Monday, March 31, 2014

Juniper BGP Over IPSec Multipoint

In my lab, I wanted to utilize a dynamic routing protocol for my hub and spoke VPN topology. I decided to try it with BGP. The requirements were to utilize only one tunnel interface on the hub device for all IPSec tunnels, as well as deny all traffic between spoke sites. Below is the configuration, and it is based on the topology below:



SRX 1 (Hub Device):

Interface configuration (please note that the tunnel interface is configured as multipoint, which allows for the termination of multiple IPSec tunnels to a single logical interface.):
interfaces {
    ge-0/0/0 {
        unit 0 {
            description "*** TRUST ***";
            family inet {
                address 10.1.1.1/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            description "*** UNTRUST ***";
            family inet {
                address 172.16.1.1/30;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 1.1.1.1/32;
            }
        }
    }
    st0 {
        unit 0 {
            description "*** VPN ***";
            multipoint;
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}

Default route configuration:
routing-options {
    static {
        route 0.0.0.0/0 next-hop 172.16.1.2;
    }
    router-id 1.1.1.1;
    autonomous-system 65001;
}

BGP configuration:
protocols {
    bgp {
        group 1 {
            type external;
            neighbor 192.168.1.3 {
                hold-time 30;
                export 1;
                peer-as 65003;
                local-as 65001;
            }
            neighbor 192.168.1.4 {
                hold-time 30;
                export 1;
                peer-as 65004;
                local-as 65001;
            }
        }
    }
}

 Routing policy configuration:
policy-options {
    policy-statement 1 {
        term 1 {
            from {
                route-filter 10.1.1.0/24 exact;
            }
            then accept;
        }
        term 2 {
            from {
                route-filter 192.168.1.0/24 exact;
            }
            then accept;
        }
        term 3 {
            then reject;
        }
    }

}

VPN configuration:
security {
    ike {
        policy 1-3 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$rV4KWXVwgUjq7-jqmfn6revW7-"; ## SECRET-DATA
        }
        policy 1-4 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$ZCDH.QF/0BEP5BEcyW8ZUjHP5"; ## SECRET-DATA
        }
        gateway 3 {
            ike-policy 1-3;
            address 172.16.3.1;
            external-interface ge-0/0/1.0;
        }
        gateway 4 {
            ike-policy 1-4;
            address 172.16.4.1;
            external-interface ge-0/0/1.0;
        }
    }
    ipsec {
        policy 1-3 {
            proposal-set standard;
        }
        policy 1-4 {
            proposal-set standard;
        }
        vpn 1-3 {
            bind-interface st0.0;
            ike {
                gateway 3;
                ipsec-policy 1-3;
            }
            establish-tunnels immediately;
        }
        vpn 1-4 {
            bind-interface st0.0;
            ike {
                gateway 4;
                ipsec-policy 1-4;
            }
            establish-tunnels immediately;
        }
    }
}

Security zone configuration (please note that for my lab testing, I am allowing almost everything. In a production environment it is required to enable the necessary services and protocols at the zone level in order for things to function properly (i.e. BGP, IKE, etc.)):
zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                lo0.0;
                ge-0/0/0.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0;
            }
        }
    }
}

Security policy configuration (please note that there is a policy which denies traffic from spoke to spoke):
    policies {
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy default-deny {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone vpn to-zone vpn {
            policy deny-intra-spoke-traffic {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

SRX 3 (Spoke Device):

Interface configuration:
interfaces {
    ge-0/0/0 {
        unit 0 {
            description "*** TRUST ***";
            family inet {
                address 10.3.3.1/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            description "*** UNTRUST ***";
            family inet {
                address 172.16.3.1/30;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 3.3.3.3/32;
            }
        }
    }
    st0 {
        unit 0 {
            description "*** VPN ***";
            family inet {
                address 192.168.1.3/24;
            }
        }
    }
}

Default route configuration:
routing-options {
    static {
        route 0.0.0.0/0 next-hop 172.16.3.2;
    }
    router-id 3.3.3.3;
    autonomous-system 65003;
}

