Scribd
Upload
242 views5 pages

Configuración VPN Site To Site Juniper Cisco

The document describes the configuration of a site-to-site VPN between a Juniper SRX firewall and a Cisco router. It includes the configuration of IKE phase 1 and phase 2 proposals and policies to establish an IPsec tunnel, as well as the associated interface, access list, and policy configurations on both devices to enable secure communication between their LAN networks.

Uploaded by

Antonio Pereda
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
242 views5 pages

Configuración VPN Site To Site Juniper Cisco

The document describes the configuration of a site-to-site VPN between a Juniper SRX firewall and a Cisco router. It includes the configuration of IKE phase 1 and phase 2 proposals and policies to establish an IPsec tunnel, as well as the associated interface, access list, and policy configurations on both devices to enable secure communication between their LAN networks.

Uploaded by

Antonio Pereda
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

Configuracin VPN Site to Site Juniper Cisco

Escenario Presentado

Configuracin en Firewall Juniper SRX 220H2

Configuracion de Interfaz Externa set interfaces ge-0/0/0 unit 0 family inet address 190.107.182.194/28

Configuracion de VPN Fase 1 set security ike proposal PROPOSAL-MALL authentication-method pre-shared-keys set security ike proposal PROPOSAL-MALL dh-group group2 set security ike proposal PROPOSAL-MALL authentication-algorithm sha1 set security ike proposal PROPOSAL-MALL encryption-algorithm 3des-cbc set security ike proposal PROPOSAL-MALL lifetime-seconds 28800 set security ike policy POLICY-MALL mode main set security ike policy POLICY-MALL proposals PROPOSAL-MALL set security ike policy POLICY-MALL pre-shared-key ascii-text jun1p3r123 set security ike gateway GATEWAY-MALL ike-policy POLICY-MALL set security ike gateway GATEWAY-MALL address 190.41.185.145 set security ike gateway GATEWAY-MALL external-interface ge-0/0/0.0

Fase 2 set security ipsec proposal PROPOSAL-MALL-PHASEII protocol esp set security ipsec proposal PROPOSAL-MALL-PHASEII authentication-algorithm hmac-sha1-96 set security ipsec proposal PROPOSAL-MALL-PHASEII encryption-algorithm 3des-cbc set security ipsec proposal PROPOSAL-MALL-PHASEII lifetime-seconds 3600 set security ipsec policy POLICY-MALL-PHASEII perfect-forward-secrecy keys group2 set security ipsec policy POLICY-MALL-PHASEII proposals PROPOSAL-MALL-PHASEII set security ipsec vpn VPN-MALL-PHASEII ike gateway GATEWAY-MALL set security ipsec vpn VPN-MALL-PHASEII ike ipsec-policy POLICY-MALL-PHASEII set security ipsec vpn VPN-MALL-PHASEII establish-tunnels immediately

Creacin de Polticas de Zona LAN WAN set security policies from-zone LAN to-zone WAN policy VPN_MB match source-address 10.10.1.0 set security policies from-zone LAN to-zone WAN policy VPN_MB match destination-address 192.168.2.0 set security policies from-zone LAN to-zone WAN policy VPN_MB match application any set security policies from-zone LAN to-zone WAN policy VPN_MB then permit tunnel ipsec-vpn VPN-MALL-PHASEII set security policies from-zone LAN to-zone WAN policy VPN_MB then permit tunnel pair-policy VPN_MB1

WAN LAN set security policies from-zone WAN to-zone LAN policy VPN_MB1 match source-address 192.168.2.0 set security policies from-zone WAN to-zone LAN policy VPN_MB1 match destination-address 10.10.1.0 set security policies from-zone WAN to-zone LAN policy VPN_MB1 match application any set security policies from-zone WAN to-zone LAN policy VPN_MB1 then permit tunnel ipsec-vpn VPN-MALL-PHASEII set security policies from-zone WAN to-zone LAN policy VPN_MB1 then permit tunnel pair-policy VPN_MB

Configuracin en Router Cisco

Configuracin de interfaz Externa

R2(config)#interface fastEthernet 1/0 R2(config-if)#ip address 190.41.185.145 255.255.255.240 R2(config-if)#no shutdown

Configuracion de VPN

Fase 1 R2(config)#crypto isakmp policy 1 R2(config-isakmp)#encryption 3des R2(config-isakmp)#authentication pre-share R2(config-isakmp)#group 2 R2(config-isakmp)#lifetime 28800 R2(config-isakmp)#exit R2(config)#crypto isakmp key 0 jun1p3r123 address 190.107.182.194 R2(config)#crypto isakmp identity hostname R2(config)#crypto isakmp keepalive 10 periodic

Fase 2 R2(config)#crypto ipsec transform-set MUNI_IPSEC esp-3des esp-sha-hmac R2(cfg-crypto-trans)#exit R2(config)#crypto map MUNI_MAP 100 ipsec-isakmp R2(config-crypto-map)#set peer 190.107.182.194 R2(config-crypto-map)#set transform-set MUNI_IPSEC R2(config-crypto-map)#set pfs group2 R2(config-crypto-map)#match address ACL_VPN_MUNI

Configuracin sobre la Interfaz Externa R2(config)#interface fastEthernet 1/0 R2(config-if)#crypto map MUNI_MAP

Configuracion de Access Lists R2(config)#ip access-list extended ACL_VPN_MUNI R2(config-ext-nacl)#permit ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255

You might also like