Site-to-Site VPN Problem with Cisco 837's and Watchguard Firewalls: watchguard, x700, cisco

by: td_milesPosted on 2004-07-08 at 22:36:31ID: 11509117

you should create the site-to-site VPN between the two watchguard boxes, not the two 837's. This would be a much easier way to do it, is there any reason not to ?

by: zhoffmanPosted on 2004-07-09 at 04:29:14ID: 11510469

Well, I actually already had setup the VPN before between the two Watchguards, and yes it was easier, but I need to have some sort of QoS (like priority queueing) for the VoIP traffic. Otherwise, the VoIP traffic will be stomped on and compromise the quality of the call.

If I could setup the VPN between the two Watchguards and still be able to have my QoS, I would be elated. But as it stands, if I have the VPN on the Watchguards, then setting up the QoS on the router does no good since it would just be seeing the encrypted VPN traffic and not the actual packets thus unable to provide QoS.

Please let me know if you have any other ideas, thanks!

by: td_milesPosted on 2004-07-09 at 16:23:31ID: 11516669

I'm assuming that your wacthguards are set up to do NAT, what you need to do is:

1. exempt the traffic between the two LAN from NAT and permit it through on your watchguards.
2. setup the watchguards to ROUTE the traffic to the 837.
3. setup the 837's to route the traffic back to the watchguards

looking at 2 & 3 in detail, the watchguards probably already have a default route that sends everything to the 837, correct ? The cisco routers will need to have a route added that says:

ip route 192.168.10.0 255.255.255.0 <outside_ip_of_watchguard>
(obviously you need to put the correct subnets & IP addresses of the watchguards on each end).

This should mean that when a PC on LAN1 goes to send traffic to a PC on LAN2, it sends the traffic to watchguard1 (as the default gateway for the PC). Watchguard1 then DOESN'T NAT it and sends it on to router1. Router1 encrypts it and sends it over IPSec tunnel to router2. Router2 decrypts and then forwards traffic to watchguard2. Watchguard2 routers the traffic to LAN2.

You'll be increasing the potential security problems. One thing to make sure of is that you DENY any traffic coming or going from the WAN interface of the 837's that is from your private subnets. You don't want unencrypted traffic leaking out and as you are routing the private traffic to your watchguards and they are permitting it through, you don't want bogus traffic coming in.

This should allow you to do what you need with the traffic at the 837's. Given that the traffic will be travelling over the Internet, I'm not sure now effective you're queueing will be, but I guess every little bit helps.

by: tim_holmanPosted on 2004-07-11 at 10:43:50ID: 11524068

If both ends are behind NAT, then make sure TCP port 4500 is allowed through the firewall, and NAT-T (NAT traversal) enabled on both peers.

As for the QoS idea, why not put the router directly behind each Watchguard, and ensure VoIP traffic gets marked up ? Then make sure the VoIP rule on the Watchguard is right at the top of the rulebase, so gets processed first ?

by: zhoffmanPosted on 2004-07-14 at 13:03:50ID: 11553157

td_miles,

Thanks for your help.

I basically did what you said. I got the VPN setup between the two 837's first with tunnel pointed to the two public sides of the routers. Then the access list pointed at the two different private LAN's. I then added the route which pointed all of the LAN traffic from the router to the external (public IP) of the Watchguard. I exempted the LAN to LAN traffic from being NAT'ed at the Watchguard and made sure all the appropriate ports were open on the firewall to allow for just the traffic (VoIP and Windows SMB) to flow through.

Below is the final config from the router for anyone in the future who may want to see it. The Watchguard config stuff is exactly was recommended by td_miles above. Thanks again, man!

Current configuration : 2998 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname corp-rtr
!
logging queue-limit 100
no logging buffered
no logging console
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
username xxxxxxx password 7 xxxxxxxxxxx
username xxxxxxx privilege 15 password 7 xxxxxxxxxxxxxx
ip subnet-zero
no ip domain lookup
ip name-server 156.xxx.xxx.11
ip name-server 156.xxx.xxx.13
!
!
ip audit notify log
ip audit po max-events 100
vpdn enable
!
vpdn-group pppoe
request-dialin
protocol pppoe
!
no ftp-server write-enable
!
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key 0 xxxxxxx address 161.xxx.xxx.33
crypto isakmp key 0 xxxxxxx address 161.xxx.xxx.121
crypto isakmp keepalive 10
!
!
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_2 esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to 161.xxx.xxx.33
set peer 161.xxx.xxx.33
set transform-set SDM_TRANSFORMSET_1
match address 102
crypto map SDM_CMAP_1 2 ipsec-isakmp
description Tunnel to 161.xxx.xxx.121
set peer 161.xxx.xxx.121
set transform-set SDM_TRANSFORMSET_2
match address 103
!
!
!
!
interface Ethernet0
description $ETH-LAN$
ip address 161.xxx.xxx.41 255.255.255.248
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
hold-queue 224 in
!
interface ATM0.1 point-to-point
pvc 0/35
pppoe-client dial-pool-number 1
!
!
interface Dialer1
ip unnumbered Ethernet0
ip mtu 1492
encapsulation ppp
no ip route-cache
ip tcp adjust-mss 1452
no ip mroute-cache
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp pap sent-username xxxxxxxxxxxxx password 7 xxxxxxxxxxxxxx
crypto map SDM_CMAP_1
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.10.0 255.255.255.0 161.xxx.xxx.42
ip http server
ip http authentication local
ip http secure-server
!
access-list 100 remark SDM_ACL Category=18
access-list 100 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 103 remark SDM_ACL Category=4
access-list 103 remark IPSec Rule
access-list 103 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
dialer-list 1 protocol ip permit
priority-list 1 protocol ip high udp 1718
priority-list 1 protocol ip high udp 1719
priority-list 1 protocol ip high tcp 1720
priority-list 1 protocol ip high tcp 10032
!
line con 0
exec-timeout 120 0
no modem enable
stopbits 1
line aux 0
stopbits 1
line vty 0 4
exec-timeout 120 0
privilege level 15
login local
length 0
transport input telnet ssh
!
scheduler max-task-time 5000
!
end

Question

Site-to-Site VPN Problem with Cisco 837's and Watchguard Firewalls

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

watchguard

x700

cisco

Virtual Private Networking (VPN)

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press