Cisco vpn configuration

 

Lab Environment

 

There are company offices, Beijing branch and Shanghai Branch, and Beijing and Shanghai branches need to access the file servers and web servers of the company.

 

Configure as shown in the following figure:

 

Router configuration

Beijing Branch

Route (config) # hostname BJROUTE

BJROUTE (config) # inter s0/0

BJROUTE (config-if) # ip add 220.231.61.165 255.255.255.0

BJROUTE (config-if) # no shutdown

BJROUTE (config) # inter e1/0

BJROUTE (config-if) # ip add 192.168.1.1 255.255.0

BJROUTE (config-if) # no shutdown

BJROUTE (config) # ip route 0.0.0.0 0.0.0.0 220.231.61.1

Shanghai Branch

Route (config) # hostname SHROUTE

SHROUTE (config) # inter s0/0

SHROUTE (config-if) # ip add 114.115.26.107 255.255.255.0

SHROUTE (config-if) # no shut

SHROUTE (config-if) # inter e1/0

SHROUTE (config-if) # ip add 172.16.0.1 255.255.255.0.0

SHROUTE (config-if) # no shutdown

SHROUTE (config) # ip route 0.0.0.0 0.0.0.0 114.115.26.1

Public Network

Router (config) # hostname NETROUTE

NETROUTE (config) # inter s0/0

NETROUTE (config-if) # ip add 220.231.61.1 255.255.255.0

NETROUTE (config-if) # no shut

NETROUTE (config-if) # inter s0/1

NETROUTE (config-if) # ip add 114.115.26.1 255.255.255.0

NETROUTE (config-if) # no shut

NETROUTE (config-if) # inter s0/2

NETROUTE (config-if) # ip add 162.61.25.1 255.255.255.0

NETROUTE (config-if) # no shut

Headquarters Router

Router (config) # hostname HQROUT

HQROUT (config) # inter s0/0

HQROUT (config-if) # ip add 162.61.25.100 255.255.255.0

HQROUT (config-if) # no shutdown

HQROUT (config-if) # inter e1/0

HQROUT (config-if) # ip add 10.1.1.1 route 0.0.0

HQROUT (config-if) # no shutdown

HQROUT (config) # ip route 0.0.0.0 0.0.0.0 162.61.25.1

In this way, you can configure the basic route, but you cannot access the LAN address.

Test

Beijing

 

Shanghai

 

General Department

 

 

 

You can see that the Internet addresses are connected. Configure the vpn below.

Router of Beijing Branch

BJROUTE (config) # crypto isakmp enable

BJROUTE (config) # crypto isakmp policy 1

BJROUTE (config-isakmp) # hash sha

BJROUTE (config-isakmp) # encryption 3des

BJROUTE (config-isakmp) # authentication pre-share

BJROUTE (config-isakmp) # exit

BJROUTE (config) # crypto isakmp key zhaoyun123 address 161.61.25.100

BJROUTE (config) # crypto ipsec transform-set vpn1 esp-3des (esp-sha-hmac)

BJROUTE (cfg-crypto-trans) # exit

BJROUTE (config) access-list 110 permit ip 192.168.1.0 0.0.255 10.0.0.0 0.20.255

BJROUTE (config) # crypto map vpn 1 ipsec-isakmp

BJROUTE (config-crypto-map) # set peer 162.61.25.100

BJROUTE (config-crypto-map) # set transform-set vpn1

BJROUTE (config-crypto-map) # match address 110

BJROUTE (config-crypto-map) # exit

BJROUTE (config) # inter s0/0

BJROUTE (config-if) # crypto map vpn

BJROUTE (config) # ip nat inside source static 192.168.1.100 192.168.1.1

BJROUTE (config) # inter e1/0

BJROUTE (config-if) # ip nat inside

BJROUTE (config-if) # ip nat outside

Router of Shanghai Branch

 

SHROUTE (config) # crypto isakmp enable

SHROUTE (config) # crypto isakmp policy 1

SHROUTE (config-isakmp) # hash sha

SHROUTE (config-isakmp) # encryption 3des

SHROUTE (config-isakmp) # authentication pre-share

SHROUTE (config-isakmp) # exit

SHROUTE (config) # crypto isakmp key zhaoyun123 address 161.61.25.100

SHROUTE (config) # crypto ipsec transform-set vpn1 esp-3des (esp-sha-hmac)

SHROUTE (cfg-crypto-trans) # exit

SHROUTE (config) access-list 110 permit ip 172.16.0.0 0.0.255.255 10.0.0.0 0.255.255.255

SHROUTE (config) # crypto map vpn 1 ipsec-isakmp

SHROUTE (config-crypto-map) # set peer 162.61.25.100

SHROUTE (config-crypto-map) # set transform-set vpn1

SHROUTE (config-crypto-map) # match address 110

SHROUTE (config-crypto-map) # exit

SHROUTE (config) # inter s0/0

SHROUTE (config-if) # crypto map vpn

SHROUTE (config) # ip nat inside source static 172.16.0.100 172.16.0.1

SHROUTE (config) # inter e1/0

SHROUTE (config-if) # ip nat inside

SHROUTE (config-if) # ip nat outside

 

Headquarters Router

HQROUTE (config) # crypto isakmp enable

HQROUTE (config) # crypto isakmp policy 1

HQROUTE (config-isakmp) # hash sha

HQROUTE (config-isakmp) # encryption 3des

HQROUTE (config-isakmp) # authentication pre-share

HQROUTE (config-isakmp) # exit

HQROUTE (config) # crypto isakmp key zhaoyun123 address 114.115.26.107

HQROUTE (config) # crypto ipsec transform-set vpn1 esp-3des (esp-sha-hmac)

HQROUTE (cfg-crypto-trans) # exit

HQROUTE (config) access-list 110 permit ip 10.0.0.0 0.20.255.255 172.16.0.0 0.0.255.255

HQROUTE (config) # crypto map vpn 1 ipsec-isakmp

HQROUTE (config-crypto-map) # set peer 114.115.26.107

HQROUTE (config-crypto-map) # set transform-set vpn1

HQROUTE (config-crypto-map) # match address 110

HQROUTE (config-crypto-map) # exit

HQROUTE (config) # crypto isakmp key zhaoyun123 address 220.231.61.165

HQROUTE (config) # crypto ipsec transform-set vpn2 esp-3des (esp-sha-hmac)

HQROUTE (cfg-crypto-trans) # exit

HQROUTE (config) access-list 110 permit ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.255

HQROUTE (config) # crypto map vpn 1 ipsec-isakmp

HQROUTE (config-crypto-map) # set peer 220.231.61.165

HQROUTE (config-crypto-map) # set transform-set vpn2

HQROUTE (config-crypto-map) # match address 110

HQROUTE (config-crypto-map) # exit

HQROUTE (config) # inter s0/0

HQROUTE (config-if) # crypto map vpn

 

Verify the configuration.

 

 

The client can ping the headquarters address.

You can access the server at the headquarters normally.

 

Common check commands

Show crypto ipsec transform-set

Show crypto ipsec key

Show crypto isakmp policy

Show crypto map

This article is from the "Technical Exchange" blog