Use pre-shared Site-to-Site IPSEC VPN

650) this. width = 650; "src =" 51cto.com/uploads/allianz 110927/1340153i7-0.jpg "class =" blogimg "border =" 0 "/>

1: Basic Interface Configuration
R1:
R1 (config) # int f0/0
R1 (config-if) # ip add 10.0.0.1 255.255.255.0
R1 (config-if) # no sh
R1 (config-if) # int lo 0
R1 (config-if) # ip add 1.1.1.1 255.255.255.0
R1 (config-if) # no sh
R1 (config) # router ospf 100
R1 (config-router) # net 0.0.0.0 0.0.0.0 area 0

R2:
R2 (config) # int f0/0
R2 (config-if) # ip add 10.0.0.2 255.255.255.0
R2 (config-if) # no sh
R2 (config-if) # int lo 0
R2 (config-if) # ip add 2.2.2.2 255.255.255.0
R2 (config-if) # no sh
R2 (config) # router ospf 100
R2 (config-router) # net 0.0.0.0 0.0.0.0 area 0
2: Configure Internet Key Exchange (IKE)
R1:
R1 (config) # crypto isakmp enable
R1 (config) # crypto isakmp policy 10
R1 (config-isakmp) # authentication pre-share
R1 (config-isakmp) # encryption 3des
R1 (config-isakmp) # group 5
R1 (config-isakmp) # hash sha
R1 (config-isakmp) # lifectime 86400
R1 (config) # crypto isakmp key 0 zhyzhjzhj address 10.0.0.2
R2:
R2 (config) # crypto isakmp enable
R2 (config) # crypto isakmp policy 10
R2 (config-isakmp) # authentication pre-share
R2 (config-isakmp) # encryption 3des
R2 (config-isakmp) # group 5
R2 (config-isakmp) # hash sha
R2 (config-isakmp) # lifectime 86400
R2 (config) # crypto isakmp key 0 zhyzhjzhj address 10.0.0.1

3: configure the IPSEC conversion set
R1:
R1 (config) # crypto ipsec transform-set R1set esp-3des esp-md5-hmac
R1 (config) # crypto map R1VPN 10 ipsec-isakmp
R1 (config-crypto-map) # set peer 10.0.0.2
R1 (config-crypto-map) # set transform-set R1set
R1 (config-crypto-map) # match address 100
R2:
R2 (config) # crypto ipsec transform-set R2set esp-3des esp-md5-hmac
R2 (config) # crypto map R2VPN 10 ipsec-isakmp
R2 (config-crypto-map) # set peer 10.0.0.1
R2 (config-crypto-map) # set transform-set R2set
R2 (config-crypto-map) # match address 100
4: Define the traffic to be triggered, that is, the traffic protected by the IPSEC connection.
R1:
R1 (config) # access-list 100 permit icmp 1.1.1.1 0.0.0.0 2.2.2.2 0.0.0.0
R1 (config) # int f0/0
R1 (config-if) # crypto map R1VPN // apply the encryption ing TO THE INTERFACE
R2:
R2 (config) # access-list 100 permit icmp 2.2.2.2 0.0.0.0 1.1.1.1 0.0.0.0
R2 (config) # int f0/0
R2 (config-if) # crypto map R2VPN

5. debugging information:
R1 # debug crypto isakmp
Crypto ISAKMP debugging is on
R1 # debug crypto ipsec
Crypto IPSEC debugging is on
R1 # ping 2.2.2.2 sou
R1 # ping 2.2.2.2 source 1.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1

