SITE TO SITE IPSEC VPN CONFIGURATION

Let's  start

SITE - TO -SITE IPSEC VPN CONFIGURATION

INTERFACES STATUS
=========================

R1#sh int des | i up
Fa0                            up             up       LAN
Se0                            up             up       WAN
R1#sh ip int brief | i up
FastEthernet0              10.0.0.1        YES NVRAM  up                    up
Serial0                    12.0.0.1        YES NVRAM  up                    up

R2#sh int des | i up
Fa0                            up             up       LAN
Se0                            up             up       WAN
R2#sh ip int brief | i up
FastEthernet0              20.0.0.1        YES NVRAM  up                    up
Serial0                    12.0.0.2        YES NVRAM  up                    up

ABLE TO PING FROM PC1 TO PC2 & VICEVERSA
=========================================
PC1> ping 20.0.0.100
84 bytes from 20.0.0.100 icmp_seq=1 ttl=62 time=36.002 ms
84 bytes from 20.0.0.100 icmp_seq=2 ttl=62 time=58.003 ms
84 bytes from 20.0.0.100 icmp_seq=3 ttl=62 time=43.003 ms
84 bytes from 20.0.0.100 icmp_seq=4 ttl=62 time=43.003 ms
84 bytes from 20.0.0.100 icmp_seq=5 ttl=62 time=44.002 ms

PC2> ping 10.0.0.100
84 bytes from 10.0.0.100 icmp_seq=1 ttl=62 time=54.003 ms
84 bytes from 10.0.0.100 icmp_seq=2 ttl=62 time=53.003 ms
84 bytes from 10.0.0.100 icmp_seq=3 ttl=62 time=42.002 ms
84 bytes from 10.0.0.100 icmp_seq=4 ttl=62 time=38.002 ms
84 bytes from 10.0.0.100 icmp_seq=5 ttl=62 time=40.002 ms

Step 1:-  Create ACL to define Interesting Traffic.
Step 2:- Define parameters for IKE Phase1 Tunnel (ISAKMP Tunnel)
      a) Enable Crypto ISAKMP
      b) Configure HAGLE PARAMTERS
      c) Set peer & key
Step 3:- Define parameters for IKE Phase2 Tunnel (IPSec Tunnel)
Step 4 :- Create Crypto map and apply to the appropriate interface.

**** every command begins with crypto ****

STEP 1  - Create ACL to define "Interesting" Traffic
=====================================================

R1(config)#access-list 100 permit ip 10.0.0.0 0.0.0.255 20.0.0.0 0.0.0.255
R2(config)#access-list 100 permit ip 20.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255

note :- we can acls with different acl numbers on both the vpn devices.

STEP 2 - Define parameters for IKE Phase 1 Tunnel (ISAKMP Tunnel)
==================================================================
a) Enable Crypto ISAKMP
==================================================================
R1#sh crypto isakmp policy
ISAKMP is turned off
R2#sh crypto isakmp policy
ISAKMP is turned off

R1(config)#crypto isakmp enable
Mar 13 02:24:38.171: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1#sh cry isakmp policy

Global IKE policy
Default protection suite
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume limit


NOTE :- By default there is one IKE PHASE 1 ISAKMP Policy present.

R2(config)#crypto isakmp enable
Mar 13 02:26:44.519: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON

b) Configure HAGLE PARAMTERS
==================================================================
R1(config)#crypto isakmp policy 10
R1(config-isakmp)#hash sha
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#group 5
R1(config-isakmp)#encryption aes
R1(config-isakmp)#^Z

R1#sh crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume limit

R2(config)#crypto isakmp policy 10
R2(config-isakmp)#hash sha
R2(config-isakmp)#authentication pre-share
R2(config-isakmp)#group 5
R2(config-isakmp)#encryption aes
R2(config-isakmp)#^Z

R2#sh crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume limit

c) Set peer & key
==================================================================
R1(config)#crypto isakmp key ?
  0  Specifies an UNENCRYPTED password will follow
  6  Specifies an ENCRYPTED password will follow
  note - both the keys will go encrypted over public network ...it is how the key will be locally

R1(config)#crypto isakmp key 0 cisco123 address 12.0.0.2
R1#sh crypto isakmp key
Keyring               Hostname/Address                   Preshared Key

default               12.0.0.2                           cisco123

R2(config)#crypto isakmp key 0 cisco123 address 12.0.0.1

R2#sh crypto isakmp key
Keyring               Hostname/Address                   Preshared Key

default               12.0.0.1                           cisco123
R2#

====================================================================================================================================
Step 3:- Define parameters for IKE Phase2 Tunnel (IPSec Tunnel)
==================================================================

R1(config)#crypto ipsec transform-set AMARTECH esp-aes 128 esp-md5-hmac
R1(cfg-crypto-trans)#^Z
R1#sh crypto ipsec transform-set
Transform set AMARTECH: { esp-aes esp-md5-hmac  }
   will negotiate = { Tunnel,  },
R2(config)#crypto ipsec transform-set AMARTECH esp-aes 128 esp-md5-hmac
R2(cfg-crypto-trans)#^Z
R2#
R2#config
Mar 13 03:07:38.415: %SYS-5-CONFIG_I: Configured from console by console
R2#sh crypto ipsec transform-set
Transform set AMARTECH: { esp-aes esp-md5-hmac  }
   will negotiate = { Tunnel,  },