BGP configuration:
protocols {
    bgp {
        group 1 {
            type external;
            neighbor 192.168.1.1 {
                hold-time 30;
                export 1;
                peer-as 65001;
                local-as 65003;
            }
        }
    }
}

 Routing policy configuration:
policy-options {
    policy-statement 1 {
        term 1 {
            from {
                route-filter 10.3.3.0/24 exact;
            }
            then accept;
        }
        term 2 {
            from {
                route-filter 192.168.1.0/24 exact;
            }
            then accept;
        }
        term 3 {
            then reject;
        }
    }

}

VPN configuration:
security {
    ike {
        policy 3-1 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$QATV3/ABIcvWxp0WxNdg4QFn/p0"; ## SECRET-DATA
        }
        gateway 3-1 {
            ike-policy 3-1;
            address 172.16.1.1;
            external-interface ge-0/0/1.0;
        }
    }
    ipsec {
        policy 3-1 {
            proposal-set standard;
        }
        vpn 3-1 {
            bind-interface st0.0;
            ike {
                gateway 3-1;
                ipsec-policy 3-1;
            }
            establish-tunnels immediately;
        }
    }
}

Security zone configuration:
zones {
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                lo0.0;
                ge-0/0/0.0;
            }
        }
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0;
            }
        }
    }
}

Security policy configuration:
policies {
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy default-deny {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

SRX 4 (Spoke Device):

Interface configuration:
interfaces {
    ge-0/0/0 {
        unit 0 {
            description "*** TRUST ***";
            family inet {
                address 10.4.4.1/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            description "*** UNTRUST ***";
            family inet {
                address 172.16.4.1/30;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 4.4.4.4/32;
            }
        }
    }
    st0 {
        unit 0 {
            description "*** VPN ***";
            family inet {
                address 192.168.1.4/24;
            }
        }
    }
}

Default route configuration:
routing-options {
    static {
        route 0.0.0.0/0 next-hop 172.16.4.2;
    }
    router-id 4.4.4.4;
    autonomous-system 65004;
}

BGP configuration:
protocols {
    bgp {
        group 1 {
            type external;
            neighbor 192.168.1.1 {
                hold-time 30;
                export 1;
                peer-as 65001;
                local-as 65004;
            }
        }
    }
}

 Routing policy configuration:
policy-options {
    policy-statement 1 {
        term 1 {
            from {
                route-filter 10.4.4.0/24 exact;
            }
            then accept;
        }
        term 2 {
            from {
                route-filter 192.168.1.0/24 exact;
            }
            then accept;
        }
        term 3 {
            then reject;
        }
    }

}

VPN configuration:
security {
    ike {
        policy 4-1 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$QATV3/ABIcvWxp0WxNdg4QFn/p0"; ## SECRET-DATA
        }
        gateway 4-1 {
            ike-policy 4-1;
            address 172.16.1.1;
            external-interface ge-0/0/1.0;
        }
    }
    ipsec {
        policy 4-1 {
            proposal-set standard;
        }
        vpn 4-1 {
            bind-interface st0.0;
            ike {
                gateway 4-1;
                ipsec-policy 4-1;
            }
            establish-tunnels immediately;
        }
    }
}

Security zone configuration:
zones {
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                lo0.0;
                ge-0/0/0.0;
            }
        }
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0;
            }
        }
    }
}

Security policy configuration:
policies {
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy default-deny {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

Verification:

Here are some commands that can be run from operational mode for verification purposes:
show security ike security-associations
show security ipsec security-associations
show bgp neighbor
show bgp summary
show route

Posted by at No comments:
Labels: , , , , , , , , , ,

Tuesday, March 4, 2014

MAG-CM060 SSO with a Self-Signed Certificate

I am posting this because although Juniper Networks does provide very detailed instructions on how to configure SSO with a valid certificate issued from a certificate authority, a customer recently wanted me to configure SSO without a valid certificate. Here is how I did it:

