IPsec, site-to-sito VPN Simple Experiment

  

Experimental Requirements: PC1 and PC2 can communicate normally through the secure channel R1 configuration: crypto isakmp policy 1 \\\\ Create conversion set encr 3des \\\\ Encryption mode hash md5 \\\\ Hash Algorithm authentication pre-share \\\\ authentication mode group 2 \\\\ DH group crypto isakmp key cisco address 10.1.1.2 \\\\create peer key! crypto ipsec transform-set TEST000 esp-3des esp-md5-hmac \\\\create conversion Set! crypto map SDM_CMAP_1 1 ipsec-isakmp \\\\ Create IPsec map description Tunnel to10.1.1.2 \\\\ Description set peer 10.1.1.2 \\\\ Specify peer address set transform-set TEST000 \\\\ Call conversion set match address 100 \\ \\call ACL!interface FastEthernet0/0ip nat outside \\\\ associated PATip address 10.1.1.1 255.255.255.0duplex autospeed autocrypto map SDM_CMAP_1 \\\\call IPsec map! interface FastEthernet1/0ip nat inside associated PATip address 192.168.10.1 255.255.255.0duplex autospeed auto !ip route 0.0.0.0 0.0.0.0 10.1.1.2 \\\\default route!access-list 100 permit ip 192.168.10.0 0.0.0.255 172.16.0.0 0.0.255.255 \\\\Create ACLip nat inside source list 102 interface FastEthernet0/0 overload \\\\Create PAT (optional)

R2 configuration: crypto isakmp policy 1 \\\\ Create conversion set encr 3des \\\\ Encryption mode hash md5 \\\\ Hash algorithm Authentication pre-share \\\\ authentication mode group 2 \\\\ DH group crypto isakmp key cisco address 10.1.1.1 \\\\create peer key! crypto ipsec transform-set TEST000 esp-3des esp-md5-hmac \\\\create conversion set !crypto map SDM_CMAP_1 1 ipsec-isakmp \\\\ Create IPsec map description Tunnel to10.1.1.1 \\\\ Description set peer 10.1.1.1 \\\\ Specify peer address set transform-set TEST000 \\\\ Call conversion set match address 100 \\\\ Call ACL!interface FastEthernet0/0ip address 10.1.1.2 255.255.255.0duplex autospeed autocrypto map SDM_CMAP_1 \\\\Invoke IPsec map!interface FastEthernet1/0ip address 172.16.0.1 255.255.0.0duplex autospeed auto!ip route 0.0.0.0 0.0.0.0 10.1. 1.1 \\\\default route! access-list 100 permit ip 172.16.0.0 0.0.255 192.168.10.0 0.0.0.255 \\\\Create ACL

Copyright © Windows knowledge All Rights Reserved