VPN Site-to-Site CLI Configuration

We are going to configure site-to-site VPN (site-to-site) between head office (Lahore) and our regional office (Peshawar), so here i am going to briefly discuss VPN i.e



1. How VPN are established
2. Configuring IKE Phase-1 parameters
3. Configuring IKE Phase-2 parameters
4. Configuring Interesting Traffic
5. CLI configuration

Cisco Router Perspective of VPN Connection

1. The routers recieve traffic considered "WORTHY" of establishing a VPN connection.
2. IKE Phase-1 negotiated, security association (SA) established.
3. IKE Phase-2 negotiated, security association established.
4. Data tranmitted through IPSec tunnel.
5. Once transmission complete, IPSec tunnel turn down (If you configure Time).

**: After 24-hours it can re-negotiated session key
**: After certain amount of data can re-negotiate the key.

Configuration:

1. Set up ISKAMP Policy (IKE Phase-1)
2. Set up IPSec Transform set (IKE Phase-2)
3. Define Interesting Traffic
4. Set up Crypto Map
5. Assign Crypto Map to Interface

PSH-Router(config) # crypto isakmp policy 50
PSH-Router(config-isakmp) # authentication pre-share
PSH-Router(config-isakmp) # encryption aes 128
PSH-Router(config-isakmp) # group 2
PSH-Router(config-isakmp) # hash sha
PSH-Router(config-isakmp) # lifetime 5000
PSH-Router(config-isakmp) #exit

PSH-Router(config) # crypto isakmp key 0 cisco address 71.209.254.34

PSH-Router(config) # crypto ipsec transform-set DEMO esp-aes 128 esp-sha-hmac
PSH-Router(cfg-crypto-trans) #

PSH-Router(config) # ip access-list extended INT_TRAFFIC
PSH-Router(config-ext-nacl) # permit ip 172.30.0.0 0.0.255.255 192.168.1.0 0.0.0.255
PSH-Router(config-ext-nacl) # exit

Note: This is not Permit or Deny ACL, this means encrypt this traffic.

PSH-Router(config) # crypto map VPN_MAP 10 ipsec-isakmp
PSH-Router(config-crypto-map) # set peer 71.209.254.34
PSH-Router(config-crypto-map) # match address INT_TRAFFIC
PSH-Router(config-crypto-map) # set transform-set DEMO

PSH-Router(config) # interface fastethernet 0/1
PSH-Router(config-if) # crypto map VPN_MAP

Head office configuration:
And same configuration is required on the other side with just a bit of changes, lets c

Head-Office(config) # crypto isakmp policy 50
Head-Office(config-isakmp) # authentication pre-share
Head-Office(config-isakmp) # encryption aes 128
Head-Office(config-isakmp) # group 2
Head-Office(config-isakmp) # hash sha
Head-Office(config-isakmp) # lifetime 5000
Head-Office(config-isakmp) #exit

Head-Office(config) # crypto isakmp key 0 cisco address 130.13.140.129

Head-Office(config) # crypto ipsec transform-set DEMO esp-aes 128 esp-sha-hmac
Head-Office(cfg-crypto-trans) #

Head-Office(config) # ip access-list extended INT_TRAFFIC
Head-Office(config-ext-nacl) # permit ip 192.168.1.0 0.0.0.255 172.30.0.0 0.0.255.255
Head-Office(config-ext-nacl) # exit

Head-Office(config) # crypto map VPN_MAP 10 ipsec-isakmp
Head-Office(config-crypto-map) # set peer 130.13.140.129
Head-Office(config-crypto-map) # match address INT_TRAFFIC
Head-Office(config-crypto-map) # set transform-set DEMO

Head-Office(config) # interface fastethernet 0/4
Head-Office(config-if) # crypto map VPN_MAP

I used group-2 in my configuration, actually we have different diffie helmin groups like group-1 is less processor intensive but encryptio is weak (768-bit), group-2 is processor intensive but provides high bit encryption (1024-bit) and group-5 provides even more (1536-bit) encryption. so it depends on you which ever group you are using.

I hope this will be informative for You :)

Any suggestion and comments will be highly appreciated.

Cheers :)