User manual SONICWALL VPN INTEROPERABILITY WITH CISCO IOS PIX USING IKE

[. . . ] SonicWALL VPN Interoperability with Cisco IOS/PIX using IKE Tech note prepared by SonicWALL, Inc. SonicWALL, Inc. 1160 Bordeaux Drive Sunnyvale, CA 94089 1-408-745-9600 Last updated by ah ­ October 30, 2000 Introduction: VPN standards are still evolving and interoperability between products is a continued effort. [. . . ] Fill in the IPSec gateway (in this example 216. 5. 31. 42) 3. Fill in the appropriate Destination Network (in this example 10. 0. 0. 0) and Subnet Mask (in this example 255. 255. 255. 0) 4. Select ESP DES HMAC MD5 or ESP 3DES HMAC MD5 A Sample Screen shot from SonicWALL firmware version 5. 0 is displayed below CISCO IOS/PIX Configuration The Cisco IOS/PIX system has a very rich and complex instruction set. Before you proceed to enter commands on the Cisco Product, you must be logged into the enable/configure terminal mode. For more details on logging into your Cisco Product and configuring settings, please refer to the Cisco documentation available online at http://www. cisco. com Once you are logged into the enable/configure terminal, use the commands below to setup a SA complimentary to the SA setup on the SonicWALL as shown above in the screen shot. The commands below are not a complete guide to configuring a Cisco IOS/PIX product, but are intended only to guide existing Cisco users. Refer to the Cisco documentation (www. cisco. com) for more information regarding the commands below. Last updated by ah ­ October 30, 2000 COMMANDS FOR CISCO IOS Command Access-list 120 permit ip 10. 0. 0. 0 0. 255. 255. 255 host 192. 0. 0. 0 0. 0. 0. 255 crypto isakmp policy 20 Description Set ACCESS LIST To specify the inside and destination networks encr 3des hash md5 authentication pre-share exit crypto isakmp key SonicWALL address 128. 6. 3. 12 Define IKE parameters To define an IKE policy, use the crypto isakmp policy global configuration command. IKE policies define a set of parameters to be used during the IKE negotiation. Use the no form of this command to delete an IKE policy. To specify the encryption algorithm within an IKE policy To specify the hash algorithm within an IKE policy To specify the authentication method within an IKE policy, use the authentication (IKE policy) ISAKMP policy configuration command. To exit and enter a new command To configure a pre-shared authentication key, use the crypto isakmp key global configuration command. In this case the pre-shared secret is "SonicWALL" Define IPSEC parameters To define a transform set---an acceptable combination of security protocols and algorithms---use the crypto ipsec transform-set global configuration command. Here you can specify if you want to use ESP with authentication and DES or 3DES. To specify and name an identifying interface to be used by the crypto map for IPSec traffic Indicates that IKE will be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry. [. . . ] 5 is a number assigned to the crypto map entry crypto map sonic-map 20 match address To specify an extended access list for a crypto map entry 120 crypto map sonic-map 20 set peer To specify an IPSec peer in a crypto map entry, 128. 6. 3. 12 crypto map sonic-map 20 set transformTo specify which transform sets can be used with the set sonic crypto map entry crypto map sonic-map 20 interface outside Last updated by ah ­ October 30, 2000 To Test the VPN tunnel: From the PC behind the Cisco IOS/PIX firewall, try to ping 192. 0. 0. 1 From the PC behind the SonicWALL, try to ping 10. 0. 0. 1 Trouble Shooting Tips: Use the Log Viewer on the Cisco IOS/PIX and the SonicWALL to determine if IKE negotiation has started. If IKE negotiation is complete but pings timeout, the Cisco IOS/PIX host computer may need route configuration. Last updated by ah ­ October 30, 2000 [. . . ]