Establishing IPSec Tunnels in Policy Template Mode Between HUAWEI Firewalls and Cisco Firewalls

Chapter Contents

• Networking Requirements
• Data Plan
• Configuration Roadmap
• Configuration Precautions
• Configuration Procedure
• Verification
• Configuration Files

Networking Requirements

As shown in Figure1, the HUAWEI firewall serves as the gateway for connecting to the Internet at the headquarters, and the Cisco firewall as that at the branch. The outbound interface IP address of the Cisco firewall at the branch is dynamic. Therefore, the HUAWEI firewall needs to use a template to establish an IPSec tunnel with the Cisco firewall for the secure communication between the headquarters and branch.

Figure 2-3 Establishing an IPSec tunnel using a policy template

Data Plan

Configuration Roadmap

1. Configure the HUAWEI firewall:
   1. Set IP addresses for interfaces and assign the interfaces to security zones.
   2. Configure the default route from the HUAWEI firewall to the Internet.
   3. Configure an interzone security policy to allow IKE negotiation packets, original IPSec packets, and decapsulated IPSec packets to pass through the HUAWEI firewall.
   4. Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, configuring an IKE peer, and configuring an IPSec policy template.
   5. Apply the IPSec policy to an interface.
2. Configure the Cisco firewall:
   1. Set IP addresses for interfaces and enable access control on the interfaces.
   2. Configure the default route from the Cisco firewall to the Internet.
   3. Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, and configuring a pre-shared key.
   4. Apply the IPSec policy to an interface.
   5. Enable the IPSec policy on the interface.

Configuration Precautions

• If the HUAWEI firewall uses a template to establish an IPSec tunnel, you do not need to specify the peer IP address of the tunnel. Note that only the Cisco firewall can serve as the tunnel initiator.
• The outbound interface of the Cisco firewall uses the ip address dhcp setroute command to obtain dynamic IP addresses in either DHCP or non-DHCP mode. The mode in which addresses are obtained does not affect IPSec tunnel establishment.

Configuration Procedure

1. Configure the HUAWEI firewall.
   1. Set IP addresses for interfaces and assign them to security zones.

      [HUAWEI] interface GigabitEthernet 1/0/1 
      [HUAWEI-GigabitEthernet1/0/1] ip address 10.1.1.1 24 
      [HUAWEI-GigabitEthernet1/0/1] service-manage ping permit /*Allow the Cisco firewall to ping the interface. */ 
      [HUAWEI-GigabitEthernet1/0/1] quit 
      [HUAWEI] interface GigabitEthernet 1/0/2 
      [HUAWEI-GigabitEthernet1/0/2] ip address 1.1.3.1 24 
      [HUAWEI-GigabitEthernet1/0/2] service-manage ping permit /*Allow the Cisco firewall to ping the interface. */  
      [HUAWEI-GigabitEthernet1/0/2] quit 
      [HUAWEI] firewall zone trust 
      [HUAWEI-zone-trust] add interface GigabitEthernet 1/0/1 
      [HUAWEI-zone-trust] quit 
      [HUAWEI] firewall zone untrust 
      [HUAWEI-zone-untrust] add interface GigabitEthernet 1/0/2 
      [HUAWEI-zone-untrust] quit

   2. Configure a default route from the HUAWEI firewall to the Internet. In the example, the next-hop IP address is 1.1.3.2.

      [HUAWEI] ip route-static 0.0.0.0 0.0.0.0 1.1.3.2

   3. Configure interzone security policies.
      1. Configure security policies for the Trust-Untrust interzone to allow the unencapsulated and decapsulated packets to pass through the HUAWEI firewall.

         [HUAWEI] security-policy 
         [HUAWEI-policy-security] rule name 1 
         [HUAWEI-policy-security-rule-1] source-zone untrust 
         [HUAWEI-policy-security-rule-1] destination-zone trust 
         [HUAWEI-policy-security-rule-1] source-address 10.1.3.0 24 
         [HUAWEI-policy-security-rule-1] destination-address 10.1.1.0 24 
         [HUAWEI-policy-security-rule-1] action permit 
         [HUAWEI-policy-security-rule-1] quit 
         [HUAWEI-policy-security] rule name 2 
         [HUAWEI-policy-security-rule-2] source-zone trust 
         [HUAWEI-policy-security-rule-2] destination-zone untrust 
         [HUAWEI-policy-security-rule-2] source-address 10.1.1.0 24 
         [HUAWEI-policy-security-rule-2] destination-address 10.1.3.0 24 
         [HUAWEI-policy-security-rule-2] action permit 
         [HUAWEI-policy-security-rule-2] quit

      2. Configure security policies for the Local-Untrust interzone to allow IKE negotiation packets to pass through the HUAWEI firewall.