* Mar 30 23:08:18. 571: IPSEC (sa_request ):,
(Key eng. msg.) OUTBOUND local = 10.0.0.1, remote = 10.0.0.2,
Local_proxy = 1.1.1.1/255.255.255.255/1/0 (type = 1 ),
Remote_proxy = 2.2.2.2/255.255.255.255/1/0 (type = 1 ),
Protocol = ESP, transform = NONE (Tunnel ),
Lifedur = 3600 s and 4608000kb,
Spi = 0x0 (0), conn_id = 0, keysize = 0, flags = 0x0
* Mar 30 23:08:18. 579: ISAKMP :( 0): SA request profile is (NULL)
* Mar 30 23:08:18. 583: ISAKMP: Created a peer struct for 10.0.0.2, peer port 500
* Mar 30 23:08:18. 583: ISAKMP: New peer created peer = 0x663BD320 peer_handle = 0
X80000002
* Mar 30 23:08:18. 587: ISAKMP: Locking peer struct 0x663BD320, refcount 1 for isa
Kmp_initiator
* Mar 30 23:08:18. 587: ISAKMP: local port 500, remote port 500
* Mar 30 23:08:18. 591: ISAKMP: set new node 0 to QM_IDLE
* Mar 30 23:08:18. 595: insert sa successfully sa = 655685C4
* Mar 30 23:08:18. 595: ISAKMP :( 0): Can not start Aggressive mode, trying Main mode
.
* Mar 30 23:08:18. 599: ISAKMP :( 0): found peer pre-shared key matching 10.0.0.2
* Mar 30 23:08:18. 603: ISAKMP :( 0): constructed NAT-T vendor-07 ID
* Mar 30 23:08:18. 607: ISAKMP :( 0): constructed NAT-T vendor-03 ID
* Mar 30 23:08:18. 607: ISAKMP :( 0): constructed NAT-T vendor-02 ID
* Mar 30 23:08:18. 611: ISAKMP :( 0): Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
* Mar 30 23:08:18. 611: ISAKMP :( 0): Old State = IKE_READY New State = IKE_ I _MM1

* Mar 30 23:08:18. 615: ISAKMP :( 0): beginning Main Mode exchange
* Mar 30 23:08:18. 619: ISAKMP :( 0): sending packet to 10.0.0.2 my_port 500 peer_po
Rt 500 (I) MM_NO_STATE
* Mar 30 23:08:18. 743: ISAKMP (0: 0): received packet from 10.0.0.2 dport 500 spor
T 500 Global (I) MM_NO_STATE
* Mar 30 23:08:18. 763: ISAKMP :( 0): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
* Mar 30 23:08:18. 763: ISAKMP :( 0): Old State = IKE_ I _MM1 New State = IKE_ I _MM2

* Mar 30 23:08:18. 775: ISAKMP :( 0): processing SA payload. message ID = 0
* Mar 30 23:08:18. 779: ISAKMP :( 0): processing vendor id payload
* Mar 30 23:08:18. 779: ISAKMP :( 0 .!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 12/64/108 MS
R1 #): vendor ID seems Unity/DPD but major 245 mismatch
* Mar 30 23:08:18. 783: ISAKMP (0: 0): vendorid is NAT-T v7
* Mar 30 23:08:18. 787: ISAKMP :( 0): found peer pre-shared key matching 10.0.0.2
* Mar 30 23:08:18. 787: ISAKMP :( 0): local preshared key found
* Mar 30 23:08:18. 791: ISAKMP: Scanning profiles for xauth...
* Mar 30 23:08:18. 791: ISAKMP :( 0): Checking ISAKMP transform 1 against priority 10 policy
* Mar 30 23:08:18. 795: ISAKMP: encryption 3DES-CBC
* Mar 30 23:08:18. 795: ISAKMP: hash SHA
* Mar 30 23:08:18. 795: ISAKMP: default group 5
* Mar 30 23:08:18. 799: ISAKMP: auth pre-share
* Mar 30 23:08:18. 799: ISAKMP: life type in seconds
* Mar 30 23:08:18. 799: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
* Mar 30 23:08:18. 807: ISAKMP :( 0): atts are acceptable. Next payload is 0
* Mar 30 23:08:18. 811: ISAKMP :( 0): processing vendor id payload
* Mar 30 23:08:18. 811: ISAKMP :( 0): vendor ID seems Unity/DPD but major 245 mismatch
* Mar 30 23:08:18. 815: ISAKMP (0: 0)
R1 #: vendor ID is NAT-T v7
* Mar 30 23:08:18. 819: ISAKMP :( 0): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
* Mar 30 23:08:18. 819: ISAKMP :( 0): Old State = IKE_ I _MM2 New State = IKE_ I _MM2

* Mar 30 23:08:18. 823: ISAKMP :( 0): sending packet to 10.0.0.2 my_port 500 peer_port 500 (I) MM_SA_SETUP
* Mar 30 23:08:18. 823: ISAKMP :( 0): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
* Mar 30 23:08:18. 823: ISAKMP :( 0): Old State = IKE_ I _MM2 New State = IKE_ I _MM3

