VPN between Ubuntu server (14.04.1 LTS ) AND Cisco ASA 5510

Question

I have an Ubuntu server (14.04.1 LTS ) that should connect to a Cisco ASA 5510 (Adaptive Security Appliance). I have tried - to use Racoon without any success. Not even phase 1 is successful.

The topology looks like this;

enter image description here

The Cisco ASA 5510 dictates the following settings should be used (just a policy by the owners);

Phase 1:

Authentication Method: PSK
Encryption Scheme: IKE
Diffie-Hellman Group: Group 2
Encryption Algorithm: 3DES
Hashing Algorithm: MD5
Main or Aggressive Mode: Main Mode
Lifetime (for renegotiation): 28800 seconds

Phase 2

Encapsulation (ESP or AH): ESP
Encryption Algorithm: 3DES
Authentication Algorithm: MD5
Perfect Forward Secrecy: NO PFS
Lifetime (for renegotiation): 3600
Lifesize in KB (for renegotiation): 4608000 kilobytes

I have all IP addresses, and encryption domains for both ends. In my end, it's another server where all the "important" stuff happens. This one running the VPN actually acts as my gateway.

I have already invested some days trying to use Racoon unsuccessfully. I hereby ask for your help great people. I need to know a quick install, configure and use GUI tool to help me connect to this Cisco ASA 5510 device from the Ubuntu 14.04.1 LTS server.

Any assistance will be highly appreciated.

score 7 · Accepted Answer · edited Nov 19 '14 at 02:11

I finally managed to set up the tunnel. I can now ping the host behind the Cisco ASA device. Originally, I wanted a GUI tool, but I realized the digitalocean VPS console access has a wrong mouse pointer so I kept running into problems trying to use GUI tools like vpnc in the method described here. I ended up using openswan. Here is how.

Install openswan.
```
sudo apt-get install openswan
```

Enable kernel IP packet forwarding and disable ICP redirects

echo "net.ipv4.ip_forward = 1" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.accept_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.send_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.rp_filter = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.accept_source_route = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.send_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" |  tee -a /etc/sysctl.conf

sysctl -p

Configure Openswan. The file is /etc/ipsec.conf Here's how mine ended up looking like;

config setup
        dumpdir=/var/run/pluto/
        nat_traversal=yes
virtual_private=%v4:!,%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
        oe=off
        protostack=netkey
        plutostderrlog=/var/log/openswan.log
        force_keepalive=yes
        keep_alive=60
conn myVpnConn
    authby=secret
    pfs=no
    auto=start
    keyingtries=%forever
    ikelifetime=8h
    keylife=1h
    ike=3des-md5;modp1024
    phase2alg=3des-md5
    type=tunnel
    leftsourceip=202.x.x.101    #my_local_ip aka encryption domain
    left=202.x.x.100
    aggrmode=no
    right=41.x.x.x
    rightsourceip=172.x.x.x
    dpddelay=10
    dpdtimeout=3600
    dpdaction=restart

Start ipsec/openswan

service ipsec start

That was it in a short summary.

I stumbled upon well written articles showing how to configure openswan vpn.

VPN between Ubuntu server (14.04.1 LTS ) AND Cisco ASA 5510

1 Answers1

Linked