PacketTracer 5.2 IPsec VPN Experiment

A rough description of the network topology: Router 1 is a Router without a private IP address, currently, VPN technology is commonly used to resolve the connection between the headquarters and branches over the Internet to solve internal private addresses)
Router 3 is the headquarters, and Router 4 is the branch.
IP address planning:
Router 1 FastEthernet0/0 200.1.1.1 FastEthernet0/1 100.1.1.1
Router 3 FastEthernet0/0 192.168.1.254 FastEthernet0/1 100.1.1.2
Router 4 FastEthernet0/0 200.1.1.2 FastEthernet0/1 192.168.2.254
PC1: 192.168.1.1/24
PC2: 192.168.2.1/24
The experiment requires that the headquarters and distributed private addresses can communicate with each other! (You Can Do It Again according to my configuration. Red indicates the key code for VPN configuration. When no VPN is configured, PC1 cannot be pinged with PC2)

The configuration is as follows:
Configure Internet for Router1 ):
Interface FastEthernet0/0
Ip address 200.1.1.1 255.255.255.0
No shutdown

Interface FastEthernet0/1
Ip address 100.1.1.1 255.255.255.0
No shutdown

Configure Router 3:

Crypto isakmp policy 10
Encr 3des
Hash md5
Authentication pre-share

Crypto isakmp key tom address 200.1.1.2

Crypto ipsec transform-set tim esp-3des esp-md5-hmac

Access-list 101 permit ip 192.168.1.0 0.0.255 192.168.2.0 0.0.255


Crypto map tom 10 ipsec-isakmp
Set peer 200.1.1.2
Set transform-set tim
Match address 101
Interface FastEthernet0/0
Ip address 192.168.1.254 255.255.255.0
No shutdown

Interface FastEthernet0/1
Ip address 100.1.1.2 255.255.255.0
No shutdown
Crypto map tom

Ip route 0.0.0.0 0.0.0.0 100.1.1.1

Configure Router 4:
Crypto isakmp policy 10
Encr 3des
Hash md5
Authentication pre-share

Crypto isakmp key tom address 100.1.1.2

Crypto ipsec transform-set tim esp-3des esp-md5-hmac
!
Crypto map tom 10 ipsec-isakmp
Set peer 100.1.1.2
Set transform-set tim
Match address 101

Access-list 101 permit ip 192.168.2.0 0.0.255 192.168.1.0 0.0.255
Interface FastEthernet0/0
Ip address 200.1.1.2 255.255.255.0
No shutdown
Crypto map tom

Interface FastEthernet0/1
Ip address 192.168.2.254 255.255.255.0
No shutdown

Ip route 0.0.0.0 0.0.0.0 200.1.1.1

In the end, PC1 and PC2 can Ping each other. During the Ping process, several packets are lost because IPSec VPN negotiation is established ). Use show crypto isakmp sa and show crypto ipsec sa to view the content status after IPSec VPN negotiation.