IPsec configuration example

PC1:-

PC1> show ip

NAME :
PC1[1]

IP/MASK :
10.1.1.10/24

GATEWAY :
10.1.1.1

DNS :

MAC :
00:50:79:66:68:00

LPORT : 10005

RHOST:PORT :
127.0.0.1:10004

MTU: : 1500

R1:-

interface FastEthernet0/0

description ***
Connected to R2 ***

ip address
12.12.12.1 255.255.255.0

no shut

interface FastEthernet2/0

description *** Connected to PC1 ***

ip address
10.1.1.1 255.255.255.0

no shut

ip
route 0.0.0.0 0.0.0.0 12.12.12.2
\Default route towards
Internet \

crypto isakmp policy 1
\Phase 1 parameters \

encr 3des

hash md5

authentication
pre-share

group 2

crypto isakmp key EncryKey address 45.45.45.5 \EncryKey is the pre share key.must
match on both side

crypto ipsec transform-set VPN_R1_R5 esp-3des esp-md5-hmac \ Phase 2 Parameters \

crypto map ipsec__R1_R5 10 ipsec-isakmp

set peer
45.45.45.5
\Peer router IP
address \

set transform-set VPN_R1_R5

match address Client_traffic

ip access-list extended Client_traffic

permit ip 10.1.1.0
0.0.0.255 50.1.1.0 0.0.0.255 \interesting traffic allowed on
IPsec tunnel \

interface FastEthernet0/0

crypto map ipsec__R1_R5
\Called crypto map
under internet facing interface \

no shut

R2:-

interface FastEthernet0/0

description *** Connected to R1 ***

ip address
12.12.12.2 255.255.255.0

no shut

interface FastEthernet0/1

description *** Connected to R3 ***

ip address
23.23.23.2 255.255.255.0

no shut

router eigrp 1 \ Used to provide connectivity
between R2 to R4 only \

network 12.12.12.2
0.0.0.0

network 23.23.23.2
0.0.0.0

R3:-

interface FastEthernet0/1

description *** Connected to R2 ***

ip address
23.23.23.3 255.255.255.0

no shut

interface FastEthernet1/0

description *** Connected to R4 ***

ip address
34.34.34.3 255.255.255.0

no shut

router eigrp 1

network 23.23.23.3
0.0.0.0

network 34.34.34.3
0.0.0.0

R4:-

interface FastEthernet0/0

description *** Connected to R5 ***

ip address
45.45.45.4 255.255.255.0

speed auto

duplex auto

interface FastEthernet1/0

description *** Connected to R3 ***

ip address
34.34.34.4 255.255.255.0

no shut

router eigrp 1

network 34.34.34.4
0.0.0.0

network 45.45.45.4
0.0.0.0

R5:-

interface FastEthernet0/0

description ***
Connected to R4 ***

ip address
45.45.45.5 255.255.255.0

interface FastEthernet2/0

description *** Connected to PC2 ***

ip address
50.1.1.1 255.255.255.0

no shut

ip route 0.0.0.0 0.0.0.0 45.45.45.4 \Default route towards Internet \

crypto isakmp policy 1 \Phase 1 parameters \

encr 3des

hash md5

authentication
pre-share

group 2

crypto isakmp key EncryKey address 12.12.12.1 \EncryKey is the pre share key.must match on both side

crypto ipsec transform-set VPN_R1_R5 esp-3des
esp-md5-hmac \ Phase 2
Parameters \

crypto map ipsec__R1_R5 10 ipsec-isakmp

set peer
12.12.12.1 \Peer router IP address \

set transform-set
VPN_R1_R5

match address
Client_traffic

interface FastEthernet0/0

crypto map ipsec__R1_R5

ip access-list extended Client_traffic

permit ip 50.1.1.0 0.0.0.255 10.1.1.0 0.0.0.255 \interesting traffic allowed on IPsec tunnel \

PC2:-

PC2> show ip

NAME :
PC2[1]

IP/MASK :
50.1.1.10/24

GATEWAY :
50.1.1.1

DNS :