  1. From operational mode in the MAG-CM060, enter the following commands:
    1. request security pki generate-key-pair certificate-id MY-CERT size 1024 type rsa
    2. request security pki local-certificate generate-self-signed certificate-id MY-CERT domain-name domain.com email test@domain.com ip-address 10.1.1.10 subject CN=10.1.1.10,O=Test
  2. From configuration mode in the MAG-CM060, enter the following commands:
    1. set system services ftp
    2. set system services web-management http port 80 interface em0.0
    3. set system services web-management https port 443 interface em0.0 pki-local-certificate MY-CERT
    4. commit
  3. Using your favorite FTP program, connect to the MAG-CM060 and copy the certificate you created, which is located in /var/db/certs/common/local/MY-CERT.cert, to the location of your choice on your computer.
  4. From within the administrator GUI of the MAG Service Module (i.e. MAG-SM60), perform the following steps:
    1. Navigate to Authentication->Auth. Servers->Chassis Auth Server
    2. Select Choose File under Upload Certificate, and upload the certificate you copied off of the MAG-CM060.
    3. Click Save
  5. Lastly, ensure that the date/time settings are the same on both the MAG-CM060 and the Service Module:
    1. From operational mode on the MAG-CM060, enter the following command:
      1. set date...
    2. From the Dashboard in the GUI of the Service Module:
      1. Click Edit next to System Date & Time
Enjoy!
Posted by at No comments:
Labels: , , , , , , , ,

Tuesday, January 7, 2014

Juniper OSPF Over IPSec Multipoint

In my lab, I wanted to utilize a dynamic routing protocol for my hub and spoke VPN topology. I decided to first try it with OSPF (BGP configuration here). The requirements were to utilize only one tunnel interface on the hub device for all IPSec tunnels, as well as deny all traffic between spoke sites. Below is the configuration, and it is based on the topology below:



SRX 1 (Hub Device):

Interface configuration (please note that the tunnel interface is configured as multipoint, which allows for the termination of multiple IPSec tunnels to a single logical interface.):
interfaces {
    ge-0/0/0 {
        unit 0 {
            description "*** TRUST ***";
            family inet {
                address 10.1.1.1/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            description "*** UNTRUST ***";
            family inet {
                address 172.16.1.1/30;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 1.1.1.1/32;
            }
        }
    }
    st0 {
        unit 0 {
            description "*** VPN ***";
            multipoint;
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}

Default route configuration:
routing-options {
    static {
        route 0.0.0.0/0 next-hop 172.16.1.2;
    }
}

OSPF configuration:
protocols {
    ospf {
        area 0.0.0.0 {
            interface ge-0/0/0.0;
            interface lo0.0 {
                passive;
            }
            interface st0.0;
        }
    }
}

VPN configuration:
security {
    ike {
        policy 1-3 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$rV4KWXVwgUjq7-jqmfn6revW7-"; ## SECRET-DATA
        }
        policy 1-4 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$ZCDH.QF/0BEP5BEcyW8ZUjHP5"; ## SECRET-DATA
        }
        gateway 3 {
            ike-policy 1-3;
            address 172.16.3.1;
            external-interface ge-0/0/1.0;
        }
        gateway 4 {
            ike-policy 1-4;
            address 172.16.4.1;
            external-interface ge-0/0/1.0;
        }
    }
    ipsec {
        policy 1-3 {
            proposal-set standard;
        }
        policy 1-4 {
            proposal-set standard;
        }
        vpn 1-3 {
            bind-interface st0.0;
            ike {
                gateway 3;
                ipsec-policy 1-3;
            }
            establish-tunnels immediately;
        }
        vpn 1-4 {
            bind-interface st0.0;
            ike {
                gateway 4;
                ipsec-policy 1-4;
            }
            establish-tunnels immediately;
        }
    }
}

Security zone configuration (please note that for my lab testing, I am allowing almost everything. In a production environment it is required to enable the necessary services and protocols at the zone level in order for things to function properly (i.e. OSPF, IKE, etc.)):
zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                lo0.0;
                ge-0/0/0.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0;
            }
        }
    }
}

