5

I would like to configure site-to-site SSL VPN between two sites.

I originally set up an IPSec VPN between the two Cisco routers and found I was only getting 10 percent of the available bandwidth. As a comparison I set up a dedicated Linux box with the pfsense distro and set up IPSec VPN, I found again I was only getting 10 percent of the available bandwidth. I then tried OpenVPN/SSL VPN and found I got 90 percent of the available bandwidth.

Both routers are running IOS 15.1(4)M12a, one is a 3825 and the other is a 1841. Both Cisco routers have the ssl-vpn AIM cards for full hardware acceleration.

Overall site-to-site bandwidth is around 80/30 Mbit/sec.

Here is the config of router A (Cisco 1841):

    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    !
    hostname xxxx
    !
    boot-start-marker
    boot system flash:c1841-adventerprisek9-mz.151-4.M12a.bin
    boot-end-marker
    !
    aaa new-model
    !
    aaa authorization exec default local
    !
    aaa session-id common
    clock timezone EDT -5
    ip cef
    !
    no ip bootp server
    ip domain name xxxx
    ip name-server x.x.x.x
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    !
    crypto pki token default removal timeout 0
    !
    ip tftp source-interface FastEthernet0/1
    ip ssh authentication-retries 2
    ip ssh version 2
    ip scp server enable
    !
    crypto isakmp policy 1
     encr aes 256
     hash md5
     authentication pre-share
     group 5
     lifetime 28800
    crypto isakmp key xxxx address x.x.x.a
    crypto isakmp nat keepalive 20
    !
    crypto ipsec security-association lifetime kilobytes 2100000
    crypto ipsec security-association lifetime seconds 28800
    !
    crypto ipsec transform-set rtpset esp-aes
    !
    crypto map rtp 1 ipsec-isakmp
     set peer x.x.x.a
     set transform-set rtpset
     match address aaa
    !
    interface Loopback1
     ip address 1.1.1.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    !
    interface Tunnel1
     no ip address
    !
    interface FastEthernet0/0
     description WAN Interface
     ip address x.x.x.b m.m.m.m
     ip nat outside
     ip virtual-reassembly
     duplex auto
     speed auto
     ipv6 address autoconfig
     no cdp enable
     crypto map rtp
    !
    interface FastEthernet0/1
     description LAN Interface
     ip address x.x.x.x m.m.m.m
     ip nat inside
     ip virtual-reassembly
     duplex auto
     speed auto
    !
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 x.x.x.x
    !
    no ip http server
    no ip http secure-server
    ip nat inside source route-map nonat interface FastEthernet0/0 overload
    ip nat inside source static tcp x.x.x.x 22 x.x.x.b 22 extendable
    ip nat inside source static tcp x.x.x.x 25 x.x.x.b 25 extendable
    ip nat inside source static tcp x.x.x.x 80 x.x.x.b 80 extendable
    ip nat inside source static tcp x.x.x.x 443 x.x.x.b 443 extendable
    !
    ip access-list extended aaa
     permit ip LOCALSUBNET LOCALNETMASK REMOTESUBNET REMOTENETMASK
    !
    access-list 111 deny   ip LOCALSUBNET LOCALNETMASK REMOTESUBNET REMOTENETMASK
    access-list 111 permit icmp any any
    access-list 111 permit ip LOCALSUBNET LOCALNETMASK any
    no cdp log mismatch duplex
    !
    route-map nonat permit 10
     match ip address 111
    !
    control-plane
    !
    scheduler allocate 20000 1000
    ntp clock-period 17178967
    ntp server x.x.x.x
    sntp server x.x.x.x
    end

Here is the config of router B (Cisco 3825):