* Mar 30 23:08:19. 035: ISAKMP (0: 0): received packet from 10.0.0.2 dport 500 sport 500 Global (I) MM_SA_SETUP
* Mar 30 23:08:19. 039: ISAKMP :( 0): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
* Mar 30 23:08:19. 043: ISAKMP :( 0): Old State = IKE_ I _MM3 New State = IKE_ I _MM4

* Mar 30 23:08:19. 055: ISAKMP :( 0): processing KE payload. message ID = 0
* Mar 30 23:08:19. 183: ISAKMP :( 0): processing NONCE payload. message ID = 0
* Mar 30 23:08:19. 183: ISAKMP :( 0): found peer pre-shared key matching 10.0.0.2
* Mar 30 23:08:19. 199: ISAKMP :( 1001): processing
R1 # vendor id payload
* Mar 30 23:08:19. 203: ISAKMP :( 1001): vendor ID is Unity
* Mar 30 23:08:19. 203: ISAKMP :( 1001): processing vendor id payload
* Mar 30 23:08:19. 203: ISAKMP :( 1001): vendor ID is DPD
* Mar 30 23:08:19. 203: ISAKMP :( 1001): processing vendor id payload
* Mar 30 23:08:19. 203: ISAKMP :( 1001): speaking to another IOS box!
* Mar 30 23:08:19. 203: ISAKMP :( 1001): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
* Mar 30 23:08:19. 203: ISAKMP :( 1001): Old State = IKE_ I _MM4 New State = IKE_ I _MM4

* Mar 30 23:08:19. 203: ISAKMP :( 1001): Send initial contact
* Mar 30 23:08:19. 203: ISAKMP :( 1001): SA is doing pre-shared key authentication using id type id_00004_addr
* Mar 30 23:08:19. 203: ISAKMP (): ID payload
Next-payload: 8
Type: 1
Address: 10.0.0.1
Protocol: 17
Port: 500
Length: 12
* Mar 30 23:08:19. 203: ISAKMP :( 1001): Total payload length: 12
* Mar 30 23:08:19. 203: ISAKMP :( 1001): sending packet to 10.0.0.2 my_port 500 peer_port 500
R1 # (I) MM_KEY_EXCH
* Mar 30 23:08:19. 203: ISAKMP :( 1001): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
* Mar 30 23:08:19. 203: ISAKMP :( 1001): Old State = IKE_ I _MM4 New State = IKE_ I _MM5

* Mar 30 23:08:19. 243: ISAKMP (): received packet from 10.0.0.2 dport 500 sport 500 Global (I) MM_KEY_EXCH
* Mar 30 23:08:19. 251: ISAKMP :( 1001): processing ID payload. message ID = 0
* Mar 30 23:08:19. 251: ISAKMP (): ID payload
Next-payload: 8
Type: 1
Address: 10.0.0.2
Protocol: 17
Port: 500
Length: 12
* Mar 30 23:08:19. 251: ISAKMP :( 0): peer matches * none * of the profiles
* Mar 30 23:08:19. 251: ISAKMP :( 1001): processing HASH payload. message ID = 0
* Mar 30 23:08:19. 251: ISAKMP :( 1001): SA authentication status:
Authenticated
* Mar 30 23:08:19. 251: ISAKMP :( 1001): SA has been authenticated with 10.0.0.2
* Mar 30 23:08:19. 251: ISAKMP: Trying to insert a peer 10.0.0.1/10.0.0.2/500/, and inserted successfully 663BD320.
* Mar 23:08:19. 25
R1 #1: ISAKMP :( 1001): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
* Mar 30 23:08:19. 251: ISAKMP :( 1001): Old State = IKE_ I _MM5 New State = IKE_ I _MM6

* Mar 30 23:08:19. 251: ISAKMP :( 1001): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
* Mar 30 23:08:19. 251: ISAKMP :( 1001): Old State = IKE_ I _MM6 New State = IKE_ I _MM6

* Mar 30 23:08:19. 251: ISAKMP :( 1001): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
* Mar 30 23:08:19. 251: ISAKMP :( 1001): Old State = IKE_ I _MM6 New State = IKE_P1_COMPLETE

