Quantar Linking - Revision history

Bryan: /* IPSEC Remote Access Config */

2021-03-17T15:09:13Z

IPSEC Remote Access Config

Bryan: /* IPSEC Remote Access Config */

2021-03-17T15:03:34Z

IPSEC Remote Access Config

Bryan: /* IPSEC Remote Access Config */

2021-03-16T21:30:08Z

IPSEC Remote Access Config

Bryan: /* network monitoring */

2020-08-08T11:16:01Z

network monitoring

Bryan: /* Configure Postfix */

2020-08-08T11:10:30Z

Configure Postfix

Bryan: /* network monitoring */

2020-08-08T11:08:57Z

network monitoring

Bryan: /* network monitoring */

2020-08-08T07:33:37Z

network monitoring

Bryan: /* Configuring the hub */

2020-04-21T10:08:02Z

Configuring the hub

Bryan: /* Interface naming */

2020-04-21T08:56:18Z

Interface naming

Bryan: /* Network Planning */

2020-04-21T08:39:15Z

Network Planning

@@ Line 409: / Line 409: @@
 https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_esyvpn/configuration/15-sy/sec-conn-esy-15-sy-book/sec-easy-vpn-srvr.html
   ! need this for the VPN client
@@ Line 437: / Line 438: @@
    ! This is the pre shared key for the VPN
    key SEKRET-KEY-HERE
-   dns 10.2.1.1
+  ! users will use this router as a DNS server
    ! the pool of IP addresses used by the VPN
    pool VPN-POOL
@@ Line 498: / Line 500: @@
   ! define the local Pool of IP's
-  ip local pool VPN-POOL 172.31.2.0 172.31.2.15
+  ip local pool VPN-POOL 172.19.0.128 172.19.0.143
   ! put in a default null route for this subnet.  When a client connects it will be a /32
   ! and longer prefix
-  ip route 172.31.2.0 255.255.255.240 Null0 tag 69
+  ip route 172.19.0.128 255.255.255.240 Null0 tag 69
   ! this next part will prevent an OSPF LSA going out every time a user connects.  Normally
@@ Line 509: / Line 511: @@
   router ospf 1
    ! make a summary address for this
-   summary-address 172.31.2.0 255.255.255.240
+   summary-address 172.19.0.128 255.255.255.240
    ! and if it matches tag 69, redistribuite it.
    redistribute static subnets tag 69

← Older revision		Revision as of 15:03, 17 March 2021
Line 406:		Line 406:

