Site to Site VPN between Cisco Routers

https://www.linkedin.com/in/sandeep-kumarr/ Page 1
Site-to-Site IPsec VPN using Pre-shared-Key
Tasks:
 Configure hostname of the device, do IP addressing and perform necessary routing.
 Check basic connectivity between WAN devices i.e. R1 and R3.
 Configure R1 and R3 for IPsec Tunnel simultaneously.
 Verify End to End connectivity over Internet Using IPsec Tunnel.
Explanation:
Here we are going to configure site to site VPN using IPSec. In this task we are
performing site to site VPN between Router and whole configuration is done via CLI. Main aim
of this Task is that private LAN can communicate over the Internet in a secure way. We are
using crypto ISAKMP policy for phase 1 also known as Main Mode negotiation using pre-
shared key. Then IPSec transform set which is used to protect actual data. These transform set
is exchanged in Phase 2 which is also called Quick Mode. Phase 2 is protected by Phase 1. Then
we will define proxy id’s also known as interesting traffic. In proxy ID we will define our Local
LAN and Remote LAN. These LAN’s are going to communicate after successful VPN connection
established.

In Phase 1 for data integrity we can use MD5/SHA. For authentication we can use either
pre-share key or RSA-Signature. For confidentiality we can use any encryption algorithm
DES/3DES/AES. Lifetime is defined as at what interval DH will refresh key for phase 2
protection.
In phase 2 we are configuring transform set in which will define data encapsulation
method along with encryption and data integrity method. So here we have two options ESP
(Encapsulating Security Payload) and AH (Authentication Header). In ESP information is
protected from Layer 3 to Layer 7. In AH information is protected from Layer 4 to Layer 7.
At last we have to create a crypto map in which we call our proxy id’s and define our
VPN peer ip address. Here we can define route for our remote LAN by injecting reverse route.
Then finally call it on the interface. When we apply Crypto Map on interface it will start
listening ISAKMP packet at port 500. Which means that particular interface can accept ISAKMP
packet at port 500.
Configuration:
Lets start from PC1
Assign IP address 192.168.1.10/24 and Gateway 192.168.1.1
In run section type ncpa.cpl then enter.

Configure adapter in red box by right click on it and open properties.

Now click on Internet protocol version 4 (TCP/IP)

Now assign ip address as shown, then click OK and you are done with configuration on PC1.

Lets verify the IP address assigned to PC1, open Command Prompt and type ipconfig
Similarly configure PC2 , Assign IP address 172.16.1.10/24 and Gateway 172.16.1.1
In run section type ncpa.cpl then enter.

Configure adapter in red box by right click on it and open properties.

Now click on Internet protocol version 4 (TCP/IP)

Now assign ip address as shown, then click OK and you are done with configuration on PC2.

Lets verify the IP address assigned to PC2, open Command Prompt and type ipconfig
Now configure R1 with basic configuration like hostname and IP addressing
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R1
R1(config)#interface ethernet0/1
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
*Aug 14 16:07:50.068: %LINK-3-UPDOWN: Interface Ethernet0/1, changed state to up
*Aug 14 16:07:51.074: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/1, changed
state to up
R1(config-if)#exit

state to up
R1(config-if)#end
R1#
Verify IP address assigned to Router R1 interfaces
R1#show ip interface brief
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 12.1.1.1 YES manual up up
Ethernet0/2 unassigned YES unset administratively down down
Router>enable
state to up

R2(config-if)#exit
state to up
R2(config-if)#end
R2#

Router>enable
state to up
R3(config-if)#exit
R3(config-if)#
state to up
R3(config-if)#end
R3#

Lets do Some Routing
Start with Router R1
R1(config)#ip route 0.0.0.0 0.0.0.0 ethernet0/0 12.1.1.2
Verify Routing Table of Router R1
R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override
Gateway of last resort is 12.1.1.2 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 12.1.1.2, Ethernet0/0
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 12.1.1.0/30 is directly connected, Ethernet0/0
L 12.1.1.1/32 is directly connected, Ethernet0/0

Similarly on Router R3
R3(config)#ip route 0.0.0.0 0.0.0.0 ethernet0/1 23.1.1.2
Verify Routing Table of Router R3
R3#show ip route
S* 0.0.0.0/0 [1/0] via 23.1.1.2, Ethernet0/1

Routing Table of Router R2
R2#show ip route
Gateway of last resort is not set

Lets check connectivity between Devices
R1#ping 192.168.1.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
R1#ping 23.1.1.1
!!!!!
Similarly from Router R3
R3#ping 172.16.1.10
!!!!!
R3#ping 12.1.1.1
!!!!!

