⚙️ Module 19: Implement Site-to-Site IPsec VPNs

This module provides hands-on implementation of site-to-site IPsec VPNs using Cisco CLI commands. Students will learn the five-step IPsec negotiation process, configure ISAKMP policies for IKE Phase 1, define IPsec policies for Phase 2, create crypto maps to bind configurations, and test VPN functionality. The focus is on practical configuration using pre-shared key authentication between two sites.

Five-Step IPsec Negotiation

Step-by-Step Process

1. Interesting Traffic Detection: Traffic matching ACL criteria triggers tunnel initiation
2. IKE Phase 1 Negotiation: Peers negotiate ISAKMP SA policy for secure management channel
3. IKE Phase 1 Completion: Secure tunnel created after policy agreement and authentication
4. IKE Phase 2 Negotiation: IPsec peers negotiate IPsec SA policy through secure tunnel
5. Data Transfer: IPsec tunnel established for secure data transmission

Phase Comparison

Tunnel Termination

IPsec tunnels terminate when:

• IPsec SAs are manually deleted
• SA lifetime expires
• Network connectivity is lost
• Configuration changes require renegotiation

Phase 1 Phase 2 Tunnel Setup Data Transfer Teardown

Default ISAKMP Policies

Default Policy Parameters

R1# show crypto isakmp default policy
Default IKE policy
Default protection suite of priority 65507
encryption algorithm: AES - Advanced Encryption Standard (128 bit keys)
hash algorithm: Secure Hash Standard
authentication method: Rivest-Shamir-Adleman Signature

ISAKMP Policy Components

Custom ISAKMP Policy Configuration

Router(config)# crypto isakmp policy 10
Router(config-isakmp)# encryption aes 256
Router(config-isakmp)# hash sha256
Router(config-isakmp)# authentication pre-share
Router(config-isakmp)# group 5
Router(config-isakmp)# lifetime 86400

Pre-Shared Key Configuration

Router(config)# crypto isakmp key cisco123 address 172.30.2.2

Defining Interesting Traffic

ACL Configuration Example

R1(config)# access-list 101 permit ip 10.0.1.0 0.0.0.255 192.168.1.0 0.0.0.255
R2(config)# access-list 101 permit ip 192.168.1.0 0.0.0.255 10.0.1.0 0.0.0.255

Transform Set Configuration

Transform sets define the encryption and authentication algorithms for data protection:

Router(config)# crypto ipsec transform-set MYSET esp-aes 256 esp-sha-hmac
Router(cfg-crypto-trans)# mode tunnel

Transform Set Options

Verification Commands

R1# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst         src         state       conn-id status

R1# show crypto ipsec transform-set

Crypto Map Purpose

Crypto Map Syntax

Router(config)# crypto map map-name seq-num { ipsec-isakmp | ipsec-manual }

Parameter Descriptions

Complete Crypto Map Configuration

Router(config)# crypto map MYMAP 10 ipsec-isakmp
Router(config-crypto-map)# set peer 172.30.2.2
Router(config-crypto-map)# set transform-set MYSET
Router(config-crypto-map)# match address 101

Interface Application

Router(config)# interface serial0/0/0
Router(config-if)# crypto map MYMAP

Crypto Map Components

• Peer Address: Remote VPN gateway IP address
• Transform Set: Encryption and authentication algorithms
• Access List: Defines interesting traffic
• Lifetime: SA duration before renegotiation

Sending Interesting Traffic

Extended Ping Example

R1# ping 192.168.1.1 source 10.0.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.0.1.1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms

Verification Commands

R1# show crypto isakmp sa
R1# show crypto isakmp sa detail

R1# show crypto ipsec sa
R1# show crypto ipsec sa detail

R1# show crypto map
R1# show crypto map interface

R1# debug crypto isakmp
R1# debug crypto ipsec

Troubleshooting Common Issues

• Mismatched Policies: Ensure ISAKMP and IPsec policies match on both peers
• Incorrect ACLs: Verify interesting traffic definitions are mirror images
• Wrong Peer Address: Check crypto map peer configuration
• Pre-shared Key Mismatch: Verify identical keys on both routers
• Interface Application: Ensure crypto map applied to correct interface

GRE over IPsec

This implementation demonstrates practical IPsec VPN deployment, showing how the five-step negotiation process works in real networks and the importance of matching configurations on both peers for successful tunnel establishment.

1. What are the five steps of IPsec negotiation?
   1) Interesting traffic detection, 2) IKE Phase 1 negotiation, 3) IKE Phase 1 completion, 4) IKE Phase 2 negotiation, 5) Data transfer through IPsec tunnel.
2. What triggers the initiation of an ISAKMP tunnel?
   Interesting traffic that matches criteria defined in an ACL traveling between IPsec peers.
3. What is the purpose of a crypto map?
   To bind together interesting traffic definitions, IPsec transform sets, and peer information into a complete IPsec policy.
4. Why might the first ping fail when testing a new VPN?
   It takes a few milliseconds to establish the ISAKMP and IPsec tunnels after interesting traffic is detected.
5. What additional configuration is needed for multicast traffic over IPsec?
   GRE tunnel configuration, as IPsec only supports unicast traffic and GRE provides multiprotocol tunneling support.

• IPsec negotiation involves five steps divided into IKE Phase 1 and Phase 2
• ISAKMP policies define security parameters for IKE Phase 1 tunnel establishment
• Interesting traffic defined by ACLs triggers IPsec tunnel negotiation
• Transform sets specify encryption and authentication algorithms for data protection
• Crypto maps bind all IPsec components together and apply to interfaces
• Extended ping tests VPN functionality by sending traffic between LANs
• Multiple verification commands help troubleshoot IPsec implementations
• GRE over IPsec required for multicast routing protocol support