	This will give you remote access to the server for remote access using a PSK and XAUTH		This will give you remote access to the server for remote access using a PSK and XAUTH
		+
		+	https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_esyvpn/configuration/15-sy/sec-conn-esy-15-sy-book/sec-easy-vpn-srvr.html
		+
		+
		+	! need this for the VPN client
		+	aaa authentication login vpnclient local
		+	aaa authorization network localgroups local
		+
		+	! need a username
		+	username bryan privilege 5 secret changeme
		+
		+	crypto logging session
		+	crypto logging session
		+	!
		+	crypto logging ezvpn group VPN
		+	!
		+	! define the isakmp policy priority
		+	crypto isakmp policy 10
		+	authentication pre-share
		+	group 2
		+	lifetime 3600
		+	!
		+	crypto isakmp policy 200
		+	authentication pre-share
		+	lifetime 3600
		+
		+	! This is a setup of the ISAKMP Config group, it will be referred to in the ISAKMP
		+	! profile VPN-DIALER-USERS This is the group ID for the pre shared key.
		+	crypto isakmp client configuration group VPN-DIALER-GROUP
		+	! This is the pre shared key for the VPN
		+	key SEKRET-KEY-HERE
		+	dns 10.2.1.1
		+	! the pool of IP addresses used by the VPN
		+	pool VPN-POOL
		+	! access list to split traffic locally, this will allow on listed subnets to go into
		+	! the VPN. Remove this if you want all traffic to go via the VPN
		+	acl VPN-DIALER-SPLIT
		+	! allow the client to access it's local lan segment when connected to the VPN
		+	include-local-lan
		+	! banner to display at login on the client (optional)
		+	banner ^C
		+	Quantar Link User Access
		+	Licensed users only
		+
		+	This is HUB1
		+	All access is logged.
		+	This is a private system.
		+	Disconnect _NOW_, you are not welcome here
		+	^C
		+
		+	! this setups a Phase 1 ISAKMP profile of VPN-DIALER-USERS
		+	crypto isakmp profile VPN-DIALER-USERS
		+	! This ties it back to the VPN-DIALER-GROUP and
		+	match identity group VPN-DIALER-GROUP
		+	!these next two tie it to the AAA configured for auth
		+	client authentication list vpnclient
		+	isakmp authorization list localgroups
		+	! this makes the server listen, not initiate
		+	client configuration address respond
		+	! the isakmp client configuration group that this profile uses
		+	client configuration group VPN-DIALER-GROUP
		+	! finally the virtual template interface that will be used to make a virtual-access
		+	! interface when the user connects
		+	virtual-template 199
		+	!
		+	!
		+	! this is the IPSEC hash and algo used and is referred to in the ipsec profile
		+	crypto ipsec transform-set VPN-DIALER-TRANSFORM-SET esp-aes esp-sha-hmac
		+	!
		+	! This ipsec profile is referenced in the Virtual template 199 to specify which hash
		+	! and algo will be permitted. You can define multiple transform-sets
		+	crypto ipsec profile VPN-DIALER-PROFILE
		+	set transform-set VPN-DIALER-TRANSFORM-SET
		+	!
		+	! This is the virtual template that will be cloned into a virtual-access tunnel when a
		+	! Client Connects. This makes the client in their own tunnel interface.
		+	interface Virtual-Template199 type tunnel
		+	description VPN-DIALER-USERS
		+	! this borrows the loopback 0 IP for the router side of the tunnel.
		+	ip unnumbered Loopback0
		+	! cut the MTU
		+	ip mtu 1400
		+	! turn on NAT (optional)
		+	ip nat inside
		+	ip virtual-reassembly in
		+	! this will adjust the IPv4 tcp MSS to avoid MTU issues
		+	ip tcp adjust-mss 1200
		+	tunnel mode ipsec ipv4
		+	! tie the tunnel config back to a crypto ipsec profile
		+	tunnel protection ipsec profile VPN-DIALER-PROFILE
		+
		+	! define the local Pool of IP's
		+	ip local pool VPN-POOL 172.31.2.0 172.31.2.15
		+
		+	! put in a default null route for this subnet. When a client connects it will be a /32
		+	! and longer prefix
		+	ip route 172.31.2.0 255.255.255.240 Null0 tag 69
		+
		+	! this next part will prevent an OSPF LSA going out every time a user connects. Normally
		+	! when the user connects they would have a /32 route and it woould be announced to all
		+	! routers in OSPF.
		+	router ospf 1
		+	! make a summary address for this
		+	summary-address 172.31.2.0 255.255.255.240
		+	! and if it matches tag 69, redistribuite it.
		+	redistribute static subnets tag 69
		+
		+
		+	! this is the IP space allowed in the tunnel for split routing.
		+	ip access-list extended VPN-DIALER-SPLIT
		+	permit ip 10.0.0.0 0.255.255.255 any
		+	permit ip 172.16.0.0 0.15.255.255 any

	=== DNS Config ===		=== DNS Config ===

← Older revision		Revision as of 21:30, 16 March 2021
Line 404:		Line 404:

	=== IPSEC Remote Access Config ===		=== IPSEC Remote Access Config ===
		+
		+	This will give you remote access to the server for remote access using a PSK and XAUTH

	=== DNS Config ===		=== DNS Config ===

← Older revision		Revision as of 11:16, 8 August 2020
Line 256:		Line 256:
	vim /etc/php/7.3/fpm/pool.d/librenms.conf		vim /etc/php/7.3/fpm/pool.d/librenms.conf

