Cisco dCloud lab - CONFIGURING SITE TO SITE IPSEC VPN TUNNEL BETWEEN CISCO ROUTERS - c5921_ubuntu32...

fcolumbu · ‎11-22-2015

This configuration is used with “Introduction to the Cisco 5921 Embedded Services Router v1” in dCloud.

Derived from:

http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/867-cisco-router-site-to-site-ipsec-vpn.html

Lines in BOLD ORANGE are changes made to the existing configuration to do the lab exercise.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2015.11.21 23:08:52 =~=~=~=~=~=~=~=~=~=~=~=

c5921_ubuntu32_1#wr t

Building configuration...

Current configuration : 5442 bytes

!

! Last configuration change at 23:06:09 PST Sat Nov 21 2015

! NVRAM config last updated at 23:06:13 PST Sat Nov 21 2015

!

version 15.5

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

service call-home

!

hostname c5921_ubuntu32_1

!

boot-start-marker

boot-end-marker

!

enable secret 5 $1$x.6O$4UZX1B5lYLF1DeOul7GiV1

enable password cisco

!

no aaa new-model

bsd-client server url https://cloudsso.cisco.com/as/token.oauth2

clock timezone PST -8 0

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

call-home

! if contact email address in call-home is configured as sch-smart-licensing@cisco.com

! The email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications

contact-email-addr sch-smart-licensing@cisco.com

profile "CiscoTAC-1"

active

destination transport-method http

no destination transport-method email

!

ip name-server 8.8.8.8

ip cef

no ipv6 cef

!

multilink bundle-name authenticated

!

crypto pki trustpoint SLA-TrustPoint

enrollment pkcs12

revocation-check crl

!

crypto pki certificate chain SLA-TrustPoint

certificate ca 01

30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030

32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363

6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934

3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305

43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720

526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030

82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D

CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520

1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE

4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC

7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188

68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7

C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191

C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44

DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201

06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85

4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500

03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905

604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B

D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8

467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C

7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B

5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678

80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB

418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0

D697DF7F 28

quit

license udi pid CISCO5921-K9 sn 91J81443B9I

license platform throughput level c5921-x86-level3

!

redundancy

!

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key cisco123 address 172.23.1.121

!

crypto ipsec transform-set myset esp-3des esp-md5-hmac

mode tunnel

!

crypto map CMAP 10 ipsec-isakmp

set peer 172.23.1.121

set transform-set myset

match address VPN-TRAFFIC

!

interface Loopback0

ip address 10.0.0.120 255.255.255.255

!

interface Loopback1

description Inside interface

ip address 10.1.1.1 255.255.255.0

ip nat inside

ip virtual-reassembly in

!

interface Ethernet0/0

description Outside interface

ip address 172.23.1.120 255.255.255.0

ip nat outside

ip virtual-reassembly in

duplex full

speed 1000

no mop enabled

crypto map CMAP

!

interface Ethernet0/1

ip address 172.23.2.1 255.255.255.0

shutdown

duplex full

speed 1000

!

interface Ethernet0/2

ip address 172.23.3.1 255.255.255.0

shutdown

duplex full

speed 1000

!

interface Ethernet0/3

ip address 172.23.4.1 255.255.255.0

shutdown

duplex full

speed 1000

!

interface Ethernet1/0

description TAP interface

ip address 198.18.134.131 255.255.192.0

!

interface Ethernet1/1

no ip address

shutdown

!

interface Ethernet1/2

no ip address

shutdown

!

interface Ethernet1/3

no ip address

shutdown

!

router ospf 100

network 10.0.0.0 0.255.255.255 area 0

network 172.23.1.0 0.0.0.255 area 0

network 172.23.2.0 0.0.0.255 area 0

network 172.23.3.0 0.0.0.255 area 0

network 172.23.4.0 0.0.0.255 area 0

network 198.18.128.0 0.0.63.255 area 0

default-information originate

!

ip forward-protocol nd

!

no ip http server

no ip http secure-server

ip nat inside source list 100 interface Loopback1 overload

ip route 0.0.0.0 0.0.0.0 198.18.134.120

!

ip access-list extended VPN-TRAFFIC

permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

!

snmp-server community public RO

!

access-list 100 remark -=[Define NAT Service]=-

access-list 100 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

access-list 100 permit ip 10.2.2.0 0.0.0.255 any

!

control-plane

!

line con 0

logging synchronous

line aux 0

line vty 0 4

password cisco

login

transport input all

!

