CloudBridge® Connector

• NetScaler appliance NS_Appliance-1 in a datacenter designated as Datacenter-1
• Cisco IOS device Cisco-IOS-Device-1 in a datacenter designated as Datacenter-2

• The following IPSec settings are supported for a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco IOS device.
  |IPSec Properties|Setting| |--|--| |IPSec mode|Tunnel mode| |IKE version|Version 1| |IKE DH group| DH group 2 (1024 bits MODP algorithm)| |IKE authentication method|Pre-Shared Key| |IKE encryption algorithm|AES, 3DES| |IKE hash algorithm|HMAC SHA1, HMAC SHA256, HMAC SHA384, HMAC SHA512, HMAC MD5| |ESP encryption algorithm|AES, 3DES| |ESP hash algorithm|HMAC SHA1, HMAC SHA256, HMAC SHA256, HMAC SHA256, HMAC MD5|
• You must specify the same IPSec settings on the NetScaler appliance and the Cisco IOS device at the two ends of the CloudBridge Connector.
• NetScaler provides a common parameter (in IPSec profiles) for specifying an IKE hash algorithm and an ESP hash algorithm. It also provides another, and a common parameter for specifying an IKE encryption algorithm and an ESP encryption algorithm. Therefore on the Cisco device, you must specify the same hash algorithm and same encryption algorithm for IKE (while creating IKE policy) and ESP (while creating IPSec transform set).
• You must configure the firewall at the NetScaler end and Cisco device end to allow the following.
  • Any UDP packets for port 500
  • Any UDP packets for port 4500
  • Any ESP (IP protocol number 50) packets

• You have a user account with administrator credentials on the Cisco IOS device.
• You are familiar with the Cisco IOS command line interface.
• The Cisco IOS device is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.

• Create an IKE Policy.
• Configure a Pre-shared key for IKE authentication.
• Define a transform set and configure IPSec in tunnel mode.
• Create a crypto access List
• Create a crypto map
• Apply the crypto Map to an interface

• Create an IPSec profile.
• Create an IP tunnel that uses IPSec protocol, and associate the IPSec profile with it.
• Create a PBR rule and associate it with the IP tunnel.

• add ipsec profile <name> -psk <string> -ikeVersion v1
• show ipsec profile <name>

• add ipTunnel <name> <remote> <remoteSubnetMask> <local> -protocol IPSEC –ipsecProfileName <string>
• add ipTunnel <name>

• add pbr <pbrName> ALLOW –srcIP <subnet-range> -destIP <subnet-range> -ipTunnel <tunnelName>
• apply pbrs
• show pbrs <pbrName>

    >  add ipsec profile NS_Cisco_IPSec_Profile -psk  examplepresharedkey -ikeVersion v1 –lifetime 315360 –encAlgo 3DES
    Done
    >  add iptunnel NS_Cisco_Tunnel 203.0.113.200 255.255.255.255 198.51.100.100 –protocol IPSEC –ipsecProfileName NS_Cisco_IPSec_Profile  

    Done
    > add pbr NS_Cisco_Pbr -srcIP 10.102.147.0-10.102.147.255 –destIP 10.20.0.0-10.20.255.255 –ipTunnel NS_Cisco_Tunnel  

    Done
    > apply pbrs

    Done

1. Navigate to System > CloudBridge Connector > IPSec Profile.
2. In the details pane, click Add.
3. In the Add IPSec Profile dialog box, set the following parameters:
   • Name
   • Encryption Algorithm
   • Hash Algorithm
   • IKE Protocol Version
4. Configure the IPSec authentication method to be used by the two CloudBridge Connector tunnel peers to mutually authenticate: Select the Pre-shared key authentication method and set the Pre-Shared Key Exists parameter.
5. Click Create, and then click Close.

1. Navigate to System > CloudBridge Connector > IP Tunnels.
2. On the IPv4 Tunnels tab, click Add.
3. In the Add IP Tunnel dialog box, set the following parameters:
   • Name
   • Remote IP
   • Remote Mask
   • Local IP Type (In the Local IP Type drop down list, select Subnet IP).
   • Local IP (All the configured IPs of the selected IP type are in the Local IP drop down list. Select the desired IP from the list.)
   • Protocol
   • IPSec Profile
4. Click Create, and then click Close.

1. Navigate to System > Network > PBR.
2. On the PBR tab, click Add.
3. In the Create PBR dialog box, set the following parameters:
   • Name
   • Action
   • Next Hop Type (Select IP Tunnel)
   • IP Tunnel Name
   • Source IP Low
   • Source IP High
   • Destination IP Low
   • Destination IP High
4. Click Create, and then click Close.

1. Navigate to System > Network > PBRs.
2. On the PBRs tab, select the PBR, in the Action list, select Apply.