LogoفارسیFA

Hands-On Lab: Configuring a Site-to-Site IPsec VPN

This hands-on lab configures a complete site-to-site IPsec VPN between two routers, walking through ISAKMP Phase 1 policy, an IPsec transform set, a crypto map, and verification of both security association phases.

Site-to-Site IPsec VPNISAKMP Policy ConfigurationCrypto Map

~4 min read · Updated Sep 23, 2026

Lab Objective

Configure a complete site-to-site IPsec VPN between two routers across a simulated public network, verify IKE Phase 1 and Phase 2 both establish successfully, and confirm traffic between each site's LAN is encrypted as it crosses the intermediate network.

Lab Purpose

This lab ties together every concept covered earlier in this series regarding IPsec VPNs — the two-phase IKE negotiation, the transform set, and interesting traffic ACL — into one complete, working configuration from start to finish.

Lab Topology

R1 (Site A) ---- Gi0/1 ---- ISP ---- Gi0/1 ---- R2 (Site B)

R1: Gi0/0 (LAN) 192.168.130.0/24, Gi0/1 (WAN) 203.0.113.1/30
R2: Gi0/0 (LAN) 192.168.140.0/24, Gi0/1 (WAN) 203.0.113.5/30

ISP router simply routes between the two WAN
addresses and requires no VPN awareness

Task 1: Configure Basic Addressing

Configure both routers' LAN and WAN interfaces.

Task 2: Configure IKE Phase 1 on Both Routers

Configure matching ISAKMP policy and a pre-shared key on both routers.

Task 3: Configure IKE Phase 2 on Both Routers

Configure a matching transform set and an ACL identifying interesting traffic (LAN-to-LAN) on both routers.

Task 4: Configure and Apply the Crypto Map

Create a crypto map referencing the peer, transform set, and interesting traffic ACL, and apply it to each router's WAN interface.

Task 5: Verify the Tunnel Establishes

Generate LAN-to-LAN traffic and confirm both Phase 1 and Phase 2 security associations are active.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.130.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.1 255.255.255.252
R1(config-if)# no shutdown

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip address 192.168.140.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface gigabitethernet0/1
R2(config-if)# ip address 203.0.113.5 255.255.255.252
R2(config-if)# no shutdown

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 14
R1(config)# crypto isakmp key VpnSharedKey2026 address 203.0.113.5

R2(config)# crypto isakmp policy 10
R2(config-isakmp)# encryption aes 256
R2(config-isakmp)# hash sha256
R2(config-isakmp)# authentication pre-share
R2(config-isakmp)# group 14
R2(config)# crypto isakmp key VpnSharedKey2026 address 203.0.113.1

R1(config)# crypto ipsec transform-set VPN-SET esp-aes 256 esp-sha256-hmac
R1(config)# access-list 101 permit ip 192.168.130.0 0.0.0.255 192.168.140.0 0.0.0.255

R2(config)# crypto ipsec transform-set VPN-SET esp-aes 256 esp-sha256-hmac
R2(config)# access-list 101 permit ip 192.168.140.0 0.0.0.255 192.168.130.0 0.0.0.255

-- Note: each router's ACL is mirrored --
-- source and destination reversed relative
-- to that router's own perspective

R1(config)# crypto map SITE-VPN 10 ipsec-isakmp
R1(config-crypto-map)# set peer 203.0.113.5
R1(config-crypto-map)# set transform-set VPN-SET
R1(config-crypto-map)# match address 101
R1(config)# interface gigabitethernet0/1
R1(config-if)# crypto map SITE-VPN

R2(config)# crypto map SITE-VPN 10 ipsec-isakmp
R2(config-crypto-map)# set peer 203.0.113.1
R2(config-crypto-map)# set transform-set VPN-SET
R2(config-crypto-map)# match address 101
R2(config)# interface gigabitethernet0/1
R2(config-if)# crypto map SITE-VPN

LAN-A-PC (192.168.130.10)> ping 192.168.140.10

!!!!!
Success rate is 100 percent (5/5)

R1# show crypto isakmp sa

dst             src             state    conn-id
203.0.113.5     203.0.113.1     QM_IDLE  1001

R1# show crypto ipsec sa

  local  ident: (192.168.130.0/255.255.255.0/0/0)
  remote ident: (192.168.140.0/255.255.255.0/0/0)
    #pkts encaps: 5, #pkts encrypt: 5
    #pkts decaps: 5, #pkts decrypt: 5
-- Both phases confirmed active, with actual
-- encrypted traffic counted in both directions

Key Takeaway

The interesting traffic ACLs on each router must be mirror images of each other — R1's ACL says "traffic from my LAN to R2's LAN," while R2's ACL says "traffic from my LAN to R1's LAN" — since each router evaluates the ACL from its own local perspective, and mismatching this mirroring is a common configuration error that silently results in a tunnel that establishes Phase 1 but never actually encrypts the intended traffic.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

Continue
Previous ArticleNext Article