Security policy configuration (please note that there is a policy which denies traffic from spoke to spoke):
    policies {
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy default-deny {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone vpn to-zone vpn {
            policy deny-intra-spoke-traffic {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

SRX 3 (Spoke Device):

Interface configuration:
interfaces {
    ge-0/0/0 {
        unit 0 {
            description "*** TRUST ***";
            family inet {
                address 10.3.3.1/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            description "*** UNTRUST ***";
            family inet {
                address 172.16.3.1/30;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 3.3.3.3/32;
            }
        }
    }
    st0 {
        unit 0 {
            description "*** VPN ***";
            family inet {
                address 192.168.1.3/24;
            }
        }
    }
}

Default route configuration:
routing-options {
    static {
        route 0.0.0.0/0 next-hop 172.16.3.2;
    }
}

OSPF configuration:
protocols {
    ospf {
        area 0.0.0.0 {
            interface st0.0;
            interface ge-0/0/0.0;
            interface lo0.0 {
                passive;
            }
        }
    }
}

VPN configuration:
security {
    ike {
        policy 3-1 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$QATV3/ABIcvWxp0WxNdg4QFn/p0"; ## SECRET-DATA
        }
        gateway 3-1 {
            ike-policy 3-1;
            address 172.16.1.1;
            external-interface ge-0/0/1.0;
        }
    }
    ipsec {
        policy 3-1 {
            proposal-set standard;
        }
        vpn 3-1 {
            bind-interface st0.0;
            ike {
                gateway 3-1;
                ipsec-policy 3-1;
            }
            establish-tunnels immediately;
        }
    }
}

Security zone configuration:
zones {
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                lo0.0;
                ge-0/0/0.0;
            }
        }
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0;
            }
        }
    }
}

Security policy configuration:
policies {
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy default-deny {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

SRX 4 (Spoke Device):

Interface configuration:
interfaces {
    ge-0/0/0 {
        unit 0 {
            description "*** TRUST ***";
            family inet {
                address 10.4.4.1/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            description "*** UNTRUST ***";
            family inet {
                address 172.16.4.1/30;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 4.4.4.4/32;
            }
        }
    }
    st0 {
        unit 0 {
            description "*** VPN ***";
            family inet {
                address 192.168.1.4/24;
            }
        }
    }
}

Default route configuration:
routing-options {
    static {
        route 0.0.0.0/0 next-hop 172.16.4.2;
    }
}

OSPF configuration:
protocols {
    ospf {
        area 0.0.0.0 {
            interface st0.0;
            interface ge-0/0/0.0;
            interface lo0.0 {
                passive;
            }
        }
    }
}

VPN configuration:
security {
    ike {
        policy 4-1 {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$QATV3/ABIcvWxp0WxNdg4QFn/p0"; ## SECRET-DATA
        }
        gateway 4-1 {
            ike-policy 4-1;
            address 172.16.1.1;
            external-interface ge-0/0/1.0;
        }
    }
    ipsec {
        policy 4-1 {
            proposal-set standard;
        }
        vpn 4-1 {
            bind-interface st0.0;
            ike {
                gateway 4-1;
                ipsec-policy 4-1;
            }
            establish-tunnels immediately;
        }
    }
}

Security zone configuration:
zones {
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                lo0.0;
                ge-0/0/0.0;
            }
        }
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0;
            }
        }
    }
}

Security policy configuration:
policies {
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy default-deny {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone vpn to-zone vpn {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

 Verification:

 Here are some commands that can be run from operational mode for verification purposes:
show security ike security-associations
show security ipsec security-associations
show ospf neighbor
show ospf route

