En esta entrada haremos una configuración básica VPN de acceso remoto, para que los usuarios autorizados se puedan comunicar desde el exterior con nuestra infraestructura de red interna, en este segundo caso las direcciones ip asignadas a los clientes VPN están en distinto rango que nuestra LAN.
* Configuración Router rtvpn:
!
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname rtvpn
!
boot-start-marker
boot-end-marker
!
enable secret ——-
!
aaa new-model
!
!
aaa authentication login VTY_LOGIN local
aaa authentication login CONSOLE_LOGIN none
aaa authentication login AUX_LOGIN none
aaa authentication login VPN_USERS_DB local
aaa authentication enable default enable
aaa authorization network VPN_NET_PROFILE local
!
aaa session-id common
memory-size iomem 5
no ip source-route
no ip gratuitous-arps
no ip icmp rate-limit unreachable
ip cef
!
!
no ip bootp server
no ip domain lookup
ip domain name campoamor.net
login block-for 30 attempts 3 within 10
!
!
username jramos secret ———-
username user1vpn secret ———
!
!
ip tcp synwait-time 5
ip ssh version 2
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group LANCAMPOAMOR
key campoamor
pool POOL_LANCAMPOAMOR
netmask 255.255.255.0
crypto isakmp profile VPN_RAS
match identity group LANCAMPOAMOR
client authentication list VPN_USERS_DB
isakmp authorization list VPN_NET_PROFILE
client configuration address respond
keepalive 30 retry 2
!
!
crypto ipsec transform-set VPNCLIENTS_TS esp-aes 256 esp-sha-hmac
!
crypto dynamic-map VPNCLIENTS_INIT 10
set transform-set VPNCLIENTS_TS
match address TRAF_VPN
reverse-route
!
!
crypto map CMAP_VPN isakmp-profile VPN_RAS
crypto map CMAP_VPN 10 ipsec-isakmp dynamic VPNCLIENTS_INIT
!
!
interface FastEthernet0/0
description Red VPN Server
ip address 192.168.1.201 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
no mop enabled
crypto map CMAP_VPN
!
interface FastEthernet0/1
description LAN Campoamor
ip address 192.168.2.1 255.255.255.0
ip access-group SALIDA_LANCAMPOAMOR in
no ip redirects
no ip unreachables
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
!
ip local pool POOL_LANCAMPOAMOR 192.168.9.16 192.168.9.31
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
no ip http server
no ip http secure-server
!
ip access-list extended SALIDA_LANCAMPOAMOR
permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.2.0 0.0.0.255 192.168.9.16 0.0.0.15
deny ip 192.168.2.0 0.0.0.255 10.0.0.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.255.255
deny ip 192.168.2.0 0.0.0.255 172.16.0.0 0.15.255.255
permit ip any any
ip access-list extended TRAF_VPN
permit ip 192.168.9.16 0.0.0.15 any
permit ip any 192.168.9.16 0.0.0.15
!
no cdp run
!
!
control-plane
!
!
banner login
*****************************************************************
* RAGASYS, S.A. *
* Este es un sistema privado perteneciente a RAGASYS SISTEMAS *
* Prohibido el acceso no autorizado. *
*****************************************************************
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login authentication CONSOLE_LOGIN
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
login authentication AUX_LOGIN
line vty 0 4
login authentication VTY_LOGIN
transport input ssh
line vty 5 807
login authentication VTY_LOGIN
transport input ssh
!
!
end
Saludos y espero que os sirva.
