Set Up IPSec Direct Encapsulation on Cisco Devices

With the importance of internet security being at the forefront of everyone’s mind these days, importance of keeping data safe while in transit is vital. There are of course a number of different technologies that are available to keep data safe including IP Security (IPSec), Generic Routing Encapsulation (GRE), Secure Sockets Layer (SSL) VPNs, and more. One of the major issues that many people have with IPSec is that it does not directly support IP multicast (required for many routing protocols) or protocols other than IP; this is often why a mix of different technologies are used to provide a solution that is optimal for each situation.

For now, let's take a look at just IPSec -- specifically, IPSec direct encapsulation on Cisco devices.

Transport or Tunnel? Tackling IPSec Modes

The first thing to recognize is that IPSec itself is not a protocol but a collection of protocols that are used collectively to create a secure connection between endpoints. While IPSec is an open standard, among the most used features are the Internet Security Association and Key Management Protocol (ISAKMP), which is used to establish a Security Association (SA) between endpoints. This includes a common encryption protocol (for ISAKMP) and authentication method and parameters. Authentication Header (AH) provides the ability for a connection to have integrity protection and data origin authentication, while Encapsulating Security Payload (ESP) provides the ability for a connection to have integrity protection and data origin authentication as well as the ability to have data confidentiality using encryption. IPSec offers two modes of operation: transport and tunnel. The Authentication Header and ESP operate differently depending on the mode being used.

Now that I've thrown a mess of acronyms at you, let's tackle the modes of operation. Intransport mode, AH inserts an IPSec header after the main IP header and is able to protect the contents of all IP header fields. In tunnel mode, AH authenticates the original header, encapsulates it and creates a new IP header which it then protects the same as in transport mode. Because of the way that AH monitors the whole IP header it is not compatible with NAT as NAT changes the source and destination IP address fields.

In transport mode, ESP encrypts the IP payload and inserts an IPSec header after the original header; it does not alter the original IP header and does not authenticate the IP header itself. In tunnel mode, however, ESP inserts the IPSec header after the original IP header, and it encapsulates and encrypts (that is, if configured) the whole IP packet. A new IP header is then put onto the encapsulated packet (this new IP header is not authenticated).

IPSec Direct Encapsulation Configuration

There are a number of commands that are used to set up IPSec. Below, table 1 shows the commands that are required and their options. Obviously, this is certainly a long list of commands to follow. The simplest way to learn it is to set up two routers (or emulated routers) and configure them with these steps.

1	Enter privileged EXEC mode	router>enable
2	Enter device configuration mode	router#configure terminal
3	Create and enter ISAKMP policy configuration mode	router(config)#crypto isakmp policy policy-priority
4	Configure an ISAKMP encryption standard	router(config-isakmp)#encryption [3des |aes | des]
5	Configure ISAKMP authentication type	router(config-isakmp)#authentication [pre-share | rsa-encr | rsa-sig]
6	Configure a Diffie-Hellman group	router(config-isamkp)#group [1 | 2 | 5 | 14 |15 | 16]
7	Exit ISAKMP policy configuration mode	router(config-isakmp)#exit
8	Configure ISAKMP pre-shared key. This is just one method -- other Public Key Infrastructure options can also be used	router(config)#crypto isakmp key key[address ip-address | hostname hostname]
9	Configure Dead Peer Detection (DPD) keep alive messages. While this is not required, it provides a mechanism to know when an IKE peer goes down.	router(config)#crypto isakmp keepaliveseconds
10	Create a IPSec transform set. This is a combination of security protocols and algorithms used. There are severaltransforms available; check the Cisco command reference for a complete list.	router(config)#crypto ipsec transform-settransform-set-name transform1 [transform2] [transform3] [transform4]
11	Configure the source IPSec interface to be used	router(config)#crypto map map-name local-address interface
12	Create and enter Crypto map configuration mode	router(config)#crypto map map-name sequence-number ipsec-isakmp
13	Configure the IPSec peer	router(config-crypto-map)#set peer [peer-ip-address | peer-hostname]
14	Configure the IPSec transform set to be used	router(config-crypto-map)#set transform-set transform-set-name
15	Configure the ACL to be used for interesting traffic. "Interesting traffic" is the traffic that will be acted upon by IPSec	router(config-crypto-map)#match addressacl-number
16	Exit Crypto map configuration mode	router(config-crypto-map)#exit
17	Create an ACL for interesting traffic. This is typically an extended ACL that is used to specify the traffic that will be handled by IPSec.	router(config)#access-list acl-numberpermit ip source-network source-inverse-mask destination-network destination-inverse-mask
18	Enter interface configuration mode. This is the source interface for IPSec	router(config)#interface interface
19	Configure the interface to use a specific crypto map	router(config-if)#crypto map map-name

Far away from the End…

When it comes to IP Security, there are certainly a large number of options and methods of using both IPSec direct encapsulation by itself and in conjunction with other security technologies. Hopefully this article helped make you feel less mired in your understanding of general IPSec concepts, and you've learned a bit about how to how to configure direct IPSec encapsulation without the use of any other technologies.

---Original reference from http://www.petri.co.il/ipsec-direct-encapsulation.htm

Need More Related Tips and Tutorials?

How to Configure IPSEC Encryption with theCisco IOS?

More Cisco and Networking News, Resources, Tips and Tutorials you can visit router-switch.com’s blog