Router to VPN Client with a Preshared Key and NAT
Complete the tasks outlined in this Practical Exercise. Also review the Practical Exercise solution to see how you did and to see what concepts you might need to review.
In this Practical Exercise, you are the administrator of a router that will be the terminating endpoint for VPNs from a VPN client.
Background Information
You will configure your router with the following options. Your router will issue the user an IP address from a pool of addresses, wildcard preshared keys, and NAT. This will allow an off-site user to gain access to your network and have an internal IP address, making it appear to the user that he or she is inside your network. Because you are using private addressing, NAT is involved, and your router must be told what to translate and what not to translate. You will use the topology shown in Figure 14-9.
Figure 14-9. Router to VPN Client with a Preshared Key and NAT
Task 1: Verify Compatibility with Existing Access Lists
To run IKE and IPSec, you need to ensure that any existing access lists are compatible with both protocols. Any existing access lists must allow the ports required by IKE and IPSec to pass through them.
Task 2: Create Network Address Translation
- Step 1. At the R3 console, provide all the configuration required to
set the following NAT settings:
-
- Define a NAT pool.
-
- Define an access list for NAT.
-
- Define the NAT route map.
-
- Define the NAT interfaces.
-
Task 3: Define IKE Parameters
- Step 1. At the R3 console, provide all the configuration required to
set the following IKE settings:
-
- Define an ISAKMP policy.
-
- Define the ISAKMP peer and key.
-
- Define the address assignment for the client.
-
Task 4: Define IPSec Parameters
- Step 1. At the R3 console, provide all the configuration required to
set the following IPSec settings:
-
- Define an IPSec transform set.
-
- Define the IPSec dynamic crypto map.
-
- Define the IPSec crypto map.
-
- Define the IPSec crypto map.
-
- Associate the crypto map to the Ethernet 0 interface.
-
Task 5: Define the Client Parameters
- Step 1. On the client PC, provide all the configuration required to
create the connection IPSec settings:
-
- Create the connection.
-
- Identify the remote peer.
-
- Identify the Phase 1 information.
-
- Identify the Phase 2 information.
-
- Identify the other connection information.
-