Lets Start with VPN Configuration on Router R1
So here We first create Crypto ISAKMP policy 1
R1(config)#
R1(config)#crypto isakmp policy 1
R1(config-isakmp)#hash md5
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#group 2
R1(config-isakmp)#encryption des
R1(config-isakmp)#exit
configure pre-shared-key authentication
R1(config)#crypto isakmp key sandeep@123 address 23.1.1.1
configure IPsec transform set for phase 2
R1(config)#crypto ipsec transform-set TSET esp-aes esp-md5-hmac
R1(cfg-crypto-trans)#mode tunnel
R1(cfg-crypto-trans)#exit
Configure an ACL for proxy ID or interesting traffic
R1(config)#
R1(config)#ip access-list extended VPN
R1(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255
R1(config-ext-nacl)#exit
R1(config)#
Now configure crypto map
R1(config)#crypto map SITE_A 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer

and a valid access list have been configured.
R1(config-crypto-map)#set peer 23.1.1.1
R1(config-crypto-map)#match address VPN
R1(config-crypto-map)#set transform-set TSET
R1(config-crypto-map)#reverse-route static
R1(config-crypto-map)#exit
R1(config)#
Now apply crypto map on the interface
R1(config)#
R1(config-if)#crypto map SITE_A
R1(config-if)#
*Aug 14 19:57:07.548: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
Verify Configuration of IPsec VPN
Start with ISAKMP policy
R1#show crypto isakmp policy
Global IKE policy
Protection suite of priority 1
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Message Digest 5
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 86400 seconds, no volume limit

Verify ISAKMP key
R1#show crypto isakmp key
Keyring Hostname/Address Preshared Key
default 23.1.1.1 sandeep@123
Verify IPsec Transform-set
R1#show crypto ipsec transform-set TSET
{ esp-aes esp-md5-hmac }
will negotiate = { Tunnel, },
Verify proxy-id
R1#show ip access-lists
Extended IP access list VPN
10 permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255
Verify Crypto map
R1#show crypto map
Interfaces using crypto map NiStTeSt1:
Crypto Map IPv4 "SITE_A" 1 ipsec-isakmp
Peer = 23.1.1.1
access-list VPN permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255
Current peer: 23.1.1.1
Security association lifetime: 4608000 kilobytes/3600 seconds
Responder-Only (Y/N): N
PFS (Y/N): N

Mixed-mode : Disabled
Transform sets={
TSET: { esp-aes esp-md5-hmac } ,
}
Reverse Route Injection Enabled
Interfaces using crypto map SITE_A:
Ethernet0/0
As we have enabled reverse-route in crypto map so a route should be present in routing table,
I have highlighted it in yellow colour in routing table.
R1#show ip route
S* 0.0.0.0/0 [1/0] via 12.1.1.2, Ethernet0/0

172.16.0.0/24 is subnetted, 1 subnets
S 172.16.1.0 [1/0] via 23.1.1.1
Now configure R3 for VPN connection,
So here We first create Crypto ISAKMP policy 1
R3#
R3#conf t
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#hash md5
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#group 2
R3(config-isakmp)#encryption des
R3(config-isakmp)#exi
Configure pre-shared-key for authentication
R3(config)#
R3(config)#crypto isakmp key sandeep@123 address 12.1.1.1
R3(config)#

Configure ipsec transform set
R3(config)#crypto ipsec transform-set TSET esp-aes esp-md5-hmac
R3(cfg-crypto-trans)#mode tunnel
R3(cfg-crypto-trans)#exit
R3(config)#
Now create an ACL for proxy ID’s
R3(config)#ip access-list extended VPN
R3(config-ext-nacl)#permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
R3(config-ext-nacl)#exit
R3(config)#
Configure Crypto Map
R3(config)#crypto map SITE_B 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
R3(config-crypto-map)#set peer 12.1.1.1
R3(config-crypto-map)#match address VPN
R3(config-crypto-map)#set transform-set TSET
R3(config-crypto-map)#reverse-route static
R3(config-crypto-map)#exit
Now apply crypto map on the interface
R3(config-if)#crypto map SITE_B
*Aug 14 20:22:06.426: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R3(config-if)#exit

