Abi Rendon - Sysadmin

VPN Tunnel Between Cisco ASA and Juniper SSG Firewalls

Abi Rendon — Tue, 03 Nov 2009 20:03:42 +0000

Recently at work I was tasked with configuring a VPN tunnel between Cisco ASA 5505 to a Juniper SSG 320M. After hearing that it wasn’t compatible from many sources including our partners I just could not believe that this was the case, ipsec tunnels are a standard protocol and both Juniper and Cisco should be compatible with ipsec.

After a day of google searches and troubleshooting I couldn’t find a proper solution that was easy and explained properly for my type of standard setup. Here is how I configured an ipsec VPN tunnel between the SSG and ASA.

Cisco ASA 5505

IP: 1.1.1.1
Network: 192.168.1.0/24

Juniper SSG 320M

IP: 2.2.2.2
Network: 192.168.2.0/24

192.168.1.0/24 < -> 1.1.1.1 < --VPN Tunnel--> 2.2.2.2 < -> 192.168.2.0/24

Here is the actual configuration including all the access list to allow all traffic through, you will probably want to lock this down as it will allow all traffic through.

Cisco ASA 5505 Configuration

object-group network local_cisco_network
network-object 192.168.1.0 255.255.255.0
object-group network remote_juniper_network
network-object 192.168.2.0 255.255.255.0

access-list ciscovpn_nat_junipervpn extended permit ip object-group local_cisco_network object-group remote_juniper_network
access-list ciscovpn_nat_junipervpn extended permit ip object-group remote_juniper_network object-group local_cisco_network

access-list ciscotojuniper_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

crypto map outside_map 1 match address ciscotojuniper_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 2.2.2.2
crypto map outside_map 1 set transform-set ESP-3DES-SHA

tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key

Juniper SSG 320M Configuration

set address “Trust” “192.168.2.0/24″ 10.248.1.0 255.255.255.0
set address “Untrust” “192.168.1.0/24″ 10.0.10.0 255.255.255.0

set ike gateway “1.1.1.1″ address 1.1.1.1 Main outgoing-interface “ethernet0/1″ preshare “” proposal “pre-g2-3des-sha”

set vpn “1.1.1.1″ gateway “1.1.1.1″ no-replay tunnel idletime 0 proposal “g2-esp-3des-sha”
set policy id 2 name “1.1.1.1″ from “Trust” to “Untrust” “192.168.2.0/24″ “192.168.1.0/24″ “ANY” tunnel vpn “1.1.1.1″ id 0xa pair-policy 1
set policy id 2
exit
set policy id 1 name “1.1.1.1″ from “Untrust” to “Trust” “192.168.1.0/24″ “192.168.2.0/24″ “ANY” tunnel vpn “1.1.1.1″ id 0xa pair-policy 2
set policy id 1
exit

This configuration will allow traffic from 192.168.1.0/24 to 192.168.2.0/24 and vice versa. On the Juniper side the name of the vpn and gateway I think are important otherwise the Phase 1 negotiation will not work. If I’ve missed something or if you don’t understand something please let me know.

I will probably need to configure this against a Cisco router in the near future so stay tuned for an update for the cisco side.

Science Vs Religion

Abi Rendon — Wed, 10 Jun 2009 06:51:46 +0000

The conflict between religion and science astounds me. The philosophical basis of nearly all popular religions stress the importance of humility. Is there a more humble institution than science? Its foundation stands on the idea that you must give up your preconceptions in the face of evidence to the contrary, no matter how much you may be comfortable in your ways. This idea doesn’t only apply to things like the elemental composition of the corona of distant stars, it goes for anything a thinking creature observes in its environment if it wants to do anything more than eat and fuck and swing from trees.

The power to collectively observe and document our world is an incredible gift, and is responsible for everything humanity has created, from the worldwide computer network with which you read this, to the actual written word language in which this opinion is expressed.

To deny science is to deny that which makes you human.

Quote from forum user the_ruiner of somethingawful.com

Install OSX on Dell Mini 9

Abi Rendon — Fri, 17 Apr 2009 08:12:50 +0000

With help from MyDellMini.com I’ve installed OS X on my new Dell Mini 9 netbook.

Here’s a few pics from the install.

CrapHost Logo

Abi Rendon — Thu, 02 Apr 2009 17:40:59 +0000

Just testing out a logo for my craphost.com design, this will essentially be a clustered fault tolerant scalable hosting system that I’ve been working on for quite some time. Starting out with craphost.com for beta testing and trying out pricing models and will start up professional services with more features and uptime guarantees as I work out the kinks.

Current Mood: sleepy

Adam Carolla Podcast!

