0

Given a windows server 2012 client (which I have under full administrator control), and an external Cisco ASA5540 router (which I don't), I'd like to connect to the router to access their internal network via ipsec VPN.

Connection details are:

IKE Phase-1: Encryption Scheme: IKE
Key Exchange methods: 3DES
Hashing Algorithm: MD5
Authentication Method: Pre-shared Secret Aggressive Mode Support: No
Diffie Helmen Group for Phase1: Group 2 (preferred) IKE SA (phase 1 ) lifetime: 1440 Seconds

IKE Phase-2: Encryption Scheme: IKE
Transform (IPSec Protocol): ESP Encryption Algorithm 3DES Data Integrity: MD5 Use Perfect Forward Secrecy (PFS): No
Diffie Helmen group for PFS: Group 2 (preferred)
IPSEC SA (phase 2) lifetime 28800 seconds Key Exchange For Subnets: Yes

Encryption domain: 192.168.113.0/24 Security policy rules: Source: 10.135.1.80/32 -> Destination: 192.168.251.32/32

(I can't make changes to the router's config)

What are the specific steps to connect to this router using any client, or method whatsoever?

Improve this question
2
  • It is actually a contradiction to have PFS: no and DH group: group 2 both in phase 2. If PFS were being used, it would look something like PFS: yes, DH group 2. If PFS were not being used, then DH group would be omitted.
    – user3629081
    May 3, 2019 at 20:41
  • While your question does have an answer, it is a daunting task to answer it. The details you've given indicate that this is a site-to-site tunnel, which Windows has built-in support for, but it's very klunky. You would start inside secpol.msc and configure everything manually. The administrator of the firewall has to add your public IP to their config for it to work.
    – user3629081
    May 3, 2019 at 20:52

2 Answers 2

Reset to default
1

The path of least resistance is to ask the people who manage the destination firewall for a copy of the Cisco IPSEC VPN client or for access using an SSL AnyConnect VPN. See if they can provide a PCF configuration file to you.

Improve this answer
2
  • I have tried with Cisco IPSec VPN client (v5), which 1, didn't allowed setting encryption domain preferences, and 2, failed during policy negotiation.
    – Silver Dragon
    Nov 5, 2014 at 17:51
  • The ASA administrator sets the VPN profile settings. You shouldn't need to make any changes on the client other than setting group and key information. Please ask the firewall administrator for a PCF configuration file.
    – ewwhite
    Nov 5, 2014 at 17:53
-1

(The IPSEC VPN client was neither available, nor of any use for their configuration)

Our solution, in the hops of allowing other people to figure this out without banging their heads against the wall for 3 days:

  • Install openswan ( https://www.openswan.org/ ) to an intermediary linux box. Having tried 5 different VPN software on Windows, openswan appears to be the only one reliably able to do this.

  • Add a new virtual interface for the NAT IP (see docs here for details)

    ifconfig eth0:1 10.135.1.80

  • Edit \etc\ipsec.conf :

conn vpc-to-asa
  type=tunnel
  forceencaps=yes
  authby=secret
  compress=no
  disablearrivalcheck=no
  left=myip.myip.myip.myip
  leftid=myip.myip.myip.myip
  leftsubnets={10.135.1.80/32}
  leftsourceip=10.135.1.80
  right=a.b.c.d
  rightsubnets={192.168.251.32/32}
  rightsourceip=192.168.251.32
  keyexchange=ike
  ike=3des-md5
  salifetime=28800s
  pfs=no
  auto=start
  dpdaction=restart
  phase2=esp
  esp=3des-md5

  • edit \etc\ipsec.secrets to add exchanged key

  • service ipsec start should bring up the new interface

  • Debug tools:

monitor all traffic via port 4500:

sudo tcpdump -i eth0 udp port 4500

current ipsec bindings status:

ipsec auto --status

all routes currently available via ipsec:

ipsec look
  • once everything's shiny by ipsec, you can either add an L2TP for windows VPN-based connection, or simply SSH-tunnel the relevant ports
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .