0
edits
Changes
Template:Netoworking rut configuration example cisco ipsec (view source)
Revision as of 10:45, 2 April 2020
, 10:45, 2 April 2020→Cisco configuration
* One RUTxxx router of any type
* One RUTxxx router of any type
* One Cisco router of any type
* One Cisco router (this configuration example was created using Cisco RV340W)
* At least one router must have a Public Static or Public Dynamic IP address
* At least one router must have a Public Static or Public Dynamic IP address
* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers
* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers
==Configuration scheme==
==Configuration scheme==
[[File:Networking_rutxxx_configuration_example_ipsec_topology_v1.png|border|class=tlt-border|1100x1100px]]
[[File:Networking_rutxxx_configuration_example_ipsec_topology_v2.png|border|class=tlt-border|1100x1100px]]
==RUT configuration==
==RUT configuration==
# Write '''Pre-shared key''' (a shared password used for authentication between the peers. The value of this field must match on both instances).
# Write '''Pre-shared key''' (a shared password used for authentication between the peers. The value of this field must match on both instances).
# Add '''Secret's ID selector''' (Cisco LAN IP).
# Add '''Secret's ID selector''' (Cisco LAN IP).
# Press '''Save'''
# Press '''Save'''.
==Cisco configuration==
==Cisco configuration==
Connect to router's WebUI, go to '''VPN > IPsec Profiles''' and apply the following configuration.
Connect to router's WebUI, go to '''VPN > IPsec Profiles''' and apply the following configuration.
[[File:Networking_rutxxx_configuration_example_ipsec_cisco_profiles_v1.png|border|class=tlt-border]]
[[File:Networking_rutxxx_configuration_example_ipsec_cisco_profiles_v2.png|border|class=tlt-border]]
----
# Add '''Profile Name''' (anything you want).
# Choose '''Keying Mode''' (Auto).
# Choose '''IKE version''' (IKEv1).
# Select '''DH Group''' (Group 5).
# Select '''Encryption''' (3DES).
# Choose '''Authentication''' (SHA1).
# Set '''SA Lifetime''' (28800).
# Choose protocol in '''Protocol Selection''' (ESP).
# Select '''Encryption''' (3DES).
# Select '''Authentication''' (SHA1).
# Set '''SA Lifetime''' (28800).
# Enable '''Perfect Forward Secrecy'''.
# Select '''Group: Group''' (5).
When you are done with '''IPsec Profiles''', save settings, go to '''Site-to-Site''' settings and apply the following configuration:
[[File:Networking_rutxxx_configuration_example_ipsec_cisco_s2s_v2.png|border|class=tlt-border]]
# '''Enable''' it.
# Select '''IPsec Profile''' (RUT).
# Set '''Interface''' (your internet source).
# Select '''Remote Endpoint''' (static IP).
# Write '''RUT Public IP'''.
# Add '''Pre Shared Key''' (a shared password used for authentication between the peers. The value of this field must match on both instances).
# Disable '''Minimum Key complexity'''.
# Select '''Local Identifier Type''' (IP Address).
# Write '''Local Identifier''' (Cisco LAN IP address).
# Select '''Local IP Type''' (Subnet).
# Write '''IP Address''' (Cisco local network).
# Add '''Subnet Mask''' (network mask).
# Select '''Remote Identifier Type''' (Remote WAN IP).
# Write '''Remote Identifier''' (RUT LAN IP).
# Select '''Remote IP Type''' (Subnet).
# Add '''IP Address''' (RUT local network).
# Add '''Subnet Mask''' (RUT local network mask).
==Testing the setup==
==Testing the setup==
If you've followed all the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly. In order to test an IPsec connection, login to the RUT WebUI and go to '''Services → CLI'''. Login with user name: '''root''' and the router's admin password. From there you should then be able to '''ping''' the opposite instance's LAN IP address. To use a ping command, type '''ping <ip_address>''' and press the "Enter" key on your keyboard:
If you've followed all the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly. In order to test an IPsec connection, login to the RUT WebUI and go to '''Services → CLI'''. Login with user name: '''root''' and the router's admin password. From there you should then be able to '''ping''' the opposite instance's LAN IP address. To use a ping command, type '''ping <ip_address>''' and press the "Enter" key on your keyboard:
[[File:Configuration example ipsec testing.png]]
[[File:Networking_rutxxx_configuration_example_ipsec_ping_v1.png|border|class=tlt-border]]
You can also test if LAN access is working the same way. Instead of pinging the opposite instance's LAN IP address, ping one of the end device's IPs. One common issue that can be encountered here is that the end devices '''might need their DHCP leases renewed'''. There are many methods of accomplishing this, but the easiest and most accessible way is to simply disconnect and reconnect the LAN cable to device or the router that it's connected to.
You can also test if LAN access is working the same way. Instead of pinging the opposite instance's LAN IP address, ping one of the end device's IPs. One common issue that can be encountered here is that the end devices '''might need their DHCP leases renewed'''. There are many methods of accomplishing this, but the easiest and most accessible way is to simply disconnect and reconnect the LAN cable to device or the router that it's connected to.
If the ping requests are successful, congratulations, your setup works! If not, we suggest that you review all steps once more.
If the ping requests are successful, congratulations, your setup works! If not, we suggest that you review all steps once more.