         [HUAWEI-policy-security] rule name 3 
         [HUAWEI-policy-security-rule-3] source-zone local 
         [HUAWEI-policy-security-rule-3] destination-zone untrust 
         [HUAWEI-policy-security-rule-3] source-address 1.1.3.1 32 
         [HUAWEI-policy-security-rule-3] destination-address 1.1.5.1 32 
         [HUAWEI-policy-security-rule-3] action permit 
         [HUAWEI-policy-security-rule-3] quit 
         [HUAWEI-policy-security] rule name 4 
         [HUAWEI-policy-security-rule-4] source-zone untrust 
         [HUAWEI-policy-security-rule-4] destination-zone local 
         [HUAWEI-policy-security-rule-4] source-address 1.1.5.1 32 
         [HUAWEI-policy-security-rule-4] destination-address 1.1.3.1 32 
         [HUAWEI-policy-security-rule-4] action permit 
         [HUAWEI-policy-security-rule-4] quit

   4. Configure an IPSec policy.
      1. Configure an ACL to define the data flow to be protected.

         [HUAWEI] acl 3000 
         [HUAWEI-acl-adv-3000] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 
         [HUAWEI-acl-adv-3000] quit

      2. Configure an IPSec proposal.

         [HUAWEI] ipsec proposal tran1 
         [HUAWEI-ipsec-proposal-tran1] transform esp 
         [HUAWEI-ipsec-proposal-tran1] encapsulation-mode tunnel 
         [HUAWEI-ipsec-proposal-tran1] esp authentication-algorithm sha1 
         [HUAWEI-ipsec-proposal-tran1] esp encryption-algorithm aes-128 
         [HUAWEI-ipsec-proposal-tran1] quit

      3. Create an IKE proposal.

         [HUAWEI] ike proposal 1 
         [HUAWEI-ike-proposal-1] encryption-algorithm aes-128 
         [HUAWEI-ike-proposal-1] authentication-algorithm sha1 
         [HUAWEI-ike-proposal-1] dh group2 
         [HUAWEI-ike-proposal-1] quit

      4. Configure an IKE peer.

         [HUAWEI] ike peer cisco 
         [HUAWEI-ike-peer-cisco] undo version 2 
         [HUAWEI-ike-peer-cisco] exchange-mode main 
         [HUAWEI-ike-peer-cisco] ike-proposal 1 
         [HUAWEI-ike-peer-cisco] pre-shared-key Key123 
         [HUAWEI-ike-peer-cisco] quit

      5. Configure IPSec policy template temp.

         [HUAWEI] ipsec policy-template temp 1 
         [HUAWEI-ipsec-policy-template-temp-1] security acl 3000 
         [HUAWEI-ipsec-policy-template-temp-1] proposal tran1 
         [HUAWEI-ipsec-policy-template-temp-1] ike-peer cisco 
         [HUAWEI-ipsec-policy-template-temp-1] quit

      6. Configure an IPSec policy.

         [HUAWEI] ipsec policy map1 1 isakmp template temp

      7. Apply the IPSec policy to interface GigabitEthernet 1/0/2.

         [HUAWEI] interface GigabitEthernet 1/0/2 
         [HUAWEI-GigabitEthernet1/0/2] ipsec policy map1 
         [HUAWEI-GigabitEthernet1/0/2] quit

2. Configure the Cisco firewall.
   1. Configure the IP address of the Cisco firewall interface.

      ASA5520> en 
      ASA5520# configure terminal 
      ASA5520(config)# interface GigabitEthernet 0/1 
      ASA5520(config-if)# nameif in 
      ASA5520(config-if)# security-level 90 
      ASA5520(config-if)# ip address 10.1.3.1 255.255.255.0 
      ASA5520(config-if)# exit 
      ASA5520(config)# interface interface GigabitEthernet 0/2 
      ASA5520(config-if)# nameif out 
      ASA5520(config-if)# security-level 10 
      ASA5520(config-if)# ip address dhcp setroute 
      ASA5520(config-if)# exit

   2. Enable access control for the Cisco firewall interface.

      ASA5520(config)# access-list 10 extended permit icmp any any 
      ASA5520(config)# access-group 10 in interface in 
      ASA5520(config)# access-group 10 out interface in 
      ASA5520(config)# access-group 10 in interface out 
      ASA5520(config)# access-group 10 out interface out

   3. Configure a default route from the Cisco firewall to the Internet. In the example, the next-hop IP address is 1.1.5.2.

      ASA5520(config)# route out 0.0.0.0 0.0.0.0 1.1.5.2 1

   4. Configure IPSec.
      1. Configure an ACL to define the data flow to be protected.

         ASA5520(config)# access-list ipsec permit ip 10.1.3.0 255.255.255.0 10.1.1.0 255.255.255.0

      2. Configure an IPSec proposal.

         ASA5520(config)# crypto ipsec transform-set myset esp-aes esp-sha-hmac

      3. Create an IKE proposal.

         ASA5520(config-isakmp-policy)# crypto isakmp policy 10 
         ASA5520(config-isakmp-policy)# authentication pre-share 
         ASA5520(config-isakmp-policy)# encryption aes 
         ASA5520(config-isakmp-policy)# hash sha 
         ASA5520(config-isakmp-policy)# group 2 
         ASA5520(config-isakmp-policy)# lifetime 86400

      4. Configure a pre-shared key.

         ASA5520(config)# crypto isakmp key Key123 address 1.1.3.1

      5. Configure an IPSec policy.

         Reference the configured ACL and IPSec proposal in the IPSec policy.