MAC :
00:50:79:66:68:01

LPORT : 10011

RHOST:PORT :
127.0.0.1:10010

MTU: : 1500

Verification:-

PC1:-

PC1> ping 50.1.1.10 \ Able to ping PC2 \

84 bytes from 50.1.1.10 icmp_seq=1 ttl=62 time=109.170 ms

84 bytes from 50.1.1.10 icmp_seq=2 ttl=62 time=140.362 ms

84 bytes from 50.1.1.10 icmp_seq=3 ttl=62 time=93.574 ms

84 bytes from 50.1.1.10 icmp_seq=4 ttl=62 time=109.169 ms

84 bytes from 50.1.1.10 icmp_seq=5 ttl=62 time=124.765 ms

PC1> trace 50.1.1.10

trace to 50.1.1.10, 8 hops max, press Ctrl+C to stop

1 10.1.1.1
46.787 ms 15.596 ms 15.596 ms

2 *
* *

3 *50.1.1.10
171.553 ms (ICMP type:3, code:3, Destination port unreachable)

R1:-

R1#show crypto isakmp sa \ Phase 1 verfication \

dst
src state conn-id slot status

45.45.45.5
12.12.12.1 QM_IDLE 1 0 ACTIVE
\ QM_Idle is good \

R1#show crypto ipsec sa

interface: FastEthernet0/0

Crypto map tag: ipsec__R1_R5, local addr
12.12.12.1

protected vrf:
(none)

local ident (addr/mask/prot/port):
(10.1.1.0/255.255.255.0/0/0) \interesting source traffic \

remote ident (addr/mask/prot/port):
(50.1.1.0/255.255.255.0/0/0) \interesting destination traffic \

current_peer
45.45.45.5 port 500

PERMIT,
flags={origin_is_acl,}

#pkts encaps: 4, #pkts encrypt:
4, #pkts digest: 4 \ Shows encrypted and decrypted packets \

#pkts decaps: 4, #pkts decrypt: 4, #pkts
verify: 4

#pkts
compressed: 0, #pkts decompressed: 0

#pkts not
compressed: 0, #pkts compr. failed: 0

#pkts not
decompressed: 0, #pkts decompress failed: 0

#send errors 0,
#recv errors 0

local crypto endpt.: 12.12.12.1,
remote crypto endpt.: 45.45.45.5 \ Tunnel end points \

path mtu 1500,
ip mtu 1500, ip mtu idb FastEthernet0/0

current
outbound spi: 0xFB8DE8A1(4220381345)

inbound esp
sas:

spi:
0xF4E3ADA1(4108561825)

transform:
esp-3des esp-md5-hmac ,

in use
settings ={Tunnel, }

conn id:
2003, flow_id: SW:3, crypto map: ipsec__R1_R5

sa timing:
remaining key lifetime (k/sec): (4501412/3567)

IV size: 8
bytes

replay
detection support: Y

Status: ACTIVE \ Phase2 is up \

inbound ah
sas:

inbound pcp
sas:

outbound esp
sas:

spi:
0xFB8DE8A1(4220381345)

transform:
esp-3des esp-md5-hmac ,

in use
settings ={Tunnel, }

conn id:
2002, flow_id: SW:2, crypto map: ipsec__R1_R5

sa timing:
remaining key lifetime (k/sec): (4501412/3565)

IV size: 8
bytes

replay
detection support: Y

Status: ACTIVE \ Phase2 is up \

outbound ah
sas:

outbound pcp
sas:

R1#sh ip access-lists

Extended IP access list Client_traffic

10 permit ip
10.1.1.0 0.0.0.255 50.1.1.0 0.0.0.255 (8 matches) \ ACL hit count shows that traffic is hitting Router \

R1#sh ip route

Codes: C – connected, S – static, R – RIP, M – mobile, B
– BGP

D – EIGRP,
EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF
NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF
external type 1, E2 – OSPF external type 2

i – IS-IS,
su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2

ia – IS-IS
inter area, * – candidate default, U – per-user static route

o – ODR, P –
periodic downloaded static route

Gateway of last resort is 12.12.12.2 to network 0.0.0.0

10.0.0.0/24 is
subnetted, 1 subnets

C 10.1.1.0 is
directly connected, FastEthernet2/0

12.0.0.0/24 is
subnetted, 1 subnets

C 12.12.12.0
is directly connected, FastEthernet0/0

S* 0.0.0.0/0
[1/0] via 12.12.12.2

R2:-

R2#sh ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(1)

