Cisco 841MJ 2台で拠点間VPN

2017年4月25日

Cisco製ルータの841MJを2台用意し、フレッツで拠点間VPNを組み、サーバを公開し、インターネットも使えるようにします。
なお、標準のGUIは使わずにCUIで設定します。

用意するもの

C841M-4X-JSEC/K9　×2台
フレッツ回線（両拠点共に）
プロバイダ契約（両拠点共に固定IPが必要）

設定のポイント

VPNはIPSecを利用します
Cisco Configuration Professional ExpressというGUIは使わないのであらかじめ削除（アンインストール方法はここを参照）
DHCPサーバとして利用　各拠点で割り当てるIPは192.168.x.1～192.168.x.20
DNSサーバとして利用
SSHが使えるようにする　アクセス制限は特につけない
LAN側に接続したPCからインターネットが使えるようにする
サーバが公開できるようにする
FirewallとしてCBACを使う
回線：フレッツ光
プロバイダ：固定ＩＰのもの

拠点Aのコンフィグ

公開サーバ：ウェブサーバ（TCP 80,443を開放）
[code]
hostname siteA
!
ip dhcp excluded-address 192.168.10.21 192.168.10.254
!
ip dhcp pool dhcp-pool
import all
network 192.168.10.0 255.255.255.0
default-router 192.168.10.254
dns-server 192.168.10.254
lease 0 2
!
!
!
ip inspect name CBAC tcp
ip inspect name CBAC udp
ip inspect name CBAC icmp
ip cef
no ipv6 cef
!
!
!
redundancy
!
!
!
!
no cdp run
!
!
!
crypto isakmp policy 1
encr aes
hash md5
authentication pre-share
crypto isakmp key cisco address 相手側のWAN側IP
crypto isakmp keepalive 30 periodic
!
!
crypto ipsec transform-set IPSEC esp-aes esp-md5-hmac
mode tunnel
!
!
!
crypto map M-ipsec 1 ipsec-isakmp
set peer 相手側のWAN側IP
set transform-set IPSEC
match address ipsec
!
!
!
!
!
interface GigabitEthernet0/0
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface GigabitEthernet0/3
no ip address
!
interface GigabitEthernet0/4
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/5
no ip address
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1414
!
interface Dialer1
mtu 1454
ip address negotiated
ip access-group security in
ip nat outside
ip inspect CBAC out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp mtu adaptive
ppp authentication chap callin
ppp chap hostname プロバイダのID
ppp chap password 0 プロバイダのパスワード
ppp ipcp dns request accept
ppp ipcp route default
no cdp enable
crypto map M-ipsec
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source list nat interface Dialer1 overload
ip nat inside source static tcp 192.168.10.120 80 この拠点のWAN側IP 80 extendable
ip nat inside source static tcp 192.168.10.120 443 この拠点のWAN側IP 443 extendable
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended ipsec
permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
ip access-list extended nat
deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 any
ip access-list extended security
permit esp host 相手側のWAN側IP host この拠点のWAN側IP
permit udp host 相手側のWAN側IP host この拠点のWAN側IP eq isakmp
permit tcp any any eq domain
permit tcp any eq domain any
permit udp any any eq domain
permit udp any eq domain any
permit tcp any host この拠点のWAN側IP eq www
permit tcp any host この拠点のWAN側IP eq 443
ip access-list extended ssh
permit ip any any
!
dialer-list 1 protocol ip permit
!
!
!
!
line con 0
login local
no modem enable
line vty 0 4
access-class ssh in
privilege level 15
login local
transport input ssh
line vty 5 15
access-class ssh in
privilege level 15
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end
[/code]

拠点Bのコンフィグ

公開サーバ：リモートデスクトップゲートウェイ(TCP 443 を開放)
[code]
hostname siteB
!
ip dhcp excluded-address 192.168.20.20 192.168.20.254
!
ip dhcp pool ccp-pool
import all
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
dns-server 192.168.20.254
lease 0 2
!
!
!
ip inspect name CBAC tcp
ip inspect name CBAC udp
ip inspect name CBAC icmp
ip cef
no ipv6 cef
!
!
license udi pid C841M-4X-JSEC/K9 sn XXXXXXXXXXX
!
!
username admin password 0 パスワード
!
redundancy
!
!
!
!
no cdp run
!
!
!
crypto isakmp policy 1
encr aes
hash md5
authentication pre-share
crypto isakmp key cisco address 相手側のWAN側IP
crypto isakmp keepalive 30 periodic
!
!
crypto ipsec transform-set IPSEC esp-aes esp-md5-hmac
mode tunnel
!
!
!
crypto map M-ipsec 1 ipsec-isakmp
set peer 相手側のWAN側IP
set transform-set IPSEC
match address ipsec
!
!
!
!
!
interface GigabitEthernet0/0
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface GigabitEthernet0/3
no ip address
!
interface GigabitEthernet0/4
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/5
no ip address
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1414
!
interface Dialer1
mtu 1454
ip address negotiated
ip access-group security in
ip nat outside
ip inspect CBAC out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp mtu adaptive
ppp authentication chap callin
ppp chap hostname プロバイダのID
ppp chap password 0 プロバイダのパスワード
ppp ipcp dns request accept
ppp ipcp route default
no cdp enable
crypto map M-ipsec
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source list nat interface Dialer1 overload
ip nat inside source static tcp 192.168.20.203 443 この拠点のWAN側IP 443 extendable
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended ipsec
permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
ip access-list extended nat
deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.20.0 0.0.0.255 any
ip access-list extended security
permit esp host 相手側のWAN側IP host この拠点のWAN側IP
permit udp host 相手側のWAN側IP host この拠点のWAN側IP eq isakmp
permit tcp any any eq domain
permit tcp any eq domain any
permit udp any any eq domain
permit udp any eq domain any
permit tcp any host この拠点のWAN側IP eq 443
ip access-list extended ssh
permit ip any any
!
dialer-list 1 protocol ip permit
!
!
!
!
line con 0
login local
no modem enable
line vty 0 4
access-class ssh in
privilege level 15
login local
transport input ssh
line vty 5 15
access-class ssh in
privilege level 15
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end
[/code]