Abi Rendon — Mon, 23 Feb 2009 14:58:34 +0000

Now that The Adam Carolla Show is off the air he’s moved over to a podcast format, listen to him now!

http://carollaradio.com/2009/02/23/acp-20090223/

Check him out, uncensored and unedited.

iPhone Blog Test

Abi Rendon — Fri, 20 Feb 2009 00:24:13 +0000

I’m just testing the wordpress plugin for the iPhone. So far it looks like it’s pretty good. I’m still looking for new iPhone apps too.

New URL and Design

Abi Rendon — Thu, 19 Feb 2009 23:12:09 +0000

As some might have noticed, I’ve recently updated my domain to abirendon.com and I’ve also applied a new wordpress theme, just made a few tweaks but it all seems to be working splendidly and it looks good.

I’ll be posting some guides on setting up and configuring VMWare ESXi, converting VMWare Server VMs to ESXi format, configuring a raid 5 array on an MSA20 via linux command line and hopefully some more interesting pictures.

I’ve also just bought an iphone so I’ll probably be messing around with doing updates on the go.

Current Mood: good

Snowpocalypse Lynnwood ‘08

Abi Rendon — Tue, 23 Dec 2008 07:21:24 +0000

After many warnings and fears there was in fact many a snow fall in the greater Seattle area… I’ve documented my neighborhood and what has come to pass…

Outside my living room window

Cat prints

Trees

Parking Lot

Path I walk to the bus every morning

Main Road West (my bus stop across the road there)

Main Road East

Road to my apartment complex

Same road

A couple squirrels ran by

An icicle

Here’s a quick video I took

Shortly after the video one of those birds shit on my head, luckily I wasn’t too far from my apartment so I just went home and showered.

Current Mood: pleased

New Hardware for WTFServe

Abi Rendon — Thu, 20 Nov 2008 07:26:00 +0000

Today was a busy day, at Airbiquity we went live with the Ford Sync Project, but before that I did some work for my own project.

We installed some new hardware, this includes 2 new VM servers and a storage array as well as networking equipment.

The List:

HP Procurve 2626 – 24 port 10/100 Switch
HP Procurve 6108 – 8 port 10/100/1000 Switch
HP DL360, Dual 3.0Ghz Xeon, 8GB RAM, 2 72GB 10K SCSI (in RAID1)
HP DL360, Dual 3.0Ghz Xeon, 8GB RAM, 2 72GB 10K SCSI (in RAID1)
HP MSA20 Storage Array, 3 1TB Drives in RAID 5

And I took pictures and video during the install…

http://dl.getdropbox.com/u/49757/wtfserve/MOV00342.MPG
http://dl.getdropbox.com/u/49757/wtfserve/MOV00350.MPG

Current Mood: cheerful

I am voting for…

Abi Rendon — Fri, 31 Oct 2008 05:33:07 +0000

Nobody!

If you’re an American of the United States variety you may have noticed there’s an election going on, and on, and on, and on. It’s been a long standing tradition amongst our culture in this great nation to stretch out events as long as possible, if you’re not picking out presents in August you might as well end it all now because god knows your grandchildren need new socks at the ready for that special day oh so many months away.

It seems like it’s been 2 years since this Election’s campaigns started, some might even say they’ve been going on for longer, speculation of Hilary Clinton running for office was going on since before the 2000 election. I ask you though, why? Why is there this need for us to constantly be waiting for an event that ultimately means nothing?

You might be shaking your head, asking “What’s with this guy? Of course it means something, it means everything!” But does it really? When was the last time you were directly affected by a new president? You might be saying “My brother is in a foreign country because of war!” or “I’m in the poor house because our president ruined the economy!”. Well I have a secret for you, economic turns and wars happen regardless of who is in office!

We had a VERY prosperous 10 years or so during the Clinton era, what else happened during that time? The dot com boom, and what happened around 9/11? The dot com bubble burst! Several new jobs were created and just as quickly several jobs were just as quickly dissipated. Same with wars and threats, we have Vietnam, Iraq v1, Kosovo, Cuban missle crisis hell every little skirmish in the middle east ties up our military for decades. Do you think it really makes that much of a difference who is in office?

I grew up in Arizona and McCain has always been great he’s changed in his political views a lot during this campaign. Obama is a great charismatic person who has a lot of views that fall in line with my own, but how can we really know who he is? In the end what is the difference between the candidates? Race? Age? Tax plans that have a history of not being enacted and even so are different by mere fractions? It’s always going to be the same, the rich people will always be taxed more, the poor people will always want more social services.

Nothing will change and we will always progress regardless of who’s in theoretical charge. I say we vote, vote for apathy, don’t vote at all who cares in the end anyway? If you decide to vote anyway, vote for progress, progress for progress sake is better than doing nothing regardless of the outcome.

edit: Vote Stephen Baldwin

Current Mood: apathetic