Let’s verify the configuration of Router R3
Verify ISAKMP policy
R3#show crypto isakmp policy
Global IKE policy
Protection suite of priority 1
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Message Digest 5
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 86400 seconds, no volume limit
verify ISAKMP key
R3#show crypto isakmp key
Keyring Hostname/Address Preshared Key
default 12.1.1.1 sandeep@123
Verify IPsec Transform-set
R3#show crypto ipsec transform-set TSET
{ esp-aes esp-md5-hmac }
will negotiate = { Tunnel, },
Verify proxy Id
R3#show ip access-lists
10 permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255

Verify Crypto Map
R3#show crypto map
Interfaces using crypto map NiStTeSt1:
Crypto Map IPv4 "SITE_B" 1 ipsec-isakmp
Peer = 12.1.1.1
access-list VPN permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
Current peer: 12.1.1.1
Security association lifetime: 4608000 kilobytes/3600 seconds
Responder-Only (Y/N): N
PFS (Y/N): N
Mixed-mode : Disabled
Transform sets={
TSET: { esp-aes esp-md5-hmac } ,
}
Reverse Route Injection Enabled
Interfaces using crypto map SITE_B:
Ethernet0/1
Verify Routing Table
R3#show ip route

S* 0.0.0.0/0 [1/0] via 23.1.1.2, Ethernet0/1
S 192.168.1.0/24 [1/0] via 12.1.1.1
So we are done with the configuration part of all the devices.
It’s time to verify VPN connection establishment between SITE_A and SITE_B.

Verification of the TASK:
Generate some traffic from PC1 for PC2.
So here from 192.168.1.10 (PC1) ping to 172.16.1.10 (PC2)
Now check ISAKMP sa on Router R1
R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
23.1.1.1 12.1.1.1 QM_IDLE 1001 ACTIVE
Now check IPsec sa on Router R1
R1#show crypto ipsec sa
interface: Ethernet0/0
Crypto map tag: SITE_A, local addr 12.1.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
current_peer 23.1.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
#pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 12.1.1.1, remote crypto endpt.: 23.1.1.1
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
current outbound spi: 0xAEDF3447(2933863495)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x600FE16E(1611653486)
transform: esp-aes esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: SW:1, sibling_flags 80004040, crypto map: SITE_A
sa timing: remaining key lifetime (k/sec): (4176059/3487)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xAEDF3447(2933863495)
conn id: 2, flow_id: SW:2, sibling_flags 80004040, crypto map: SITE_A
IV size: 16 bytes
outbound ah sas:
outbound pcp sas:
Check Crypto session on Router R1
R1#show crypto session
Crypto session current status
Interface: Ethernet0/0
Session status: UP-ACTIVE
Peer: 23.1.1.1 port 500
Session ID: 0
IKEv1 SA: local 12.1.1.1/500 remote 23.1.1.1/500 Active
IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 172.16.1.0/255.255.255.0
Active SAs: 2, origin: crypto map

Check similar things on Router R3
R3#show crypto isakmp sa
dst src state conn-id status
23.1.1.1 12.1.1.1 QM_IDLE 1001 ACTIVE
Check ipsec sa on Router R3
R3#show crypto ipsec sa
interface: Ethernet0/1
Crypto map tag: SITE_B, local addr 23.1.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer 12.1.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
#pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 23.1.1.1, remote crypto endpt.: 12.1.1.1
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/1
current outbound spi: 0x600FE16E(1611653486)

PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xAEDF3447(2933863495)
conn id: 1, flow_id: SW:1, sibling_flags 80000040, crypto map: SITE_B
IV size: 16 bytes
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x600FE16E(1611653486)
conn id: 2, flow_id: SW:2, sibling_flags 80000040, crypto map: SITE_B
IV size: 16 bytes
outbound ah sas:
outbound pcp sas:

Check crypto session on Router R3
R3#show crypto session
Crypto session current status
Interface: Ethernet0/1
Session status: UP-ACTIVE
Peer: 12.1.1.1 port 500
Session ID: 0
IKEv1 SA: local 23.1.1.1/500 remote 12.1.1.1/500 Active
IPSEC FLOW: permit ip 172.16.1.0/255.255.255.0 192.168.1.0/255.255.255.0
Active SAs: 2, origin: crypto map
END of Task.

Site to Site VPN between Cisco Routers

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Site to Site VPN between Cisco Routers

Similar to Site to Site VPN between Cisco Routers (20)

Recently uploaded

Recently uploaded (20)

Site to Site VPN between Cisco Routers