* Mar 30 23:08:19. 255: ISAKMP :( 1001): beginning Quick Mode exchange, M-ID of-479716604
* Mar 30 23:08:19. 259: ISAKMP :( 1001): QM Initiator gets spi
* Mar 30 23:08:19. 271: ISAKMP :( 1001): sending packet to 10.0.0.2 my_port 500 peer_port 500 (I) QM_IDLE
* Mar 30 23:08:19. 275: ISAKMP :( 1001): Node-479716604, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
* Mar 30 23:08:19. 279: ISAKMP :( 1001): Old State = IKE_QM_READY New State = IKE_QM_ I _QM1
* Mar 30 23:08:19. 283: ISAKMP :( 1001): Input = IKE_MESG_INTERNAL, IKE_PHASE1
R1 # _ COMPLETE
* Mar 30 23:08:19. 283: ISAKMP :( 1001): Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

* Mar 30 23:08:19. 395: ISAKMP (): received packet from 10.0.0.2 dport 500 sport 500 Global (I) QM_IDLE
* Mar 30 23:08:19. 403: ISAKMP :( 1001): processing HASH payload. message ID =-479716604
* Mar 30 23:08:19. 403: ISAKMP :( 1001): processing SA payload. message ID =-479716604
* Mar 30 23:08:19. 403: ISAKMP :( 1001): Checking IPSec proposal 1
* Mar 30 23:08:19. 403: ISAKMP: transform 1, ESP_3DES
* Mar 30 23:08:19. 403: ISAKMP: attributes in transform:
* Mar 30 23:08:19. 403: ISAKMP: encaps is 1 (Tunnel)
* Mar 30 23:08:19. 403: ISAKMP: SA life type in seconds
* Mar 30 23:08:19. 403: ISAKMP: SA life duration (basic) of 3600
* Mar 30 23:08:19. 403: ISAKMP: SA life type in kilobytes
* Mar 30 23:08:19. 403: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
* Mar 30 23:08:19. 403: ISAKMP: authenticator is HMAC-MD5
* Mar 30 23:08:19. 403: ISAKMP :( 1001):
R1 # ts are acceptable.
* Mar 30 23:08:19. 403: IPSEC (validate_proposal_request): proposal part #1
* Mar 30 23:08:19. 403: IPSEC (validate_proposal_request): proposal part #1,
(Key eng. msg.) INBOUND local = 10.0.0.1, remote = 10.0.0.2,
Local_proxy = 1.1.1.1/255.255.255.255/1/0 (type = 1 ),
Remote_proxy = 2.2.2.2/255.255.255.255/1/0 (type = 1 ),
Protocol = ESP, transform = esp-3des esp-md5-hmac (Tunnel ),
Lifedur = 0 s and 0kb,
Spi = 0x0 (0), conn_id = 0, keysize = 0, flags = 0x0
* Mar 30 23:08:19. 403: Crypto mapdb: proxy_match
Src addr: 1.1.1.1
Dst addr: 2.2.2.2
Protocol: 1
Src port: 0
Dst port: 0
* Mar 30 23:08:19. 403: ISAKMP :( 1001): processing NONCE payload. message ID =-479716604
* Mar 30 23:08:19. 403: ISAKMP :( 1001): processing ID payload. message ID =-479716604
* Mar 30 23:08:19. 403: ISAKMP :( 1001): processing ID payload. message ID =-479716604
* Mar 30 23:08:19. 407: ISAKMP :( 1001): Creating IPSec SAs
* Mar 30 23:08:19. 411: inboun
R1 # d SA from 10.0.0.2 to 10.0.0.1 (f/I) 0/0
(Proxy 2.2.2.2 to 1.1.1.1)
* Mar 30 23:08:19. 415: has spi 0x1AA6B7AE and conn_id 0
* Mar 30 23:08:19. 415: lifetime of 3600 seconds
* Mar 30 23:08:19. 415: lifetime of 4608000 kilobytes
* Mar 30 23:08:19. 419: outbound SA from 10.0.0.1 to 10.0.0.2 (f/I) 0/0
(Proxy 1.1.1.1 to 2.2.2.2)
* Mar 30 23:08:19. 423: has spi 0x2E523B94 and conn_id 0
* Mar 30 23:08:19. 423: lifetime of 3600 seconds
* Mar 30 23:08:19. 423: lifetime of 4608000 kilobytes
* Mar 30 23:08:19. 427: ISAKMP :( 1001): sending packet to 10.0.0.2 my_port 500 peer_port 500 (I) QM_IDLE
* Mar 30 23:08:19. 427: ISAKMP :( 1001): deleting node-479716604 error FALSE reason "No Error"
* Mar 30 23:08:19. 427: ISAKMP :( 1001): Node-479716604, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
* Mar 30 23:08:19. 427: ISAKMP :( 1001): Old State = IKE_QM_ I _QM1 New State = IKE_QM_PHASE2_COMPLETE
* Mar 30 23:08:19. 427: IPSEC (key_engine): got a q
R1 # ueue event with 1 KMI message (s)
* Mar 30 23:08:19. 427: Crypto mapdb: proxy_match
Src addr: 1.1.1.1
Dst addr: 2.2.2.2
Protocol: 1
Src port: 0
Dst port: 0
* Mar 30 23:08:19. 427: IPSEC (crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer 10.0.0.2
* Mar 30 23:08:19. 427: IPSEC (policy_db_add_ident): src 1.1.1.1, dest 2.2.2.2, dest_port 0