Posted by at 2 comments:
Labels: , , , , , , , , , ,

Monday, October 14, 2013

SonicWALL - Forward Packets to Remote VPNs

Older versions of the SonicWALL operating system used to include a feature called, "Forward packets to remote VPNs." This feature, when enabled in a hub and spoke VPN topology, allowed for spoke sites to communicate with each other via a hub site. This is advantageous for a few reasons:
  1. SonicWALL does not support Group VPN (GDOI) or other mesh VPN technologies, leaving manual configuration as the only option.
  2. Configuring site to site VPNs for each and every site in your organization is time consuming, and depending on your SonicWALL model you may be limited by the number of IPSec tunnels allowed on your device (i.e. The TZ-105 only allows 5 IPSec tunnels).
I recently ran into this very situation. I was deploying a phone system at multiple sites for a customer, which required LAN-like communication between all sites. Rather than building tunnels at each site to every other site, I remembered the 'Forward packets to remote VPNs," feature. It would be great because it would save me time, as all traffic would just route through the hub site. However, in newer versions of the software this option is no longer present, so I had to do some research on how to make it work. I thought I would share what I did, since there is really no information out there (none that I could find anyway...) that walks you through the process.

For simplicity's sake, let's assume that we have 3 sites:
  • Los Angeles - This is our main office (AKA the hub site). The LAN subnet for this site is 10.0.0.0/24.
  • Austin - This is a branch office (AKA our first spoke site). The LAN subnet for this site is 192.168.0.0/24.
  • Atlanta - This is a branch office (AKA our second spoke site). The LAN subnet for this site is 172.16.0.0/24.
Here are the general configuration steps:
  1. On Los Angeles (the hub site):
    1. Define address objects for each site under Network -> Address Objects:
      1. Los Angeles:
        1. Name: Los Angeles LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 10.0.0.0
        5. Netmask: 255.255.255.0
      2. Austin:
        1. Name: Austin LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 192.168.0.0
        5. Netmask: 255.255.255.0
      3. Atlanta:
        1. Name: Atlanta LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 172.16.0.0
        5. Netmask: 255.255.255.0
    2. Create an address group for each site under Network -> Address Objects:
      1. Create a group called Austin:
        1. Add Atlanta LAN
        2. Add Los Angeles LAN
          1. Note that we are calling this group "Austin" even though we are not adding Austin LAN to the group. This group will be referenced in a VPN policy that will allow both the Los Angeles LAN and Atlanta LAN subnets to communicate with Austin. More information to follow...
      2. Create a group called Atlanta:
        1. Add Austin LAN
        2. Add Los Angeles LAN
          1. Same thing applicable here as above. We are calling the group Atlanta because it will be applied to the Atlanta VPN, but these address objects we are referencing do not include the Atlanta LAN address object.
    3. Create VPNs to each remote site under VPN -> Settings:
      1. Create a VPN called Austin:
        1. Under the General tab:
          1. Policy Type: Site to Site
          2. Authentication Method: IKE using Preshared Secret
          3. Name: Austin
          4. IPSec Primary Gateway Name or Address: (public IP of Austin site)
          5. Shared Secret: (enter whatever password you want here, just remember that it has to match on both ends)
        2. Under the Network tab:
          1. Local Networks: (choose Austin from the list)
          2. Remote Networks: (choose Ausitn LAN from the list)
        3. Under the Proposals tab:
          1. This varies, but I usually choose IKEv2 mode, and AES-256 for encryption at the very least.
        4. Under the Advanced tab:
          1. Check the Enable Keep Alive check box
