Build a site-to-site IPsec tunnel and read its IKE and ESP state

Steps

1. Place the devices and cable them as the Topology lists. Use the automatic connection type (the lightning-bolt cable) for every link, so Packet Tracer picks straight-through or cross-over for you. Give PC1 and PC2 their addresses and gateways in Desktop > IP Configuration. Configure ISP1 with its two links and no routes to either private LAN:

Router> enable
Router# configure terminal
Router(config)# hostname ISP1
ISP1(config)# interface GigabitEthernet0/0/0
ISP1(config-if)# ip address 203.0.113.1 255.255.255.252
ISP1(config-if)# no shutdown
ISP1(config-if)# interface GigabitEthernet0/0/1
ISP1(config-if)# ip address 198.51.100.1 255.255.255.252
ISP1(config-if)# no shutdown
ISP1(config-if)# end

2. Address R1 and R2, each with a default route to ISP1. On R1:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.20.0.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip address 203.0.113.2 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# end

Do the same on R2 with hostname R2, G0/0 at 10.10.0.1 255.255.255.0, G0/1 at 198.51.100.2 255.255.255.252, and ip route 0.0.0.0 0.0.0.0 198.51.100.1. Then R1# ping 198.51.100.2 succeeds, because the public addresses are routable, while C:\> ping 10.10.0.9 from PC1 fails: ISP1 has no route to 10.10.0.0/24. That is the gap the tunnel fills. 3. Turn on the security package on R1, accept the licence, save and reload. Repeat on R2. If show version already lists securityk9 as enabled, skip this step on that router.

R1# show version
R1# configure terminal
R1(config)# license boot module c2900 technology-package securityk9
ACCEPT? [yes/no]: yes
R1(config)# end
R1# copy running-config startup-config
R1# reload

Press Enter at the filename and confirm prompts. After the reload, show version lists securityk9 under the technology package licence information. 4. On R1, define how IKE authenticates the peer and protects its own exchange: AES-256, a pre-shared key and Diffie-Hellman group 5. IKE runs over UDP 500. Packet Tracer's crypto maps use IKEv1, the older version the lesson describes:

R1# configure terminal
R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 5
R1(config-isakmp)# exit
R1(config)# crypto isakmp key lab-only-vpnkey address 198.51.100.2

5. On R1, select the traffic to protect with ACL 110 (branch LAN to head-office LAN), name the ESP cipher and hash in a transform set, tie them to the peer in a crypto map, and apply the map to the outside interface:

R1(config)# access-list 110 permit ip 10.20.0.0 0.0.0.255 10.10.0.0 0.0.0.255
R1(config)# crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
R1(cfg-crypto-trans)# exit
R1(config)# crypto map VPN-MAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer 198.51.100.2
R1(config-crypto-map)# set transform-set VPN-SET
R1(config-crypto-map)# match address 110
R1(config-crypto-map)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# crypto map VPN-MAP
R1(config-if)# end

6. Mirror it on R2, with the ACL reversed and R1 as the peer, but deliberately stop before applying the map to an interface:

R2# configure terminal
R2(config)# crypto isakmp policy 10
R2(config-isakmp)# encryption aes 256
R2(config-isakmp)# authentication pre-share
R2(config-isakmp)# group 5
R2(config-isakmp)# exit
R2(config)# crypto isakmp key lab-only-vpnkey address 203.0.113.2
R2(config)# access-list 110 permit ip 10.10.0.0 0.0.0.255 10.20.0.0 0.0.0.255
R2(config)# crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
R2(cfg-crypto-trans)# exit
R2(config)# crypto map VPN-MAP 10 ipsec-isakmp
R2(config-crypto-map)# set peer 203.0.113.2
R2(config-crypto-map)# set transform-set VPN-SET
R2(config-crypto-map)# match address 110
R2(config-crypto-map)# end

7. Find the fault. From PC1, C:\> ping 10.10.0.9 still fails. On R1:

R1# show crypto isakmp sa

No line shows the state QM_IDLE: there is no working IKE SA at all, which is the lesson's first fault pattern. R1 is trying, but R2 has no crypto map on its outside interface, so it never completes the exchange. The next step fixes that. 8. Apply the map on R2's outside interface:

R2# configure terminal
R2(config)# interface GigabitEthernet0/1
R2(config-if)# crypto map VPN-MAP
R2(config-if)# end

Ping 10.10.0.9 from PC1 again. The first one or two requests may time out while IKE builds the security associations; then the replies arrive. Neither PC needed any VPN software: this is a site-to-site VPN, and the gateways do everything. 9. Read what was built, on R1:

R1# show crypto isakmp sa
R1# show crypto ipsec sa

The first shows the IKE SA with R2. The second shows the ESP SAs: the local and remote idents are the two private LANs, the crypto endpoints are the two public addresses, and the packet counters climb with each ping. ISP1 still has no route to 10.10.0.0/24 and never needed one: in tunnel mode each private packet travels behind a new outer header from 203.0.113.2 to 198.51.100.2.