LogoENEnglish

Hands-On Lab: Configuring a Site-to-Site IPsec VPN

This hands-on lab configures a complete site-to-site IPsec VPN between two routers, walking through ISAKMP Phase 1 policy, an IPsec transform set, a crypto map, and verification of both security association phases.

Site-to-Site IPsec VPNISAKMP Policy ConfigurationCrypto Map

~4 دقیقه مطالعه · آخرین به‌روزرسانی ۱ مهر ۱۴۰۵

Lab Objective

Configure a complete site-to-site IPsec VPN between two routers across a simulated public network, verify IKE Phase 1 and Phase 2 both establish successfully, and confirm traffic between each site's LAN is encrypted as it crosses the intermediate network.

Lab Purpose

This lab ties together every concept covered earlier in this series regarding IPsec VPNs — the two-phase IKE negotiation, the transform set, and interesting traffic ACL — into one complete, working configuration from start to finish.

Lab Topology

R1 (Site A) ---- Gi0/1 ---- ISP ---- Gi0/1 ---- R2 (Site B)

R1: Gi0/0 (LAN) 192.168.130.0/24, Gi0/1 (WAN) 203.0.113.1/30
R2: Gi0/0 (LAN) 192.168.140.0/24, Gi0/1 (WAN) 203.0.113.5/30

ISP router simply routes between the two WAN
addresses and requires no VPN awareness

Task 1: Configure Basic Addressing

Configure both routers' LAN and WAN interfaces.

Task 2: Configure IKE Phase 1 on Both Routers

Configure matching ISAKMP policy and a pre-shared key on both routers.

Task 3: Configure IKE Phase 2 on Both Routers

Configure a matching transform set and an ACL identifying interesting traffic (LAN-to-LAN) on both routers.

Task 4: Configure and Apply the Crypto Map

Create a crypto map referencing the peer, transform set, and interesting traffic ACL, and apply it to each router's WAN interface.

Task 5: Verify the Tunnel Establishes

Generate LAN-to-LAN traffic and confirm both Phase 1 and Phase 2 security associations are active.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.130.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.1 255.255.255.252
R1(config-if)# no shutdown

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip address 192.168.140.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface gigabitethernet0/1
R2(config-if)# ip address 203.0.113.5 255.255.255.252
R2(config-if)# no shutdown

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 14
R1(config)# crypto isakmp key VpnSharedKey2026 address 203.0.113.5

R2(config)# crypto isakmp policy 10
R2(config-isakmp)# encryption aes 256
R2(config-isakmp)# hash sha256
R2(config-isakmp)# authentication pre-share
R2(config-isakmp)# group 14
R2(config)# crypto isakmp key VpnSharedKey2026 address 203.0.113.1

R1(config)# crypto ipsec transform-set VPN-SET esp-aes 256 esp-sha256-hmac
R1(config)# access-list 101 permit ip 192.168.130.0 0.0.0.255 192.168.140.0 0.0.0.255

R2(config)# crypto ipsec transform-set VPN-SET esp-aes 256 esp-sha256-hmac
R2(config)# access-list 101 permit ip 192.168.140.0 0.0.0.255 192.168.130.0 0.0.0.255

-- Note: each router's ACL is mirrored --
-- source and destination reversed relative
-- to that router's own perspective

R1(config)# crypto map SITE-VPN 10 ipsec-isakmp
R1(config-crypto-map)# set peer 203.0.113.5
R1(config-crypto-map)# set transform-set VPN-SET
R1(config-crypto-map)# match address 101
R1(config)# interface gigabitethernet0/1
R1(config-if)# crypto map SITE-VPN

R2(config)# crypto map SITE-VPN 10 ipsec-isakmp
R2(config-crypto-map)# set peer 203.0.113.1
R2(config-crypto-map)# set transform-set VPN-SET
R2(config-crypto-map)# match address 101
R2(config)# interface gigabitethernet0/1
R2(config-if)# crypto map SITE-VPN

LAN-A-PC (192.168.130.10)> ping 192.168.140.10

!!!!!
Success rate is 100 percent (5/5)

R1# show crypto isakmp sa

dst             src             state    conn-id
203.0.113.5     203.0.113.1     QM_IDLE  1001

R1# show crypto ipsec sa

  local  ident: (192.168.130.0/255.255.255.0/0/0)
  remote ident: (192.168.140.0/255.255.255.0/0/0)
    #pkts encaps: 5, #pkts encrypt: 5
    #pkts decaps: 5, #pkts decrypt: 5
-- Both phases confirmed active, with actual
-- encrypted traffic counted in both directions

Key Takeaway

The interesting traffic ACLs on each router must be mirror images of each other — R1's ACL says "traffic from my LAN to R2's LAN," while R2's ACL says "traffic from my LAN to R1's LAN" — since each router evaluates the ACL from its own local perspective, and mismatching this mirroring is a common configuration error that silently results in a tunnel that establishes Phase 1 but never actually encrypts the intended traffic.

نوشته و پژوهش‌شده توسط دکتر شاهین صیامی

مقالات مرتبط

Hands-On Lab: Final Comprehensive CCNP Troubleshooting Challenge (BGP, DMVPN, and QoS Integration)

This hands-on lab presents a complex multi-layer failure across an integrated BGP-over-DMVPN topology combined with QoS marking, requiring systematic diagnosis of a route reflector misconfiguration, an NHRP registration failure, and an incorrectly applied QoS policy simultaneously affecting the same network.

ادامه

Hands-On Lab: Configuring BGP over DMVPN

This hands-on lab runs iBGP as the routing protocol across the same DMVPN hub-and-spoke topology used in the two previous labs, configuring the hub as a route reflector so spokes learn each other's routes without a full iBGP mesh, combining two previously separate concepts into one integrated design.

ادامه

Hands-On Lab: Configuring OSPF over DMVPN

This hands-on lab runs OSPF as the dynamic routing protocol across the same DMVPN hub-and-spoke topology, configuring the tunnel interface as an OSPF point-to-multipoint network type to correctly handle the hub-and-spoke adjacency pattern without requiring the broadcast network type's DR/BDR election.

ادامه

Hands-On Lab: Configuring EIGRP over DMVPN

This hands-on lab runs EIGRP as the dynamic routing protocol across the DMVPN hub-and-spoke topology built in earlier labs, verifying neighbor relationships form correctly across the multipoint tunnel and routes propagate without requiring per-spoke static configuration on the hub.

ادامه

Hands-On Lab: Configuring HSRP MD5 Authentication

This hands-on lab configures MD5 authentication on an HSRP group, verifying two routers with matching authentication strings form a normal active/standby relationship while a router with a mismatched string is excluded from the group entirely.

ادامه

Hands-On Lab: Configuring Cisco Umbrella-Style DNS Security via DNS Forwarding Redirection

This hands-on lab configures a router to redirect all client DNS queries toward a security-focused DNS resolver using DNS forwarding interception, approximating cloud-delivered DNS security enforcement without requiring per-client configuration changes.

ادامه
مقاله‌ی قبلیمقاله‌ی بعدی