      2. Create a VPN called Atlanta:
        1. Under the General tab:
          1. Policy Type: Site to Site
          2. Authentication Method: IKE using Preshared Secret
          3. Name: Atlanta
          4. IPSec Primary Gateway Name or Address: (public IP of Atlanta site)
          5. Shared Secret: (enter whatever password you want here, just remember that it has to match on both ends)
        2. Under the Network tab:
          1. Local Networks: (choose Atlanta from the list)
          2. Remote Networks: (choose Atlanta LAN from the list)
        3. Under the Proposals tab:
          1. This varies, but I usually choose IKEv2 mode, and AES-256 for encryption at the very least.
        4. Under the Advanced tab:
          1. Check the Enable Keep Alive check box
  2. On Austin (the spoke site):
    1. Define address objects for each site under Network -> Address Objects:
      1. Los Angeles:
        1. Name: Los Angeles LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 10.0.0.0
        5. Netmask: 255.255.255.0
      2. Austin:
        1. Name: Austin LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 192.168.0.0
        5. Netmask: 255.255.255.0
      3. Atlanta:
        1. Name: Atlanta LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 172.16.0.0
        5. Netmask: 255.255.255.0
    2. Create an address group for the other sites under Network -> Address Objects:
      1. Create a group called Other Sites:
        1. Add Atlanta LAN
        2. Add Los Angeles LAN
    3. Create a VPN to the Los Angeles site under VPN -> Settings:
      1. Under the General tab:
        1. Policy Type: Site to Site
        2. Authentication Method: IKE using Preshared Secret
        3. Name: Los Angeles
        4. IPSec Primary Gateway Name or Address: (public IP of Los Angeles site)
        5. Shared Secret: (enter the same password you entered when you created the Austin VPN on the Los Angeles SonicWALL)
      2. Under the Network tab:
        1. Local Networks: (choose Austin LAN from the list)
        2. Remote Networks: (choose Other Sites from the list)
      3. Under the Proposals tab:
        1. Enter the same information you entered on the Los Angeles SonicWALL
      4. Under the Advanced tab:
        1. Leave everything as is
  3. On Atlanta (the other spoke site):
    1. Define address objects for each site under Network -> Address Objects:
      1. Los Angeles:
        1. Name: Los Angeles LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 10.0.0.0
        5. Netmask: 255.255.255.0
      2. Austin:
        1. Name: Austin LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 192.168.0.0
        5. Netmask: 255.255.255.0
      3. Atlanta:
        1. Name: Atlanta LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 172.16.0.0
        5. Netmask: 255.255.255.0
    2. Create an address group for the other sites under Network -> Address Objects:
      1. Create a group called Other Sites:
        1. Add Austin LAN
        2. Add Los Angeles LAN
    3. Create a VPN to the Los Angeles site under VPN -> Settings:
      1. Under the General tab:
        1. Policy Type: Site to Site
        2. Authentication Method: IKE using Preshared Secret
        3. Name: Los Angeles
        4. IPSec Primary Gateway Name or Address: (public IP of Los Angeles site)
        5. Shared Secret: (enter the same password you entered when you created the Atlanta VPN on the Los Angeles SonicWALL)
      2. Under the Network tab:
        1. Local Networks: (choose Atlanta LAN from the list)
        2. Remote Networks: (choose Other Sites from the list)
      3. Under the Proposals tab:
        1. Enter the same information you entered on the Los Angeles SonicWALL
      4. Under the Advanced tab:
        1. Leave everything as is
Upon completion, you will see a green light on the VPN -> Settings page, which indicates that the VPN is up. On the remote sites, you will see 2 green lights, indicating connectivity to both the hub and spoke sites.
Posted by at 9 comments:
Labels: , , , , , , , , ,