H Address Interface Hold Uptime SRTT
RTO Q Seq

(sec) (ms) Cnt Num

0 23.23.23.3 Fa0/1 14 01:22:19 41
246 0 8

R2#sh ip route

Codes: L – local, C – connected, S – static, R – RIP, M –
mobile, B – BGP

D – EIGRP,
EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF
NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF
external type 1, E2 – OSPF external type 2

i – IS-IS,
su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2

ia – IS-IS
inter area, * – candidate default, U – per-user static route

o – ODR, P –
periodic downloaded static route, H – NHRP

+ –
replicated route, % – next hop override

Gateway of last resort is not set

12.0.0.0/8 is
variably subnetted, 2 subnets, 2 masks

C
12.12.12.0/24 is directly connected, FastEthernet0/0

L
12.12.12.2/32 is directly connected, FastEthernet0/0

23.0.0.0/8 is
variably subnetted, 2 subnets, 2 masks

C
23.23.23.0/24 is directly connected, FastEthernet0/1

L
23.23.23.2/32 is directly connected, FastEthernet0/1

34.0.0.0/24
is subnetted, 1 subnets

D 34.34.34.0
[90/30720] via 23.23.23.3, 01:22:14, FastEthernet0/1

45.0.0.0/24
is subnetted, 1 subnets

D 45.45.45.0
[90/33280] via 23.23.23.3, 01:21:20, FastEthernet0/1

R2#sh cdp neighbors

Capability Codes: R – Router, T – Trans Bridge, B –
Source Route Bridge

S
– Switch, H – Host, I – IGMP, r – Repeater, P – Phone

Device ID
Local Intrfce Holdtme Capability
Platform Port ID

R3
Fas 0/1 174 R 7206VXR
Fas 0/1

R1             Fas
0/0           163
R S I     3745      Fas 0/0

R3:-

R3#sh ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(1)

H Address Interface Hold Uptime SRTT
RTO Q Seq

(sec) (ms) Cnt Num

1 34.34.34.4 Fa1/0 11 01:21:53 47
282 0 4

0 23.23.23.2 Fa0/1 12 01:22:47 1035 5000
0 4

R3#sh ip route

Codes: L – local, C – connected, S – static, R – RIP, M –
mobile, B – BGP

D – EIGRP,
EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF
NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF
external type 1, E2 – OSPF external type 2

i – IS-IS,
su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2

ia – IS-IS
inter area, * – candidate default, U – per-user static route

o – ODR, P –
periodic downloaded static route, H – NHRP

+ –
replicated route, % – next hop override

Gateway of last resort is not set

12.0.0.0/24
is subnetted, 1 subnets

D 12.12.12.0
[90/30720] via 23.23.23.2, 01:22:48, FastEthernet0/1

23.0.0.0/8 is
variably subnetted, 2 subnets, 2 masks

C
23.23.23.0/24 is directly connected, FastEthernet0/1

L
23.23.23.3/32 is directly connected, FastEthernet0/1

34.0.0.0/8 is
variably subnetted, 2 subnets, 2 masks

C
34.34.34.0/24 is directly connected, FastEthernet1/0

L
34.34.34.3/32 is directly connected, FastEthernet1/0

45.0.0.0/24
is subnetted, 1 subnets

D 45.45.45.0
[90/30720] via 34.34.34.4, 01:21:49, FastEthernet1/0

R4:-

R4#sh ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(1)

H Address Interface Hold Uptime SRTT
RTO Q Seq

(sec) (ms) Cnt Num

0 34.34.34.3 Fa1/0 14 01:59:20 1270 5000
0 7

R4#sh ip route

Codes: L – local, C – connected, S – static, R – RIP, M –
mobile, B – BGP

D – EIGRP,
EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF
NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF
external type 1, E2 – OSPF external type 2

