SITE TO SITE VPN ROUTER PART 1
SITE TO SITE IPSEC VPN TUNNEL BETWEEN CISCO ROUTERS
These steps are:
(1) Configure ISAKMP (ISAKMP Phase 1)
(2) Configure IPSec (ISAKMP Phase 2, ACLs, Crypto MAP)
CONFIGURE ISAKMP (IKE) - (ISAKMP PHASE 1):-
R1(config)# crypto isakmp policy 1
R1(config-isakmp)# encr 3des
R1(config-isakmp)# hash md5
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 2
R1(config-isakmp)# lifetime 86400
R1(config)# crypto isakmp key firewallcx address X.X.X.X(ROUTER-2 IP ADDRESS)
CONFIGURE IPSEC:-
R1(config)# ip access-list extended XXX(Name for access list)
R1(config-ext-nacl)# permit ip x.x.x.x(R1-LOCAL internal Network) 0.0.0.255 x.x.x.x(R2LOCAL internal Network) 0.0.0.255
crypto ipsec transform-set TS esp-3des esp-md5-hmac
R1(config)# crypto map CMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer X.X.X.X(ROUTER-2 IP ADDRESS)
R1(config-crypto-map)# set transform-set TS
R1(config-crypto-map)# match address XXX(Name for access list)
R1(config)# interface FastEthernet0/1
R1(config- if)# crypto map CMAP
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
SITE -1
These steps are:
(1) Configure ISAKMP (ISAKMP Phase 1)
(2) Configure IPSec (ISAKMP Phase 2, ACLs, Crypto MAP)
CONFIGURE ISAKMP (IKE) - (ISAKMP PHASE 1):-
R1(config)# crypto isakmp policy 1
R1(config-isakmp)# encr 3des
R1(config-isakmp)# hash md5
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 2
R1(config-isakmp)# lifetime 86400
R1(config)# crypto isakmp key antony address 1.1.1.2
CONFIGURE IPSEC:-
R1(config)# ip access-list extended SITE-2-VPN
R1(config-ext-nacl)# permit ip 10.0.0.0 0.0.0.255 192.168.0.0 0.0.0.255
crypto ipsec transform-set TS-ANT esp-3des esp-md5-hmac
R1(config)# crypto map CMAP-ANT 10 ipsec-isakmp
R1(config-crypto-map)# set peer 1.1.1.2
R1(config-crypto-map)# set transform-set TS-ANT
R1(config-crypto-map)# match address SITE-2-VPN
R1(config)# interface FastEthernet0/1
R1(config- if)# crypto map CMAP-ANT
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
R1 CONFIGURATION:
Router#SHOW RUN
Building configuration...
Current configuration : 1707 bytes
!
version 15.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool ccp-pool
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
!
!
!
no ip cef
no ipv6 cef
!
!
!
!
license udi pid C819HGW-PT-K9 sn FTX18066A3L
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key antony address 1.1.1.2
!
!
!
crypto ipsec transform-set TS-ANT esp-3des esp-md5-hmac
!
crypto map CMAP-ANT 10 ipsec-isakmp
set peer 1.1.1.2
set transform-set TS-ANT
match address SITE-2-VPN
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0
ip address 10.0.0.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Serial0
ip address 1.1.1.1 255.255.255.0
ip nat outside
clock rate 2000000
crypto map CMAP-ANT
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
!
interface Cellular0
no ip address
shutdown
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.10.10.1 255.255.255.248
!
ip nat inside source static 10.0.0.2 1.1.1.1
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0
!
ip flow-export version 9
!
!
access-list 23 permit 10.10.10.0 0.0.0.7
ip access-list extended SITE-2-VPN
permit ip 10.0.0.0 0.0.0.255 192.168.0.0 0.0.0.255
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
Router#
SO WATCH MY SECOND VIDEO FOR SITE 2 VPN CONNECTION.
----------------------------------------------------------------------------------------------------------------------------
PART-2 VIDEO LINK
• SITE TO SITE VPN ROUTER PART 2