Wednesday, August 14, 2013

Asterisk, Google Voice, and Amazon EC2

I've been running Asterisk on my DD-WRT router for some time now. However, Juniper was awesome enough to give me a WLA and a virtual controller when I was invited to their tech summit this year, so I've decided to change things up with my home setup (for like the 80th time haha). I've been thinking of different ways to setup a home phone for free, utilizing Asterisk and Google Voice. One way would be by repurposing an Android Mini PC as shown to me by a buddy I do business with, but since I'm a cheap bastard and this is really more just for fun than anything else, I decided to look into setting up a micro instance in Amazon Web Services. One advantage to this is the fact that if you have a new account you can have a micro instance for a year for free. Anyway, I found a forum post here that does a great job of taking you through the process. I am going to copy the process here so that in the event that something happens to that site there will be a copy. I also made a few edits as there were a few steps missing from the original tutorial.

This guide assumes that you've already setup your AWS account and figured out how to set the security group. You will need to open some ports (TCP: 22, 1723, 5060. UDP: 5060, 10000-20000). On a side note, I understand that opening up these ports is a security risk, so you may want to look at using an AWS VPC or some other form of security to lock things down a little better. In my case, I don't really care about security since I'm using a throw away email and my endpoint is on a completely separate network.

Step 1. Goto: http://uec-images.ubuntu.com/releases/10.04/release/ and pick the t1.micro instance (ebs 64 bit) for the region that you setup in AWS. Launch this instance (there is a button) and get it working with the security group that you configured. After it's launched you need to setup an Elastic IP and associate it with the instance. After that go ahead and log into your new micro instance server. Once you get to this point, then you can continue with the guide. There are TONS of resources (including youtube videos) on how to get to this point. It's not rocket science.

Step 2. Setup firewall settings for asterisk. Lucid also has firewall settings that need to be adjusted.

#Uncomplicated Firewall
sudo ufw enable
sudo ufw allow 22/tcp
sudo ufw allow 1723/tcp
sudo ufw allow 5060/tcp
sudo ufw allow 5060/udp
sudo ufw allow 10000:20000/udp

#check status
sudo ufw status

#edit /etc/default/ufw and enable forward policy
DEFAULT_FORWARD_POLICY="ACCEPT"

#edit /etc/ufw/sysctl.conf and uncomment
net/ipv4/ip_forward=1

#edit /etc/ufw/before.rules and add this after the header comments

---<BEGIN>--- (DON'T COPY THIS LINE)
# nat Table rules
*nat
:POSTROUTING ACCEPT [0:0]

 # Forward traffic through eth0.
-A POSTROUTING -o eth0 -j MASQUERADE

 # don't delete the 'COMMIT' line or these nat table rules won't be processed
COMMIT
---<END>--- (DON'T COPY THIS LINE)

#disable and enable to apply changes
sudo ufw disable && sudo ufw enable

Step 3. Recompile Kernel. The default kernel is set at 100HZ timing, this will give you HORRIBLE VOIP quality. The kernel needs to be recompiled to 1000HZ timing.

# Make yourself root
sudo su

# Update source list:
aptitude update

# Upgrade everything:
aptitude upgrade 

# Install dependencies:
apt-get build-dep linux-image-$(uname -r)
apt-get build-dep linux
apt-get install fakeroot build-essential
apt-get install crash kexec-tools makedumpfile kernel-wedge
apt-get install libncurses5 libncurses5-dev
apt-get install libelf-dev asciidoc binutils-dev kernel-package
apt-get install git-core

cd /usr/src
git clone git://kernel.ubuntu.com/ubuntu/ubuntu-lucid.git 
cd ubuntu*
git checkout --track -b ec2 origin/ec2
fakeroot debian/rules clean
fakeroot debian/rules editconfigs

# Configuration window should now appear, do the following:

Select YES

# Navigate to:
Processor type and features -> Timer frequency
# Select the 1000HZ frequency
Exit
Exit
Yes (Save)

#After saving and returning to prompt it may ask you to do it again for i386, select yes and repeat!

Step 4. This next command will take about 7 hours to recompile the kernel. But, there is a shortcut. Amazon charges by the minute for each instance type that you use. I recommend shutting down your instance at this point and changing it to a m1 extra large instance type (this will cost you about 70 cents). This will increase your micro instance from:

613 MiB memory
Up to 2 EC2 Compute Units (for short periodic bursts)
EBS storage only
32-bit or 64-bit platform
I/O Performance: Low
EBS-Optimized Available: No
API name: t1.micro

to:

15 GiB memory
8 EC2 Compute Units (4 virtual cores with 2 EC2 Compute Units each)
1,690 GB instance storage
64-bit platform
I/O Performance: High
EBS-Optimized Available: 1000 Mbps
API name: m1.xlarge

The compiling time will be reduced to about 25 minutes. Once you got the instance backup with the m1.xlarge instance, continue like so:

sudo su
cd /usr/src/ubuntu*
fakeroot debian/rules binary

#Check if your deb files were created
cd ..
ls *.deb

#install new kernel
#IF A GRUB MENU POPS UP PICK PACKAGE VERSION
sudo dpkg -i linux-*.deb

Then shutdown your system again and change it back to a micro instance. Then boot it back up.

#Check your new Kernel version
uname -r

#Check if Kernel HZ value change persisted:
cat /boot/config-`uname -r` | grep HZ

#If value 1000HZ=yes then you did it right!

