This document provides a guide for setting up a site-to-site VPN between two Cisco IOS routers, one using route-based VPN and the other using policy-based VPN. It includes pre-configured router settings, detailed configuration steps for both routers (R1 and R2), and verification references for successful implementation. The process focuses on crypto policies and IP address assignments to establish secure connections.

1. Site to Site VPN
Policy Based & Route Based
Dhruv Sharma

2. Introduction
• In this session we will setup a site-to-site VPN between two cisco IOS routers, one configured with
Route Based VPN and other configured with Policy Based.

3. Topology

4. Pre-configured - R1

5. Pre-configured - R1
!
hostname R1
!
interface Loopback1
ip address 11.11.11.1 255.0.0.0
!
interface GigabitEthernet0/0
ip address 10.10.10.10 255.0.0.0
no sh
!

6. Pre-Configured – R2

7. Pre-Configured – R2
!
hostname R2
!
interface Loopback1
ip address 12.12.12.1 255.0.0.0
!
interface GigabitEthernet0/0
ip address 10.10.10.11 255.0.0.0
no sh
!

8. • Configuration – R1

9. !
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.10.10.11
!
crypto ipsec transform-set ra-set esp-3des esp-md5-hmac
!
crypto ipsec profile profile1
set transform-set ra-set
!

10. !
interface Tunnel1
ip address 192.168.1.1 255.255.255.0
tunnel source GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel destination 10.10.10.11
tunnel protection ipsec profile profile1
!
ip route 12.0.0.0 255.0.0.0 Tunnel1
!

11. • Configuration – R2

12. !
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.10.10.10
!
crypto ipsec transform-set ra-set esp-3des esp-md5-hmac
!
crypto map babi 20 ipsec-isakmp
set peer 10.10.10.10
set transform-set ra-set
match address 101
!

13. !
ip route 0.0.0.0 0.0.0.0 10.10.10.10
!
access-list 101 permit ip 12.0.0.0 0.255.255.255 11.0.0.0 0.255.255.255
!
interface GigabitEthernet0/0
ip address 10.10.10.11 255.0.0.0
duplex auto
speed auto
media-type rj45
crypto map babi
!

14. • Verification

15. Verification

16. Verification

17. Verification

18. References
• https://community.cisco.com/t5/security-blogs/connect-route-based-
vpn-connect-to-policy-based-vpn/ba-p/4624682
• https://packetlife.net/blog/2011/aug/15/policy-based-vs-route-
based-vpns-part-1/

19. • Lab Work