    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    !
    hostname xxxx
    !
    boot-start-marker
    boot system flash flash:c3825-adventerprisek9-mz.151-4.M12a.bin
    boot-end-marker
    !
    aaa new-model
    !
    aaa authorization exec default local
    !
    aaa session-id common
    clock timezone EDT -5
    no ip source-route
    ip cef
    !
    no ip bootp server
    ip domain name xxxx
    ip name-server x.x.x.x
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    !
    voice-card 0
     no dspfarm
    !
    crypto pki token default removal timeout 0
    !
    ip ssh authentication-retries 2
    ip ssh source-interface GigabitEthernet0/1.3
    ip ssh version 2
    ip scp server enable
    !
    class-map match-any xxxx-speed
     match access-group name xxxx-speed-acl
    !
    policy-map qos
     class xxxx-speed
      shape average 1600000
    !
    crypto isakmp policy 1
     encr aes 256
     hash md5
     authentication pre-share
     group 5
     lifetime 28800
    crypto isakmp key xxxx address x.x.x.b
    crypto isakmp nat keepalive 20
    !
    crypto ipsec security-association lifetime kilobytes 2100000
    crypto ipsec security-association lifetime seconds 28800
    !
    crypto ipsec transform-set rtpset esp-aes
    !
    crypto map rtp 1 ipsec-isakmp
     set peer x.x.x.b
     set transform-set rtpset
     match address aaaanet
    !
    !
    !
    !
    interface GigabitEthernet0/0
     ip address INTERNETIP NETMASK secondary
     ip address INTERNETIP NETMASK secondary
     ip address INTERNETIP NETMASK secondary
     ip address INTERNETIP NETMASK secondary
     ip address INTERNETIP NETMASK secondary
     ip address INTERNETIP NETMASK
     ip flow ingress
     ip flow egress
     ip nat outside
     ip virtual-reassembly
     ip route-cache flow
     duplex auto
     speed auto
     media-type rj45
     crypto map rtp
    !
    interface GigabitEthernet0/1
     no ip address
     duplex auto
     speed auto
     media-type rj45
    !
    interface GigabitEthernet0/1.2
     encapsulation dot1Q 2
     ip address LOCALIP LOCALMASK
     ip access-group bbbb-firewall in
     ip access-group cccc-firewall out
     ip nat inside
     ip virtual-reassembly
    !
    interface GigabitEthernet0/1.3
     description xxxx vlan
     encapsulation dot1Q 3
     ip address LOCALIP LOCALMASK
     ip access-group bbbb-firewall in
     ip access-group firewall out
     ip nat inside
     ip virtual-reassembly
    !
    no ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 x.x.x.a
    !
    ip flow-export source GigabitEthernet0/0
    ip flow-export version 5
    ip flow-export destination LOCALIP 9995
    !
    no ip http server
    no ip http secure-server
    ip nat inside source list natlist interface GigabitEthernet0/0 overload
    ip nat inside source static tcp x.x.x.x PORT x.x.x.a PORT extendable
    ip nat inside source static tcp x.x.x.x PORT x.x.x.a PORT extendable
    ip nat inside source static tcp x.x.x.x PORT x.x.x.a PORT extendable
    ip nat inside source static x.x.x.x x.x.x.x no-payload
    ip nat inside source static x.x.x.x x.x.x.x route-map ddddmap no-payload
    ip nat inside source static x.x.x.x x.x.x.x route-map ddddmap no-payload
    ip nat inside source static x.x.x.x x.x.x.x route-map ddddmap no-payload
    ip nat inside source static x.x.x.x x.x.x.x route-map ddddmap no-payload
    ip route 0.0.0.0 0.0.0.0 x.x.x.x
    !
    ip access-list extended xxxx-speed-acl
     permit ip host LOCALIP any
     permit ip host EXTERNALIP any
    ip access-list extended firewall
     permit ip REMOTENETWORK REMOTEMASK any
     permit tcp any any established
     permit udp any any eq ntp
     permit icmp any any
     permit tcp any any eq domain
     permit tcp any eq domain any
     permit udp any any eq domain
     permit udp any eq domain any
     permit tcp any any range PORT PORT
     permit udp any any range PORT PORT
     permit udp any any gt PORT
     permit gre any any
     permit tcp any host LOCALIP eq 1720
     permit tcp any host LOCALIP eq 22
     permit tcp any host LOCALIP eq www
     permit tcp any host LOCALIP eq smtp
     permit tcp any host LOCALIP eq 465
     permit tcp any host LOCALIP eq 993
     permit tcp any host LOCALIP eq www
     permit tcp any host LOCALIP eq ftp
     permit tcp any host LOCALIP gt 19999
     permit tcp any host LOCALIP eq smtp
     permit tcp any host LOCALIP eq www
     permit tcp any host LOCALIP eq 81
     permit tcp any host LOCALIP eq pop3
     permit tcp any host LOCALIP eq ident
     permit tcp any host LOCALIP eq nntp
     permit tcp any host LOCALIP eq 465
     permit tcp any host LOCALIP eq 873
     permit tcp any host LOCALIP eq 993
     permit tcp any host LOCALIP eq 2401
     permit tcp any host LOCALIP eq 243
     permit tcp any host LOCALIP eq 1243
     permit tcp any host LOCALIP eq 12435
     permit tcp any host LOCALIP eq 22
     permit tcp any host LOCALIP eq 22
     permit tcp host LOCALIP host LOCALIP eq cmd
     permit tcp host LOCALIP host LOCALIP eq cmd
     permit udp host LOCALIP host LOCALIP eq syslog
     permit udp host LOCALIP host LOCALIP eq syslog
     deny   ip any any
    ip access-list extended firwall
    ip access-list extended cccc-firewall
     permit ip host LOCALIP REMOTENETWORK REMOTEMASK
     permit tcp any any established
     permit ip host IP any
     permit tcp any host LOCALIP eq 65
     permit icmp any any
     permit tcp any host LOCALIP eq domain
     permit udp any any eq domain
     permit udp any eq domain any
     permit udp any any eq ntp
     permit tcp any host LOCALIP eq ftp
     permit tcp any host LOCALIP eq smtp
     permit tcp any host LOCALIP eq www
     permit tcp any host LOCALIP eq ident
     permit tcp any host LOCALIP eq 873
     permit tcp any host LOCALIP eq 2401
     permit tcp any host LOCALIP eq 9418
     permit tcp any any range 8000 8999
     deny   ip any any
    ip access-list extended aaaanet
     permit ip LOCALNETWORK LOCALMASK REMOTENETWORK REMOTEMASK
    ip access-list extended natlist
     deny   ip host LOCALIP any
     deny   ip LOCALNETWORK LOCALMASK REMOTENETWORK REMOTEMASK
     deny   ip LOCALNETWORK LOCALMASK REMOTENETWORK REMOTEMASK
     permit ip any any
     permit icmp any any
    ip access-list extended nonat
     deny   ip LOCALNETWORK LOCALMASK REMOTENETWORK REMOTEMASK
     permit ip LOCALNETWORK LOCALMASK any
    ip access-list extended aaaa-firewall
     permit tcp host LOCALIP any eq smtp
     permit tcp host LOCALIP any eq smtp
     permit ip any any
    !
    route-map aaaamap permit 10
     match ip address nonat
    !
    control-plane
    !
    scheduler allocate 20000 1000
    !
    end
Improve this question
6
  • Please edit your question to include the router models and (sanitized) configurations, along with any other information that could help us answer the question. You can refer to the Network Engineering Question Checklist for guidance.
    – Ron Maupin ♦
    Apr 21, 2019 at 3:52
  • I don't have any configuration for SSL VPN so there isn't much I can provide.
    – Mike Thomas
    Apr 21, 2019 at 4:05
  • We need your current configurations so that we can help you come up with the new configurations.
    – Ron Maupin ♦
    Apr 21, 2019 at 4:12
  • Ok that makes sense. I wasn't really asking for the community to make the changes more point me to a guide or a consultant. I will sanitize the configs and add them.
    – Mike Thomas
    Apr 21, 2019 at 4:14
  • Unfortunately, resource recommendations are explicitly off-topic here. Cisco maintains many documents if you search. Something like a search for cisco configuration ssl vpn will probably get you an official Cisco SSL VPN configuration guide.
    – Ron Maupin ♦
    Apr 21, 2019 at 4:16

1 Answer 1

Reset to default
1

From what I see, you want to establish a site-to-site, or LAN-to-LAN VPN from one Cisco router to another using SSL/WEB/ VPN.

Firstly, SSL VPN is a remote-access type VPN, not site to site, this is taken straight out of the Cisco's official SSL VPN guide for users:

"The SSL VPN feature (also known as WebVPN) provides support, in Cisco IOS software, for remote user access to enterprise networks from anywhere on the Internet. Remote access is provided through a Secure Socket Layer- (SSL-) enabled SSL Virtual Private Network (VPN) gateway. The SSL VPN gateway allows remote users to establish a secure VPN tunnel using a web browser. This feature provides a comprehensive solution that allows easy access to a broad range of web resources and web-enabled applications using native HTTP over SSL (HTTPS) browser support.

This document describes how a remote user, whose enterprise network is configured for SSL VPN, can access the network by launching a browser and connecting to the SSL VPN gateway. "

This means that you must install a software on the end client in order to connect to the remote/server end, which means that one of the endpoints must be a PC/user machine.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_sslvpn/configuration/15-mt/sec-conn-sslvpn-15-mt-book/sec-conn-sslvpn-remote.html here's a link to the official guide on SSL VPN.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.