Router to VPN Client with a Preshared Key and NAT
Complete the tasks outlined in this Practical Exercise. Also
review the Practical Exercise solution to see how you did and to see what
concepts you might need to review.
In this Practical Exercise, you are the administrator of a
router that will be the terminating endpoint for VPNs from a VPN client.
Background Information
You will configure your router with the following options. Your
router will issue the user an IP address from a pool of addresses, wildcard
preshared keys, and NAT. This will allow an off-site user to gain access to your
network and have an internal IP address, making it appear to the user that he or
she is inside your network. Because you are using private addressing, NAT is
involved, and your router must be told what to translate and what not to
translate. You will use the topology shown in Figure 14-9.
Task 1: Verify Compatibility with Existing Access
Lists
To run IKE and IPSec, you need to ensure that any existing
access lists are compatible with both protocols. Any existing access lists must
allow the ports required by IKE and IPSec to pass through them.
Task 2: Create Network Address Translation
- Step 1. At the R3 console, provide all the configuration required to
set the following NAT settings:
-
- Define a NAT pool.
-
- Define an access list for NAT.
-
- Define the NAT route map.
-
- Define the NAT interfaces.
Task 3: Define IKE Parameters
- Step 1. At the R3 console, provide all the configuration required to
set the following IKE settings:
-
- Define an ISAKMP policy.
-
- Define the ISAKMP peer and key.
-
- Define the address assignment for the
client.
Task 4: Define IPSec Parameters
- Step 1. At the R3 console, provide all the configuration required to
set the following IPSec settings:
-
- Define an IPSec transform set.
-
- Define the IPSec dynamic crypto map.
-
- Define the IPSec crypto map.
-
- Define the IPSec crypto map.
-
- Associate the crypto map to the Ethernet 0
interface.
Task 5: Define the Client Parameters
- Step 1. On the client PC, provide all the configuration required to
create the connection IPSec settings:
-
- Create the connection.
-
- Identify the remote peer.
-
- Identify the Phase 1 information.
-
- Identify the Phase 2 information.
-
- Identify the other connection
information.
Sections
Archive
Newsletter
Comments (0 posted)
Syndication