i – IS-IS,
su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2

ia – IS-IS
inter area, * – candidate default, U – per-user static route

o – ODR, P –
periodic downloaded static route, H – NHRP

+ –
replicated route, % – next hop override

Gateway of last resort is not set

12.0.0.0/24
is subnetted, 1 subnets

D 12.12.12.0
[90/33280] via 34.34.34.3, 01:59:21, FastEthernet1/0

23.0.0.0/24
is subnetted, 1 subnets

D 23.23.23.0
[90/30720] via 34.34.34.3, 01:59:21, FastEthernet1/0

34.0.0.0/8 is
variably subnetted, 2 subnets, 2 masks

C 34.34.34.0/24
is directly connected, FastEthernet1/0

L
34.34.34.4/32 is directly connected, FastEthernet1/0

45.0.0.0/8 is
variably subnetted, 2 subnets, 2 masks

C
45.45.45.0/24 is directly connected, FastEthernet0/0

L
45.45.45.4/32 is directly connected, FastEthernet0/0

R5:-

R5#sh ip route

Codes: C – connected, S – static, R – RIP, M – mobile, B
– BGP

D – EIGRP,
EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF
NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF
external type 1, E2 – OSPF external type 2

i – IS-IS,
su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2

ia – IS-IS
inter area, * – candidate default, U – per-user static route

o – ODR, P –
periodic downloaded static route

Gateway of last resort is 45.45.45.4 to network 0.0.0.0

50.0.0.0/24 is
subnetted, 1 subnets

C 50.1.1.0 is
directly connected, FastEthernet2/0

45.0.0.0/24 is
subnetted, 1 subnets

C 45.45.45.0
is directly connected, FastEthernet0/0

S* 0.0.0.0/0
[1/0] via 45.45.45.4

R5#sh crypto isakmp sa
\ Phase1 is up \

dst
src state conn-id slot status

45.45.45.5
12.12.12.1 QM_IDLE 1 0 ACTIVE

R5#show crypto ipsec sa

interface: FastEthernet0/0

Crypto map tag:
ipsec__R1_R5, local addr 45.45.45.5

protected vrf:
(none)

local ident (addr/mask/prot/port):
(50.1.1.0/255.255.255.0/0/0)

remote ident
(addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)

current_peer
12.12.12.1 port 500

PERMIT,
flags={origin_is_acl,}

#pkts encaps: 22, #pkts encrypt:
22, #pkts digest: 22 \ Number of packets encrypted \

#pkts decaps: 22, #pkts decrypt: 22, #pkts
verify: 22 \ Number of packets decrypted \

#pkts
compressed: 0, #pkts decompressed: 0

#pkts not
compressed: 0, #pkts compr. failed: 0

#pkts not
decompressed: 0, #pkts decompress failed: 0

#send errors 2,
#recv errors 0

local crypto endpt.: 45.45.45.5,
remote crypto endpt.: 12.12.12.1
\ Tunnel end points \

path mtu 1500,
ip mtu 1500, ip mtu idb FastEthernet0/0

current
outbound spi: 0xF4E3ADA1(4108561825)

inbound esp
sas:

spi:
0xFB8DE8A1(4220381345)

transform:
esp-3des esp-md5-hmac ,

in use
settings ={Tunnel, }

conn id:
2003, flow_id: SW:3, crypto map: ipsec__R1_R5

sa timing:
remaining key lifetime (k/sec): (4607263/1083)

IV size: 8
bytes

replay
detection support: Y

Status:
ACTIVE \ Phase2 is up \

inbound ah
sas:

inbound pcp
sas:

outbound esp
sas:

spi:
0xF4E3ADA1(4108561825)

transform:
esp-3des esp-md5-hmac ,

in use
settings ={Tunnel, }

conn id:
2002, flow_id: SW:2, crypto map: ipsec__R1_R5

sa timing:
remaining key lifetime (k/sec): (4607263/1068)

IV size: 8
bytes

replay
detection support: Y

Status:
ACTIVE \ Phase2 is up \

outbound ah
sas:

outbound pcp
sas:

protected vrf:
(none)

local ident (addr/mask/prot/port):
(10.1.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port):
(50.1.1.0/255.255.255.0/0/0)

current_peer
12.12.12.1 port 500

PERMIT,
flags={origin_is_acl,}

#pkts encaps:
0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps:
0, #pkts decrypt: 0, #pkts verify: 0

