Hands-On Lab: Configuring and Verifying IPsec Site-to-Site VPN

By /

Listen to this Post

In this hands-on lab, I explored the configuration and verification of an IPsec Site-to-Site VPN between two routers (R1 and R3) via an ISP router (R2). The goal was to establish a secure tunnel over the public internet to securely transmit sensitive data between two networks.

🔑 Key Tasks:

1️⃣ Network Setup: Configured basic device settings, interface addressing, and static routing.
2️⃣ IPsec VPN Configuration: Implemented IKE policies, pre-shared keys, and IPsec transform sets to secure the VPN tunnel.
3️⃣ Verification: Tested the VPN by generating interesting traffic and verifying the security associations (SAs) using various show commands.

💡 Why It Matters:

IPsec VPNs are crucial for securing data transmission over untrusted networks like the internet. This lab provided a practical understanding of how to configure and troubleshoot VPNs, a must-have skill for network engineers working in secure environments.

🔧 Tools Used:

  • Cisco Routers (4221)
  • Cisco Layer 3 Switches (Catalyst 3650)
  • Cisco IOS XE

📈 Skills Gained:

  • IPsec VPN configuration
  • IKE policy implementation
  • Crypto map application
  • Network troubleshooting

Practice Verified Codes and Commands:

1. Basic Device Configuration:

R1(config)# hostname R1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown

2. Static Routing Configuration:

R1(config)# ip route 192.168.2.0 255.255.255.0 192.168.1.2

3. IKE Policy Configuration:

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes
R1(config-isakmp)# hash sha
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 2
R1(config-isakmp)# lifetime 86400

4. Pre-Shared Key Configuration:

R1(config)# crypto isakmp key MY_SECRET_KEY address 192.168.2.1

5. IPsec Transform Set Configuration:

R1(config)# crypto ipsec transform-set MY_TRANSFORM_SET esp-aes esp-sha-hmac

6. Crypto Map Configuration:

R1(config)# crypto map MY_CRYPTO_MAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer 192.168.2.1
R1(config-crypto-map)# set transform-set MY_TRANSFORM_SET
R1(config-crypto-map)# match address 101

7. Applying Crypto Map to Interface:

R1(config)# interface GigabitEthernet0/0
R1(config-if)# crypto map MY_CRYPTO_MAP

8. Verifying IPsec VPN:

R1# show crypto isakmp sa
R1# show crypto ipsec sa

What Undercode Say:

IPsec VPNs are a cornerstone of modern network security, providing a robust method for securing data transmission over untrusted networks. This lab demonstrated the essential steps to configure and verify an IPsec Site-to-Site VPN, a critical skill for network engineers. The use of Cisco routers and switches, along with Cisco IOS XE, provided a realistic environment for hands-on learning.

Key takeaways include the importance of properly configuring IKE policies, pre-shared keys, and IPsec transform sets to ensure the security and integrity of the VPN tunnel. The verification process, using commands like `show crypto isakmp sa` and show crypto ipsec sa, is crucial for troubleshooting and ensuring the VPN is functioning as expected.

For those looking to deepen their understanding, consider exploring additional resources on Cisco’s official documentation and online courses that offer more advanced configurations and troubleshooting techniques. The skills gained from this lab are directly applicable to real-world scenarios, making it an invaluable exercise for anyone in the field of network security.

Additional Commands for Further Exploration:

  • Linux IPsec Configuration:
    sudo ipsec start
sudo ipsec status
sudo ipsec whack --trafficstatus

  • Windows IPsec Configuration:

    netsh ipsec static add policy name="MY_IPSEC_POLICY"
netsh ipsec static add filterlist name="MY_FILTER_LIST"
netsh ipsec static add filter filterlist="MY_FILTER_LIST" srcaddr=192.168.1.0/24 dstaddr=192.168.2.0/24

  • Troubleshooting Commands:

    ping 192.168.2.1
traceroute 192.168.2.1

By mastering these commands and configurations, you can ensure the security and reliability of your network communications, a critical aspect of modern IT infrastructure.

Useful URLs:

References:

Hackers Feeds, Undercode AIFeatured Image

Related Posts: