VPN SITE TO SITE ON INTERNET BEHIND NATED NETWORK (Cisco Systems - alternative)

Problem:
Often we establish VPN site to site on the internet using public IPs as the tunnel source and destination, but if one of the nodes do not have public IP from the ISP?
In these cases we can use tools SSL VPN like Teamviewer, Logmein or other, but if one side we have equipment such as PLC, CCTV systems or other we must seek alternatives, for example the question below.


Scenario:
One network located behind another nated network initiates a VPN client that will establish a secure tunnel enabling bidirectional IP traffic between the sites.


Elements of this laboratory:
- Host computer capable to virtualize.
- GNS3
- - 04 routers running Cisco IOS K9 (c2691-adventerprisek9-mz.124-15.T14)
- Oracle VirtualBox
- - 03 guests


Below the configuration of each router:


main_branch router config

version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname main_branch ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication login CISCO_VPN_XAUTH local aaa authorization network CISCO_VPN_GROUP local ! ! aaa session-id common memory-size iomem 5 no ip icmp rate-limit unreachable ip cef ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! username cisco privilege 0 password 0 cisco username user privilege 0 password 0 user archive log config hidekeys ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group REMOTE_BRANCH key KEY_REMOTE_BRANCH pool POOL_REMOTE_BRANCH acl ACL_REMOTE_BRANCH save-password max-users 1 netmask 255.255.255.0 ! crypto isakmp client configuration group REMOTE_USERS key KEY_REMOTE_USERS pool POOL_REMOTE_USERS acl ACL_REMOTE_USERS save-password max-users 4 netmask 255.255.255.0 crypto isakmp profile IKE_PROFILE match identity group REMOTE_BRANCH match identity group REMOTE_USERS client authentication list CISCO_VPN_XAUTH isakmp authorization list CISCO_VPN_GROUP client configuration address respond virtual-template 1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto ipsec profile IPSec_PROFILE set transform-set ESP-3DES-SHA set isakmp-profile IKE_PROFILE ! ! ! ! ! ! ! ! interface FastEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface FastEthernet0/1 ip address 1.1.1.2 255.255.255.252 ip nat outside ip virtual-reassembly duplex auto speed auto ! interface Virtual-Template1 type tunnel ip unnumbered FastEthernet0/1 tunnel mode ipsec ipv4 tunnel protection ipsec profile IPSec_PROFILE ! ip local pool POOL_REMOTE_BRANCH 192.168.1.254 ip local pool POOL_REMOTE_USERS 192.168.1.250 192.168.1.253 ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 1.1.1.1 254 ip route 192.168.2.0 255.255.255.0 192.168.1.254 ! ! no ip http server no ip http secure-server ip dns server ip nat inside source list ACL-NAT interface FastEthernet0/1 overload ! ip access-list extended ACL-Client-Access permit ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255 permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255 ip access-list extended ACL-NAT deny ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255 permit ip 192.168.1.0 0.0.0.255 any ip access-list extended ACL_REMOTE_BRANCH permit ip 192.168.1.0 0.0.0.255 any ip access-list extended ACL_REMOTE_USERS permit ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255 permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255 ! no cdp log mismatch duplex ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 ! ! end

internet router config

version 12.4 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname internet ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip icmp rate-limit unreachable ip cef ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! archive log config hidekeys ! ! ! ! ! ! ! ! interface FastEthernet0/0 ip address 1.1.1.1 255.255.255.252 duplex auto speed auto ! interface FastEthernet0/1 ip address 2.2.2.1 255.255.255.252 duplex auto speed auto ! interface FastEthernet1/0 ip address 3.3.3.1 255.255.255.252 duplex auto speed auto ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ! no cdp log mismatch duplex ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end

front_nat_network router config

version 12.4 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname front_nat_network ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip icmp rate-limit unreachable ip cef ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! archive log config hidekeys ! ! ! ! ! ! ! ! interface FastEthernet0/0 ip address 172.16.1.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface FastEthernet0/1 ip address 2.2.2.2 255.255.255.252 ip nat outside ip virtual-reassembly duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 2.2.2.1 254 ! ! no ip http server no ip http secure-server ip nat inside source list ACL-NAT interface FastEthernet0/1 overload ! ip access-list extended ACL-NAT permit ip 172.16.1.0 0.0.0.255 any ! no cdp log mismatch duplex ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end

remote_branch router config

version 12.4 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname remote_branch ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip icmp rate-limit unreachable ip cef ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! archive log config hidekeys ! ! ! ! ! ! crypto ipsec client ezvpn MAIN_BRANCH connect auto group REMOTE_BRANCH key KEY_REMOTE_BRANCH mode client peer 1.1.1.2 virtual-interface 1 username cisco password cisco xauth userid mode local ! ! ! ! ! ! ! ! interface FastEthernet0/0 ip address 192.168.2.1 255.255.255.0 duplex auto speed auto crypto ipsec client ezvpn MAIN_BRANCH inside ! interface FastEthernet0/1 ip address 172.16.1.254 255.255.255.0 duplex auto speed auto crypto ipsec client ezvpn MAIN_BRANCH ! interface Virtual-Template1 type tunnel no ip address tunnel mode ipsec ipv4 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 172.16.1.1 254 ! ! no ip http server no ip http secure-server ! ip sla 1 icmp-echo 192.168.1.1 source-ip 192.168.2.1 timeout 1000 threshold 40 frequency 5 ip sla schedule 1 life forever start-time now no cdp log mismatch duplex ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end

remote users config