         ASA5520(config)# crypto map ipsec_map 10 match address ipsec 
         ASA5520(config)# crypto map ipsec_map 10 set peer 1.1.3.1 
         ASA5520(config)# crypto map ipsec_map 10 set transform-set myset

      6. Apply the IPSec policy to the interface.

         ASA5520(config)# crypto map ipsec_map interface out

      7. Enable the IPSec policy on the interface.

         ASA5520(config)# crypto isakmp enable out

Verification

1. Ping a user on the headquarters network from the branch network.
2. In normal cases, the data flows from the branch to the headquarters trigger the gateways to establish an IPSec tunnel. On the HUAWEI firewall, check whether an IKE SA is established. If the following information is displayed, an IKE SA has been established.

   <HUAWEI> display ike sa                                                                                                                         
   current ike sa number: 2                     
   -------------------------------------------------------------------------------- 
   ------------------                     
   conn-id peer                                    flag          phase vpn       
   -------------------------------------------------------------------------------- 
   ------------------               
   179        1.1.5.1                                 RD|ST|A       v1:2  public 
   178        1.1.5.1                                 RD|ST|D|A     v1:1  public    
    
    
     flag meaning                                
     RD--READY      ST--STAYALIVE     RL--REPLACED FD--FADING TO--TIMEOUT     
     TD--DELETING NEG--NEGOTIATING  D--DPD          M--ACTIVE     S--STANDBY      
     A--ALONE                                                                        

3. Run the display ipsec sa command to check whether an IPSec SA is established. If the following information is displayed, an IPSec SA is established.

   <HUAWEI> display ipsec sa                                                             
   =============================== 
   Interface: GigabitEthernet1/0/2 
    path MTU: 1500              
   =============================== 
                                   
     ----------------------------- 
     IPSec policy name: "map1"     
     sequence number: 1            
     mode: template                
     vpn: public                   
     ----------------------------- 
    connection id: 46           
    rule number: 4294967295     
     encapsulation mode: tunnel  
    holding time: 0d 0h 0m 39s  
    tunnel local : 1.1.3.1 tunnel remote: 1.1.5.1 
    flow      source: 10.1.1.0/255.255.255.0 0/0     
    flow destination: 10.1.3.0/255.255.255.0 0/0     
                                 
    [inbound ESP SAs]           
         spi: 238449139 (0xe3671f3)                     
         vpn: public  said: 0  cpuid: 0x0000            
         proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA1        
         sa remaining key duration (kilobytes/sec): 4608000/3561 
         max received sequence-number: 3                
         udp encapsulation used for nat traversal: N 
                                   
    [outbound ESP SAs]          
         spi: 1163306489 (0x4556a5f9)                   
         vpn: public  said: 1  cpuid: 0x0000            
         proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA1        
         sa remaining key duration (kilobytes/sec): 4608000/3561 
         max sent sequence-number: 4                    
         udp encapsulation used for nat traversal: N     

Configuration Files

#
 sysname HUAWEI 
#
interface GigabitEthernet 1/0/1 
 undo shutdown
 ip address 10.1.1.1 24 
 service-manage ping permit
#
interface GigabitEthernet 1/0/2 
 undo shutdown
 ip address 1.1.3.1 24 
 service-manage ping permit
 ipsec policy map1 
#
firewall zone trust 
 add interface GigabitEthernet 1/0/1 
#
firewall zone untrust 
 add interface GigabitEthernet 1/0/2 
#
ip route-static 0.0.0.0 0.0.0.0 1.1.3.2
#
security-policy 
 rule name 1 
  source-zone untrust 
  destination-zone trust 
  source-address 10.1.3.0 24 
  destination-address 10.1.1.0 24 
  action permit 
 rule name 2 
  source-zone trust 
  destination-zone untrust 
  source-address 10.1.1.0 24 
  destination-address 10.1.3.0 24 
  action permit 
 rule name 3 
  source-zone local 
  destination-zone untrust 
  source-address 1.1.3.1 32 
  destination-address 1.1.5.1 32 
  action permit 
 rule name 4 
  source-zone untrust 
  destination-zone local 
  source-address 1.1.5.1 32 
  destination-address 1.1.3.1 32 
  action permit 
#
acl 3000 
 rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 
#
ipsec proposal tran1 
 transform esp 
 encapsulation-mode tunnel 
 esp authentication-algorithm sha1 
 esp encryption-algorithm aes-128 
#
ike proposal 1 
 encryption-algorithm aes-128 
 authentication-algorithm sha1 
 dh group2 
#
ike peer cisco 
 undo version 2 
 exchange-mode main 
 ike-proposal 1 
 pre-shared-key Key123 
#
ipsec policy-template temp 1 
 security acl 3000 
 proposal tran1 
 ike-peer cisco 
#
ipsec policy map1 1 isakmp template temp
# 
return