SITE TO SITE VPN ROUTER PART 2
SITE TO SITE IPSEC VPN TUNNEL BETWEEN CISCO ROUTERS
These steps are:
(1) Configure ISAKMP (ISAKMP Phase 1)
(2) Configure IPSec (ISAKMP Phase 2, ACLs, Crypto MAP)
CONFIGURE ISAKMP (IKE) - (ISAKMP PHASE 1):-
R1(config)# crypto isakmp policy 1
R1(config-isakmp)# encr 3des
R1(config-isakmp)# hash md5
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 2
R1(config-isakmp)# lifetime 86400
R1(config)# crypto isakmp key firewallcx address X.X.X.X(ROUTER-2 IP ADDRESS)
CONFIGURE IPSEC:-
R1(config)# ip access-list extended XXX(Name for access list)
R1(config-ext-nacl)# permit ip x.x.x.x(R1-LOCAL internal Network) 0.0.0.255 x.x.x.x(R2LOCAL internal Network) 0.0.0.255
crypto ipsec transform-set TS esp-3des esp-md5-hmac
R1(config)# crypto map CMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer X.X.X.X(ROUTER-2 IP ADDRESS)
R1(config-crypto-map)# set transform-set TS
R1(config-crypto-map)# match address XXX(Name for access list)
R1(config)# interface FastEthernet0/1
R1(config- if)# crypto map CMAP
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
SITE -2 PART-2
These steps are:
(1) Configure ISAKMP (ISAKMP Phase 1)
(2) Configure IPSec (ISAKMP Phase 2, ACLs, Crypto MAP)
CONFIGURE ISAKMP (IKE) - (ISAKMP PHASE 1):-
R2(config)# crypto isakmp policy 1
R2(config-isakmp)# encr 3des
R2(config-isakmp)# hash md5
R2(config-isakmp)# authentication pre-share
R2(config-isakmp)# group 2
R2(config-isakmp)# lifetime 86400
R2(config)# crypto isakmp key antony address 1.1.1.1
CONFIGURE IPSEC:-
R2(config)# ip access-list extended SITE-1-VPN
R2(config-ext-nacl)# permit ip 192.168.0.0 0.0.0.255 10.0.0.0 0.0.0.255
crypto ipsec transform-set TS-ANT esp-3des esp-md5-hmac
R2(config)# crypto map CMAP 10 ipsec-isakmp
R2(config-crypto-map)# set peer 1.1.1.1
R2(config-crypto-map)# set transform-set TS-ANT
R2(config-crypto-map)# match addresS SITE-1-VPN
R2(config)# interface SERIAL 0
R2(config- if)# crypto map CMAP
WAIT 5 MIN.... TO SHARE THE KEY....
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
R2 CONFIGURATION:-
Router(config-if)#DO SHOW RUN
Building configuration...
Current configuration : 1862 bytes
!
version 15.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool ccp-pool
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
!
!
!
ip cef
no ipv6 cef
!
!
!
!
license udi pid C819HGW-PT-K9 sn FTX1806BFM3
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key antony address 1.1.1.1
!
!
!
crypto ipsec transform-set TS-ANT esp-3des esp-md5-hmac
!
crypto map CMAP 10 ipsec-isakmp
set peer 1.1.1.1
set transform-set TS-ANT
match address SITE-1-VPN
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0
ip address 192.168.0.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Serial0
ip address 1.1.1.2 255.255.255.0
ip nat outside
crypto map CMAP
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
!
interface Cellular0
no ip address
shutdown
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.10.10.1 255.255.255.248
!
ip nat inside source list 101 interface Serial0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0
!
ip flow-export version 9
!
!
access-list 23 permit 10.10.10.0 0.0.0.7
ip access-list extended SITE-1-VPN
permit ip 192.168.0.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 remark nat
access-list 101 deny ip 192.168.0.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
access-list 101 remark nat1
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
Router(config-if)#
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
BRINGING UP AND VERIFYING THE VPN TUNNEL
ping 20.20.20.1 source SERIAL 0
show crypto session