====================================================================
Step 4 :- Create Crypto map and apply to the appropriate interface.
====================================================================

R1(config)#crypto map TECHMAP 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R1(config-crypto-map)#set peer 12.0.0.2
R1(config-crypto-map)#match address 100
R1(config-crypto-map)#set transform-set AMARTECH
R1(config-crypto-map)#^Z


R2(config)#crypto map TECHMAP 10 IPsec-ISakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
R2(config-crypto-map)#set peer 12.0.0.1
R2(config-crypto-map)#match address 100
R2(config-crypto-map)#set transform-set AMARTECH
R2(config-crypto-map)#^Z

R1#sh crypto map
Crypto Map "TECHMAP" 10 ipsec-isakmp
        Peer = 12.0.0.2
        Extended IP access list 100
            access-list 100 permit ip 10.0.0.0 0.0.0.255 20.0.0.0 0.0.0.255
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                AMARTECH,
        }
        Interfaces using crypto map TECHMAP:

R2#sh crypto ma
Crypto Map "TECHMAP" 10 ipsec-isakmp
        Peer = 12.0.0.1
        Extended IP access list 100
            access-list 100 permit ip 20.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                AMARTECH,
        }
        Interfaces using crypto map TECHMAP:

R1(config)#int s0
R1(config-if)#crypto map TECHMAP
R1(config-if)#^Z
R1#

R1#sh crypto map
Crypto Map "TECHMAP" 10 ipsec-isakmp
        Peer = 12.0.0.2
        Extended IP access list 100
            access-list 100 permit ip 10.0.0.0 0.0.0.255 20.0.0.0 0.0.0.255
        Current peer: 12.0.0.2
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                AMARTECH,
        }
        Interfaces using crypto map TECHMAP:
                Serial0

R2(config)#int s0
R2(config-if)#cry
R2(config-if)#crypto map TECHMAP
R2(config-if)#^Z
R2#sh crypto map
Crypto Map "TECHMAP" 10 ipsec-isakmp
        Peer = 12.0.0.1
        Extended IP access list 100
            access-list 100 permit ip 20.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255
        Current peer: 12.0.0.1
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                AMARTECH,
        }
        Interfaces using crypto map TECHMAP:
                Serial0

========================================================================

R1#sh cry isakmp sa
dst             src             state          conn-id slot status

R1#sh cry ipsec
R1#sh cry ipsec sa

interface: Serial0
    Crypto map tag: TECHMAP, local addr 12.0.0.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (20.0.0.0/255.255.255.0/0/0)
   current_peer 12.0.0.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 12.0.0.1, remote crypto endpt.: 12.0.0.2
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0
     current outbound spi: 0x0(0)

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:

======================================================================================================

R1#sh cry isakmp sa
dst             src             state          conn-id slot status
12.0.0.2        12.0.0.1        QM_IDLE              1    0 ACTIVE

R2#sh cry isakmp sa
dst             src             state          conn-id slot status
12.0.0.2        12.0.0.1        QM_IDLE              1    0 ACTIVE


R1#sh cry ipsec sa

interface: Serial0
    Crypto map tag: TECHMAP, local addr 12.0.0.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (20.0.0.0/255.255.255.0/0/0)
   current_peer 12.0.0.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 21, #pkts encrypt: 21, #pkts digest: 21
    #pkts decaps: 21, #pkts decrypt: 21, #pkts verify: 21
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 0

     local crypto endpt.: 12.0.0.1, remote crypto endpt.: 12.0.0.2
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0
     current outbound spi: 0xA9BA9F1(177973745)

     inbound esp sas:
      spi: 0x3637026C(909574764)
        transform: esp-aes esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2002, flow_id: SW:2, crypto map: TECHMAP
        sa timing: remaining key lifetime (k/sec): (4525445/3524)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xA9BA9F1(177973745)
        transform: esp-aes esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2001, flow_id: SW:1, crypto map: TECHMAP
        sa timing: remaining key lifetime (k/sec): (4525445/3522)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

R2#sh crypto ipsec sa

interface: Serial0
    Crypto map tag: TECHMAP, local addr 12.0.0.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (20.0.0.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
   current_peer 12.0.0.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 67, #pkts encrypt: 67, #pkts digest: 67
    #pkts decaps: 67, #pkts decrypt: 67, #pkts verify: 67
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 12.0.0.2, remote crypto endpt.: 12.0.0.1
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0
     current outbound spi: 0x3637026C(909574764)

     inbound esp sas:
      spi: 0xA9BA9F1(177973745)
        transform: esp-aes esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2002, flow_id: SW:2, crypto map: TECHMAP
        sa timing: remaining key lifetime (k/sec): (4467647/3445)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x3637026C(909574764)
        transform: esp-aes esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2001, flow_id: SW:1, crypto map: TECHMAP
        sa timing: remaining key lifetime (k/sec): (4467647/3443)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:


Thanks for Reading !!!!!!