		+
		+	==== config Rancid ====
		+	sudo apt-get install rancid subversion
		+	https://docs.librenms.org/Extensions/Rancid/

@@ Line 198: / Line 198: @@
 <code>apt-get install postfix mailutils</code>
-This will run an installer with a curses interface and you must select '''Satallite System'''.  Check the '''System mail''' name is the hostname of the server, and the '''SMTP relay host''' is ''morty.keekles.org''. '''Root and postmaster mail''' should be ''rootmail@allstarlink.org''.
+This will run an installer with a curses interface and you must select '''Satallite System'''.  Check the '''System mail''' name is the hostname of the server, and the '''SMTP relay host''' is ''morty.keekles.org''. '''Root and postmaster mail''' should be ''me@myemail.com''.
 Should you need to reconfigure this use:
@@ Line 205: / Line 205: @@
 other aliases are setup in /etc/aliases.  You must run ''newaliases'' after this is updated for them to take effect.
 === Setup LibreNMS ===

← Older revision		Revision as of 11:08, 8 August 2020
Line 191:		Line 191:

	sudo timedatectl set-timezone UTC		sudo timedatectl set-timezone UTC
		+
		+	=== Configure Postfix ===
		+
		+	Postfix is installed to forward mail for root to a smtp host.
		+
		+	<code>apt-get install postfix mailutils</code>
		+
		+	This will run an installer with a curses interface and you must select '''Satallite System'''. Check the '''System mail''' name is the hostname of the server, and the '''SMTP relay host''' is ''morty.keekles.org''. '''Root and postmaster mail''' should be ''rootmail@allstarlink.org''.
		+
		+	Should you need to reconfigure this use:
		+
		+	<code> dpkg-reconfigure postfix </code>
		+
		+	other aliases are setup in /etc/aliases. You must run ''newaliases'' after this is updated for them to take effect.
		+
		+

	=== Setup LibreNMS ===		=== Setup LibreNMS ===

@@ Line 168: / Line 168: @@
 == network monitoring ==
-A server with LibreNMS or Observium
+=== RPI4 4gb ===
 SNMP

@@ Line 222: / Line 222: @@
 * Loopback 0
+  interface Loopback0
 * Gi0/0
+  interface GigabitEthernet0/0
 === DMVPN config ===
 * Tunnel 0
+  interface Tunnel0
 === Routing Config ===
@@ Line 299: / Line 348: @@
 * SNMP
 * rancid
 == Configuring a client ==

← Older revision		Revision as of 08:56, 21 April 2020
Line 142:		Line 142:

	== Interface naming ==		== Interface naming ==
		+	It's very helpful to have an interface name on each interface on the router. These should be in ALL CAPS and follow a description pattern.
		+
		+	Any IP address should be in DNS and reverse DNS.
		+
		+	Description "<circuit-ID> <source host>-<src cross connect> to <destination host>-<dest port>-<dest cross connect>"
		+
		+	Examples:
		+	interface serial 1/0
		+	description "HUB-ATAC-pt1 to TPA-s0/0/0-Quantar-KP1UG-pt1"
		+	Meaning Hub connected to S1 going to Tampa s0/0/0 and connecting to Quantar KP1UG Port 1
		+
		+	interface Tunnel0
		+	description "HUB DMVPN Multipoint"
		+	Hub router multipoint interface for DMVPN
		+
		+	interface GigabitEthernet0/0
		+	description "HUB to upstream ISP <CIRCUIT ID>

	== DNS ==		== DNS ==

@@ Line 97: / Line 97: @@
 | 4/1/0 || s1/15 || 16 || PIE || 2600 || 2601 || 160 || Yellow/Blue
 |}
 == circuits over this ==
@@ Line 115: / Line 155: @@
 SNMP
 SSH for management
 = Hardware for linking =