Step 4a. Add missing dependencies. I ran into an issue with RTP not working following the guide provided, so I had to run the following command, which adds res_rtp_asterisk to the list of supported modules that you need to ensure is checked when you get to the Asterisk menu below.

apt-get install uuid-dev

Step 5. Install Asterisk 11

#get source. note: dahdi needs to be installed to compile and install libpri -- we don't really need it for any other reason

cd /usr/src/
wget http://downloads.asterisk.org/pub/telephony/dahdi-linux-complete/dahdi-linux-complete-current.tar.gz
wget http://downloads.asterisk.org/pub/telephony/libpri/libpri-1.4-current.tar.gz
wget http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-11-current.tar.gz

#extract source

tar zxvf dahdi-*
tar zxvf libpri-*
tar zxvf asterisk-11*

#resolve error for compiling dahdi

ln -nsf /usr/src/linux-headers-`uname -r`/include/asm-x86 /usr/src/linux-headers-`uname -r`/include/asm

#install dahdi

cd /usr/src/dahdi*
make && make install && make config

#install libpri

cd /usr/src/libpri-1.4*
make && make install

#install asterisk. note: once the menu pops up check and make sure you have chan_motif and xmpp (should have a * next to them)

cd /usr/src/asterisk*
./configure && make menuselect && make && make install && make config && make samples

Step 6. Configure Google Voice

#Backup original conf files (you should still be root)

cd /etc/asterisk
cp extensions.conf extensions.conf.orig
cp motif.conf motif.conf.orig
cp sip.conf sip.conf.orig
cp xmpp.conf xmpp.conf.orig

Now you will want to replace the following files with these (change USERNAME to whatever you want and make sure you google account info is correct):

#extensions.conf - Don't forget the USERNAME on the last line

[general]
autofallthrough=yes

 ; If an unauthenticated request some how gets through, send them to free 411.
[default]
exten => 411,1,Answer()
same => n,Dial(Motif/google/1800...@voice.google.com)

 [local]
exten => _1XXXXXXXXXX,1,Dial(Motif/google/${EXTEN}@voice.google.com,,r)
exten => _XXXXXXXXXX,1,Dial(Motif/google/${EXTEN}@voice.google.com,,r)
exten => _+1XXXXXXXXXX,1,Dial(Motif/google/${EXTEN}@voice.google.com,,r)

 [incoming-motif]
exten => s,1,NoOp()
 same => n,Set(crazygooglecid=${CALLERID(name)})
 same => n,Set(stripcrazysuffix=${CUT(crazygooglecid,@,1)})
 same => n,Set(CALLERID(all)=${stripcrazysuffix})
 same => n,Dial(SIP/USERNAME,20,D(:1))

#motif.conf

[google]
context=incoming-motif
disallow=all
allow=ulaw
connection=google

#sip.conf - Pay attention to externhost, secret, and USERNAME

[general]
allow=all
allowguest=no
nat=force_rport,comedia
tcpbindaddr=0.0.0.0
tcpenable=yes

 externhost=ELASTICIP
localnet=10.0.0.0/8

[USERNAME]
type=peer
secret=PASSWORDYOUGENERATE
host=dynamic
context=local
transport=udp,tcp

#xmpp.conf

[general]
[google]
type=client
serverhost=talk.google.com
username=YOUREMAIL@GMAIL.COM
secret=GMAILPASSWORD
priority=100
port=5222
usetls=yes
usesasl=yes
status=available
statusmessage="VOIP"
timeout=5

# Stop/Start asterisk

sudo /etc/init.d/asterisk stop
sudo /etc/init.d/asterisk start

If everything went at planned your Asterisk Server with Google voice should be working, you can now login with your SIP client utilizing the extension username and password that you chose in sip.conf. In my case I used a SNOM 300 from our office. So far, I have been on business calls with it and have yet to have any call quality issues. Enjoy!
Posted by at No comments:
Labels: , , , , ,
Subscribe to: Posts (Atom)