IPsec VPN Crypto Map Based Example

Applied version

• R2 R4
  • Cisco IOS version 15.6(2)T

! IP Routing between VPN underlay

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 10.0.12.1

! Crypto endpoint authentication

crypto isakmp key ISAKMP_SECRET address 4.4.4.4

! Proxy ACL

ip access-list extended IP26_TO_47

permit ip 10.0.26.0 0.0.0.255 10.0.47.0 0.0.0.255

! ISAKMP/IKE Phase 1 security parameters

crypto isakmp policy 10

encryption des

hash md5

authentication pre-share

group 2

! ISAKMP/IKE Phase 2 security parameters

crypto ipsec transform-set XF esp-des esp-md5-hmac

mode tunnel

! Crypto map parameters

crypto map MAP1 local-address Loopback0

!

crypto map MAP1 10 ipsec-isakmp

set peer 4.4.4.4

set transform-set XF

set pfs group2

match address IP26_TO_47

! Apply crypto map to interface

interface GigabitEthernet0/0

crypto map MAP1

! IP Routing between VPN underlay

 ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 10.0.34.3

! Crypto endpoint authentication

crypto isakmp key ISAKMP_SECRET address 2.2.2.2

! Proxy ACL

ip access-list extended IP47_TO_26

permit ip 10.0.47.0 0.0.0.255 10.0.26.0 0.0.0.255

! ISAKMP/IKE Phase 1 security parameters

crypto isakmp policy 10

encryption des

hash md5

authentication pre-share

group 2

! ISAKMP/IKE Phase 2 security parameters

crypto ipsec transform-set XF esp-des esp-md5-hmac

mode tunnel

! Crypto map parameters

crypto map MAP1 local-address Loopback0

!

crypto map MAP1 10 ipsec-isakmp

set peer 2.2.2.2

set transform-set XF

set pfs group2

match address IP47_TO_26

! Apply crypto map to interface

interface GigabitEthernet0/0

crypto map MAP1

! Reset security association

clear crypto sa

clear crypto isakmp

! ISAKMP SA

R2#show crypto isakmp sa

dst             src             state          conn-id status

4.4.4.4         2.2.2.2         QM_IDLE           1004 ACTIVE

! IPsec SA

R2#show crypto ipsec sa

interface: GigabitEthernet0/0

Crypto map tag: MAP1, local addr 2.2.2.2

local  ident (addr/mask/prot/port): (10.0.26.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (10.0.47.0/255.255.255.0/0/0)

current_peer 4.4.4.4 port 500

#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4

#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4

local crypto endpt.: 2.2.2.2, remote crypto endpt.: 4.4.4.4

plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0

PFS (Y/N): Y, DH group: group2

inbound esp sas:

spi: 0x3158897A(827885946)

in use settings ={Tunnel, }

replay detection support: Y

Status: ACTIVE(ACTIVE)

outbound esp sas:

spi: 0xBEDC9551(3202127185)

in use settings ={Tunnel, }

replay detection support: Y

Status: ACTIVE(ACTIVE)

! Crypto Engine Connections

R2#show crypto engine connection active

ID  Type    Algorithm           Encrypt  Decrypt LastSeqN IP-Address

9  IPsec   DES+MD5                   0        4        4 2.2.2.2

10  IPsec   DES+MD5                   4        0        0 2.2.2.2

1004  IKE     MD5+DES                   0        0        0 2.2.2.2

! Reset security association

clear crypto sa

clear crypto isakmp

! ISAKMP SA

R4#show crypto isakmp sa

dst             src             state          conn-id status

4.4.4.4         2.2.2.2         QM_IDLE           1004 ACTIVE

! IPsec SA

R4#show crypto ipsec sa

interface: GigabitEthernet0/0

Crypto map tag: MAP1, local addr 4.4.4.4

local  ident (addr/mask/prot/port): (10.0.47.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (10.0.26.0/255.255.255.0/0/0)

current_peer 2.2.2.2 port 500

#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4

#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4

local crypto endpt.: 4.4.4.4, remote crypto endpt.: 2.2.2.2

plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0

PFS (Y/N): Y, DH group: group2

inbound esp sas:

spi: 0xBEDC9551(3202127185)

in use settings ={Tunnel, }

replay detection support: Y

Status: ACTIVE(ACTIVE)

outbound esp sas:

spi: 0x3158897A(827885946)

in use settings ={Tunnel, }

replay detection support: Y

Status: ACTIVE(ACTIVE)

! Crypto Engine Connections

R4#show crypto engine connection active

ID  Type    Algorithm           Encrypt  Decrypt LastSeqN IP-Address

9  IPsec   DES+MD5                   0        4        4 4.4.4.4

10  IPsec   DES+MD5                   4        0        0 4.4.4.4

1004  IKE     MD5+DES                   0        0        0 4.4.4.4