100

Type this in "enable" mode to view your routing table (after succesfull RIP update):

sh ip route

or

sh ip rip database

This example can be implemented also with another routing protocol like OSPF, and also very simply we can setup here a failover connection. Regarding the failover, the setup is very easy, all that we need is to create another set of tunnels via another ISP or gateway, but again the remote peer is the same router. Instead of the routing protocol for the second set of tunnels, it needs static routes to be configured, only that the static routes should have higher distance than the dynamic protocol. The idea is that, when the primary link will go down (dynamic routing distance=120) than the backup link becomes active (static routes distance=200), as soon as the primary link will come up, it will put the failover link in inactive mode.Titolo del collegamento

PPTPClient

PPtp Client / VPN

Now lets configure the remote client to connect to the above VPN

/interface pptp-client
add name="vpn-to-server" connect-to: 192.168.x.x user="user-1" password="********" allow=mschap1,mschap2

>print
Flags: X - disabled, R - running
0 X name="vpn-to-server" max-mtu=1460 max-mru=1460 connect-to=192.168.x.x
user="user-1" password="*******" profile=default-encryption
add-default-route=no allow=mschap1,mschap2
>enable 0

PPTPServer

A minimalistic HowTo for using a MT Router OS as PPTP-Server, based on 2.9.x. Use it on your own risk.

I prefer bridge-groups as they are always up and one can add physical interfaces later. The arp=proxy-arp is important.

N.B. 8 Oct 2007: "set gre disabled=no" is not active on RouterOS 3.0rc5

/ interface ethernet
set ether1 name="ether1"

/ interface bridge
add name="lan" arp=proxy-arp

/ interface bridge port
add interface=ether1 bridge=lan

/ ip address
add address=192.168.0.1/24 interface=lan

/ ip dns
allow-remote-requests=yes

/ ip firewall service-port
set gre disabled=no
set pptp disabled=no

/ ip pool
add name="pptp" ranges=192.168.0.200-192.168.0.229

/ ppp profile
add name="pptp-in" local-address=192.168.0.1 remote-address=pptp use-encryption=required only-one=yes change-tcp-mss=yes dns-server=192.168.0.1

/ interface pptp-server server
set enabled=yes max-mtu=1460 max-mru=1460 authentication=chap,mschap1,mschap2 default-profile=pptp-in

/ ppp secret
add name="user-1" service=pptp password="******" profile=pptp-in
add name="user-2" service=pptp password="******" profile=pptp-in

Securing your router

Set up packet filtering
All packets with destination to the router are processed against the ip firewall filter's input chain. Note, that the input chain does not affect packets which are being transferred through the router!

You can add following rules to the input chain under /ip firewall filter (just 'copy and paste' to the router using Terminal Console or configure the relevant arguments in WinBox):

/ ip firewall filter
add chain=input connection-state=established comment="Accept established connections"
add chain=input connection-state=related comment="Accept related connections"
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
add chain=input protocol=udp action=accept comment="UDP" disabled=no
add chain=input protocol=icmp limit=50/5s,2 comment="Allow limited pings"
add chain=input protocol=icmp action=drop comment="Drop excess pings"
add chain=input protocol=tcp dst-port=22 comment="SSH for secure shell"
add chain=input protocol=tcp dst-port=8291 comment="winbox"
# Edit these rules to reflect your actual IP addresses! #
add chain=input src-address=159.148.172.192/28 comment="From Mikrotikls network"
add chain=input src-address=10.0.0.0/8 comment="From our private LAN"
# End of Edit #
add chain=input action=log log-prefix="DROP INPUT" comment="Log everything else"
add chain=input action=drop comment="Drop everything else"

Use /ip firewall filter print input stats command to see how many packets have been processed against these rules. Use reset-counters-all command to reset the counters. Examine the system log file /log print to see the packets which have been dropped.

You may need to include additional rules to allow access from certain hosts, etc. Remember that firewall rules are processed in the order they appear on the list! After a rule matches the packet, no more rules are processed for it. After adding new rules, move them up using the move command.

Note, if you mis-configured the firewall and have locked yourselves out from the router, you may use MAC telnet from another router or workstation on the same LAN to connect to your router and correct the problem.