* Mar 30 23:08:19. 427: IPSEC (create_sa): sa created,
(Sa) sa_dest = 10.0.0.1, sa_proto = 50,
Sa_spi = 0x1AA6B7AE (447133614 ),
Sa_trans = esp-3des esp-md5-hmac, sa_conn_id = 1
* Mar 30 23:08:19. 427: IPSEC (create_sa): sa created,
(Sa) sa_dest = 10.0.0.2, sa_proto = 50,
Sa_spi = 0x2E523B94 (777141140 ),
Sa_trans = esp-3des esp-md5-hmac, sa_conn_id = 2
* Mar 30 23:08:19. 431: IPSEC (update_current_outbound_sa): updated peer 10.0.0.2 current outbound sa to SPI 2E523B94

R1 # show crypto isakmp sa
IPv4 Crypto ISAKMP SA
Dst src state conn-id slot status
10.0.0.2 10.0.0.1 QM_IDLE 1001 0 ACTIVE

IPv6 Crypto ISAKMP SA

========================================================== ========================================================== ======================================
R1 # show crypto ipsec sa

Interface: FastEthernet0/0
Crypto map tag: R1VPN, local addr 10.0.0.1

Protected vrf: (none)
Local ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/1/0)
Remote ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/1/0)
Current_peer 10.0.0.2 port 500
PERMIT, flags = {origin_is_acl ,}
# Pkts encaps: 4, # pkts encrypt: 4, # pkts digest: 4
# Pkts decaps: 4, # pkts decrypt: 4, # pkts verify: 4
# Pkts compressed: 0, # pkts decompressed: 0
# Pkts not compressed: 0, # pkts compr. failed: 0
# Pkts not decompressed: 0, # pkts decompress failed: 0
# Send errors 1, # recv errors 0

Local crypto endpt.: 10.0.0.1, remote crypto endpt.: 10.0.0.2
Path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
Current outbound spi: 0x2E523B94 (777141140)

Inbound esp sas:
Spi: 0x1AA6B7AE (447133614)
Transform: esp-3des esp-md5-hmac,
In use settings = {Tunnel ,}
Conn id: 1, flow_id: 1, crypto map: R1VPN
Sa timing: remaining key lifetime (k/sec): (4455635/3328)
IV size: 8 bytes
Replay detection support: Y
Status: ACTIVE

Inbound ah sas:

Inbound pcp sas:

Outbound esp sas:
Spi: 0x2E523B94 (777141140)
Transform: esp-3des esp-md5-hmac,
In use settings = {Tunnel ,}
Conn id: 2, flow_id: 2, crypto map: R1VPN
Sa timing: remaining key lifetime (k/sec): (4455635/3321)
IV size: 8 bytes
Replay detection support: Y
Status: ACTIVE

Outbound ah sas:

Outbound pcp sas:
========================================================== ========================================================== ======================================
R1 # show crypto session
Crypto session current status

Interface: FastEthernet0/0
Session status: UP-ACTIVE
Peer: 10.0.0.2 port 500
Ike sa: local 10.0.0.1/500 remote 10.0.0.2/500 Active
Ipsec flow: permit 1 host 1.1.1.1 host 2.2.2.2
Active SAs: 2, origin: crypto map