#pkts
compressed: 0, #pkts decompressed: 0

#pkts not
compressed: 0, #pkts compr. failed: 0

#pkts not
decompressed: 0, #pkts decompress failed: 0

#send errors 0,
#recv errors 0

local crypto endpt.: 45.45.45.5,
remote crypto endpt.: 12.12.12.1

path mtu 1500,
ip mtu 1500, ip mtu idb FastEthernet0/0

current
outbound spi: 0x0(0)

inbound esp
sas:

inbound ah
sas:

inbound pcp
sas:

outbound esp
sas:

outbound ah
sas:

outbound pcp
sas:

protected vrf:
(none)

local ident (addr/mask/prot/port):
(50.1.1.0/255.255.255.0/10/0)

remote ident
(addr/mask/prot/port): (10.1.1.0/255.255.255.0/10/0)

current_peer
12.12.12.1 port 500

PERMIT,
flags={origin_is_acl,}

#pkts encaps:
0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps:
0, #pkts decrypt: 0, #pkts verify: 0

#pkts
compressed: 0, #pkts decompressed: 0

#pkts not
compressed: 0, #pkts compr. failed: 0

#pkts not
decompressed: 0, #pkts decompress failed: 0

#send errors 0,
#recv errors 0

local crypto
endpt.: 45.45.45.5, remote crypto endpt.: 12.12.12.1

path mtu 1500,
ip mtu 1500, ip mtu idb FastEthernet0/0

current
outbound spi: 0x0(0)

inbound esp
sas:

inbound ah
sas:

inbound pcp
sas:

outbound esp
sas:

outbound ah
sas:

outbound pcp
sas:

R5#
show crypto session detail

Crypto session current status

Code: C – IKE Configuration mode, D – Dead Peer Detection

K – Keepalives, N – NAT-traversal, X – IKE Extended
Authentication

Interface: FastEthernet0/0

Session status: UP-ACTIVE

Peer: 12.12.12.1 port 500 fvrf: (none) ivrf: (none)

Phase1_id:
12.12.12.1

Desc: (none)

IKE SA: local
45.45.45.5/500 remote 12.12.12.1/500 Active

Capabilities:D connid:1 lifetime:22:33:45

IPSEC FLOW:
permit ip 50.1.1.0/255.255.255.0 10.1.1.0/255.255.255.0

Active SAs:
2, origin: crypto map

Inbound: #pkts dec’ed 22 drop 0 life (KB/Sec) 4607263/1056

Outbound: #pkts enc’ed 22 drop 2 life
(KB/Sec) 4607263/1056

IPSEC FLOW:
permit ip 10.1.1.0/255.255.255.0 50.1.1.0/255.255.255.0

Active SAs:
0, origin: crypto map

Inbound: #pkts dec’ed 0 drop 0
life (KB/Sec) 0/0

Outbound:
#pkts enc’ed 0 drop 0 life (KB/Sec) 0/0

IPSEC FLOW:
permit 10 50.1.1.0/255.255.255.0 10.1.1.0/255.255.255.0

Active SAs:
0, origin: crypto map

Inbound: #pkts dec’ed 0 drop 0
life (KB/Sec) 0/0

Outbound:
#pkts enc’ed 0 drop 0 life (KB/Sec) 0/0

R5# ping
10.1.1.1 source 50.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2
seconds:

Packet sent with a source address of 50.1.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max
= 164/336/940 ms

ESW2#show crypto isakmp sa de

Codes: C – IKE configuration mode, D – Dead Peer
Detection

K –
Keepalives, N – NAT-traversal

X – IKE
Extended Authentication

psk –
Preshared key, rsig – RSA signature

renc – RSA
encryption

C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.

1
45.45.45.5 12.12.12.1 ACTIVE 3des md5 psk
2 22:21:05

Connection-id:Engine-id =
1:1(software)

PC2:-

PC2> ping 10.1.1.10 \ Able to ping PC1 \

84 bytes from 10.1.1.10 icmp_seq=1 ttl=62 time=77.979 ms

84 bytes from 10.1.1.10 icmp_seq=2 ttl=62 time=124.766 ms

84 bytes from 10.1.1.10 icmp_seq=3 ttl=62 time=140.361 ms

84 bytes from 10.1.1.10 icmp_seq=4 ttl=62 time=155.957 ms

84 bytes from 10.1.1.10 icmp_seq=5 ttl=62 time=109.170 ms

PC2> trace 10.1.1.10

trace to 10.1.1.10, 8 hops max, press Ctrl+C to stop

1 50.1.1.1
15.596 ms 15.595 ms 15.596 ms

2 10.1.1.10
140.361 ms (ICMP type:3, code:3, Destination port unreachable)