ntp server 198.18.134.132

!

end

c5921_ubuntu32_1#show crypto session

Crypto session current status

Interface: Ethernet0/0

Session status: UP-ACTIVE

Peer: 172.23.1.121 port 500

Session ID: 0

IKEv1 SA: local 172.23.1.120/500 remote 172.23.1.121/500 Active

IPSEC FLOW: permit ip 10.1.1.0/255.255.255.0 10.2.2.0/255.255.255.0

Active SAs: 4, origin: crypto map

c5921_ubuntu32_1#show crypto isakmp sa detail

Codes: C - IKE configuration mode, D - Dead Peer Detection

K - Keepalives, N - NAT-traversal

T - cTCP encapsulation, X - IKE Extended Authentication

psk - Preshared key, rsig - RSA signature

renc - RSA encryption

IPv4 Crypto ISAKMP SA

C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.

1001 172.23.1.120 172.23.1.121 ACTIVE aes md5 psk 2 23:08:57

Engine-id:Conn-id = SW:1

IPv6 Crypto ISAKMP SA

c5921_ubuntu32_1# show crypto ipsec sa

interface: Ethernet0/0

Crypto map tag: CMAP, local addr 172.23.1.120

protected vrf: (none)

local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)

current_peer 172.23.1.121 port 500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 0, #recv errors 0

local crypto endpt.: 172.23.1.120, remote crypto endpt.: 172.23.1.121

plaintext mtu 1390, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0

current outbound spi: 0x9FF24064(2683453540)

PFS (Y/N): N, DH group: none

inbound esp sas:

spi: 0x1C810439(478217273)

transform: esp-256-aes esp-sha512-hmac ,

in use settings ={Tunnel, }

conn id: 1, flow_id: SW:1, sibling_flags 80000070, crypto map: CMAP

sa timing: remaining key lifetime (k/sec): (4282818/527)

IV size: 16 bytes

replay detection support: Y

Status: ACTIVE(ACTIVE)

inbound ah sas:

spi: 0x87BD5EC6(2277334726)

transform: ah-sha-hmac ,

in use settings ={Tunnel, }

conn id: 1, flow_id: SW:1, sibling_flags 80000070, crypto map: CMAP

sa timing: remaining key lifetime (k/sec): (4282818/527)

replay detection support: Y

Status: ACTIVE(ACTIVE)

inbound pcp sas:

outbound esp sas:

spi: 0x668F64B(107542091)

transform: esp-256-aes esp-sha512-hmac ,

in use settings ={Tunnel, }

conn id: 2, flow_id: SW:2, sibling_flags 80000070, crypto map: CMAP

sa timing: remaining key lifetime (k/sec): (4282821/527)

IV size: 16 bytes

replay detection support: Y

Status: ACTIVE(ACTIVE)

outbound ah sas:

spi: 0x9FF24064(2683453540)

transform: ah-sha-hmac ,

in use settings ={Tunnel, }

conn id: 2, flow_id: SW:2, sibling_flags 80000070, crypto map: CMAP

sa timing: remaining key lifetime (k/sec): (4282821/527)

replay detection support: Y

Status: ACTIVE(ACTIVE)

outbound pcp sas:

c5921_ubuntu32_1#sh ver

Cisco IOS Software, C5921 Software (C5921_I86-UNIVERSALK9-M), Version 15.5(2)T, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Compiled Wed 25-Mar-15 15:49 by prod_rel_team

ROM: Bootstrap program is Linux

c5921_ubuntu32_1 uptime is 1 hour, 6 minutes

System returned to ROM by reload at 0

System restarted at 22:04:40 PST Sat Nov 21 2015

System image file is "unix:./c5921i86-universalk9-ms.SPA"

Last reload reason: Unknown reason

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

Cisco C5921 (Intel-x86) processor with 381079K bytes of memory.

Processor board ID 100

8 Ethernet interfaces

512K bytes of NVRAM.

License Info:

License UDI:

-------------------------------------------------

Device# PID SN

-------------------------------------------------

*0 CISCO5921-K9 91J81443B9I

Packet forwarding: Enabled

Enforced traffic rate: 50 Mbps

Configuration register is 0x0

c5921_ubuntu32_1#

fcolumbu · ‎03-05-2018

Please restore these pages ASAP.

Cisco dCloud lab - CONFIGURING SITE TO SITE IPSEC VPN TUNNEL BETWEEN CISCO ROUTERS - c5921_ubuntu32_1 - View