Router configuration basics: Configure IPsec statement learning notes

Many people do not quite understand the meaning of configuring IPsec statements. The following describes the problem in detail. With the increasing popularity of Internet, the low cost of Internet access has prompted more and more enterprises to use VPN to achieve remote connection. Compared with traditional WAN connections such as leased lines, frame relay, and ATM, VPN not only has much lower cost, but also has no less security. Today we will mainly introduce how to use a router to configure a remote connection from an IPsec statement site to a site, at the same time, NAT is used for Internet access.

1. Configure IPsec statements

R1 route:
R1 (config) # int f0/0
R1 (config-if) # ip address 13.0.0.1 255.0.0.0 configure the interface ip address
R1 (config-if) # no shutdown
R1 (config) # int loopback 0
R1 (config-if) # ip address 192.168.1.1 255.255.255.0 configure the loopback address for testing
R1 (config) # ip route 0.0.0.0 0.0.0.0 13.0.0.3 set the default static route
R3 route:
R3 (config) # int f0/0
R3 (config-if) # ip address 13.0.0.3 255.0.0.0 configure the interface ip address
R3 (config-if) # no shutdown
R3 (config) # int f0/1
R3 (config-if) # ip add 23.0.0.3 255.0.0.0 configure the interface ip Address
R3 (config-if) # no shutdown
R2 route:
R2 (config) # int f0/0
R2 (config-if) # ip address 23.0.0.2 255.0.0.0 configure the interface ip address
R2 (config-if) # no shutdown
R2 (config) # int loopback 0
R2 (config-if) # ip address 172.16.1.1 255.255.0.0 configure the loopback address for testing
R2 (config) # ip route 0.0.0.0 0.0.0.0 23.0.0.3 set the default static route

Ii. VPN configuration

Step 1 configure IKE negotiation
R1 (config) # crypto isakmp policy 100 sets up an IKE negotiation policy
R1 (config-isakmap) # authentication pre-share sets the pre-shared key to be used by the route
R1 (config) # crypto isakmp key jxxh address 23.0.0.2 set the shared key and peer address jxxh as the key

R2 (config) # crypto isakmp policy 100 create an IKE negotiation policy
R2 (config-isakmap) # authentication pre-shareRouter settingsPre-shared key to be used
R2 (config) # crypto isakmp key jxxh address 13.0.0.1 set the shared key and peer address jxxh as the key

Step 2 configure IPSEC statement Parameters
R1 (config) # crypto ipsec transform-set jxxhset esp-des
R1 (config) # access-list 101 permit ip 192.168.1.0 0.0.255 172.16.0.0 0.0.255.255 the access control list is defined here
R2 (config) # crypto ipsec transform-set jxxhset esp-des both sides of the transmission mode should have the same name
R2 (config) # access-list 101 permit ip 172.16.0.0 0.0.255.255 192.168.1.0 0.0.255

Step 3 apply configurations to interfaces
R1 (config) # crypto map jxxhmap 110 ipsec-isakmp adopts IKE negotiation with a priority of 110
R1 (config-crypto-map) # set peer 23.0.0.2 specify the IP address of the peer VPN Link
R1 (config-crypto-map) # set transform-set jxxhset specifies the previously defined transmission mode
R1 (config-crypto-map) # match address 101 indicates the list of reverse Q & A controls used. MATCH indicates matching.
R1 (config) # int f0/0
R1 (config-if) # crypto map jxxhmap apply this table to the port

R2 (config) # crypto map jxxhmap 110 configure IPsec statements using IKE negotiation. The priority is 110. Here jxxhmap is the name of a table.
R2 (config-crypto-map) # set peer 13.0.0.1 specifies the IP address of the VPN link peer.
R2 (config-crypto-map) # set transform-set jxxhset specifies the previously defined transmission mode
R2 (config-crypto-map) # match address 101 indicates the list of reverse Q & A controls used. MATCH indicates matching.
R2 (config) # int f0/0
R2 (config-if) # crypto map jxxhmap apply this table to the port

NAT configuration

R1 (config) # access list 102 deny ip 192.168.1.0 0.0.255 172.16.0.0 0.0.255.255
R1 (config) # access list 102 permit ip any
R1 (config) # ip nat inside source list 102 int f0/0 overload configure NAT
R1 (config) # int f0/0
R1 (config) # ip nat outside
R1 (config) # int lo 0 physical interface is recommended
R1 (config) # ip nat inside
R2 (config) # access list 102 deny ip 172.16.0.0 0.0.255.255 192.168.1.0.0.0.255
R2 (config) # access list 102 permit ip any
R2 (config) # ip nat inside source list 102 int f0/0 overload configure NAT
R2 (config) # int f0/0
R2 (config) # ip nat outside
R2 (config) # int lo 0 physical interface is recommended
R2 (config) # ip nat inside