Configuracin VPN Site to Site Juniper Cisco

Escenario Presentado

Configuracin en Firewall Juniper SRX 220H2

Configuracion de Interfaz Externa set interfaces ge-0/0/0 unit 0 family inet address 190.107.182.194/28

Configuracion de VPN Fase 1 set security ike proposal PROPOSAL-MALL authentication-method pre-shared-keys set security ike proposal PROPOSAL-MALL dh-group group2 set security ike proposal PROPOSAL-MALL authentication-algorithm sha1 set security ike proposal PROPOSAL-MALL encryption-algorithm 3des-cbc set security ike proposal PROPOSAL-MALL lifetime-seconds 28800 set security ike policy POLICY-MALL mode main set security ike policy POLICY-MALL proposals PROPOSAL-MALL set security ike policy POLICY-MALL pre-shared-key ascii-text jun1p3r123 set security ike gateway GATEWAY-MALL ike-policy POLICY-MALL set security ike gateway GATEWAY-MALL address 190.41.185.145 set security ike gateway GATEWAY-MALL external-interface ge-0/0/0.0

Fase 2 set security ipsec proposal PROPOSAL-MALL-PHASEII protocol esp set security ipsec proposal PROPOSAL-MALL-PHASEII authentication-algorithm hmac-sha1-96 set security ipsec proposal PROPOSAL-MALL-PHASEII encryption-algorithm 3des-cbc set security ipsec proposal PROPOSAL-MALL-PHASEII lifetime-seconds 3600 set security ipsec policy POLICY-MALL-PHASEII perfect-forward-secrecy keys group2 set security ipsec policy POLICY-MALL-PHASEII proposals PROPOSAL-MALL-PHASEII set security ipsec vpn VPN-MALL-PHASEII ike gateway GATEWAY-MALL set security ipsec vpn VPN-MALL-PHASEII ike ipsec-policy POLICY-MALL-PHASEII set security ipsec vpn VPN-MALL-PHASEII establish-tunnels immediately

Creacin de Polticas de Zona LAN WAN set security policies from-zone LAN to-zone WAN policy VPN_MB match source-address 10.10.1.0 set security policies from-zone LAN to-zone WAN policy VPN_MB match destination-address 192.168.2.0 set security policies from-zone LAN to-zone WAN policy VPN_MB match application any set security policies from-zone LAN to-zone WAN policy VPN_MB then permit tunnel ipsec-vpn VPN-MALL-PHASEII set security policies from-zone LAN to-zone WAN policy VPN_MB then permit tunnel pair-policy VPN_MB1

WAN LAN set security policies from-zone WAN to-zone LAN policy VPN_MB1 match source-address 192.168.2.0 set security policies from-zone WAN to-zone LAN policy VPN_MB1 match destination-address 10.10.1.0 set security policies from-zone WAN to-zone LAN policy VPN_MB1 match application any set security policies from-zone WAN to-zone LAN policy VPN_MB1 then permit tunnel ipsec-vpn VPN-MALL-PHASEII set security policies from-zone WAN to-zone LAN policy VPN_MB1 then permit tunnel pair-policy VPN_MB

Configuracin en Router Cisco

Configuracin de interfaz Externa

R2(config)#interface fastEthernet 1/0 R2(config-if)#ip address 190.41.185.145 255.255.255.240 R2(config-if)#no shutdown

Configuracion de VPN

Fase 1 R2(config)#crypto isakmp policy 1 R2(config-isakmp)#encryption 3des R2(config-isakmp)#authentication pre-share R2(config-isakmp)#group 2 R2(config-isakmp)#lifetime 28800 R2(config-isakmp)#exit R2(config)#crypto isakmp key 0 jun1p3r123 address 190.107.182.194 R2(config)#crypto isakmp identity hostname R2(config)#crypto isakmp keepalive 10 periodic

Fase 2 R2(config)#crypto ipsec transform-set MUNI_IPSEC esp-3des esp-sha-hmac R2(cfg-crypto-trans)#exit R2(config)#crypto map MUNI_MAP 100 ipsec-isakmp R2(config-crypto-map)#set peer 190.107.182.194 R2(config-crypto-map)#set transform-set MUNI_IPSEC R2(config-crypto-map)#set pfs group2 R2(config-crypto-map)#match address ACL_VPN_MUNI

Configuracin sobre la Interfaz Externa R2(config)#interface fastEthernet 1/0 R2(config-if)#crypto map MUNI_MAP

Configuracion de Access Lists R2(config)#ip access-list extended ACL_VPN_MUNI R2(config-ext-nacl)#permit ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255