Configuring Site to Site IPSec VPN Tunnel Between Cisco IOS Routers (route-based VPN)

The configuration of IPSec VPN of route-based between IOS Cisco routers are very similar to configure GRE with IPSec or DMVPN.

Note: Cisco ASA firewall DOES NOT SUPPORT route-based VPN

For further reference:
http://packetlife.net/blog/2011/aug/17/policy-based-vs-route-based-vpns-part-2/


Sample script:

IPSec VPN (route-based):   
Phase 1:
==========
1. Create policy on both routers
    crypto isakmp policy 10
    encr aes 256
    authentication pre-share
    group 5
   
2. Create a pre-shared key on both routers
    crypto keyring xxx
    pre-shared-key address <peer ip addr x.x.x.x> key xxxx
   
Phase 2
========   
1. Create an ISAKMP profile on both routers
    crypto isakmp profile RB-VPN-PROFILE
    keyring RB-VPN-KEY
    match identity address <peer ip x.x.x.x> 255.255.255.255
   
2. Define an IPsec transform-set on both routers
    crypto ipsec transform-set <name of TS> ESP-AES256-SHA1 esp-aes 256 esp-sha-hmac   
   
3. Create IPSec Profile for route-based VPN on both routers
    crypto ipsec profile RB_IPSEC_PROFILE
    set transform-set TS-VPN
   
4. Create a VPN tunnel interface on both end
    interface Tunnel0
    ip address 192.168.1.1 255.255.255.0
    tunnel source 12.12.12.1
    tunnel destination 12.12.12.2
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile RB_IPSEC_PROFILE
   
5. Enable dynamic routing (EIGRP or OSPF)   
    advertise network subnet you want to be reached
    router eigrp 10
    network 3.3.3.0 0.0.0.255
    network 10.10.10.0 0.0.0.255
    network 192.168.1.0
    passive-interface Ethernet0/0

Basic DMVPN validation check

dmvpn verification

show crypto engine connection active  —Displays the total encrypts and decrypts per SA.

show crypto ipsec sa —Displays the stats on the active tunnels.

show crypto isakmp sa —Displays the state for the the ISAKMP SA.

sh crypto session

sh dmvpn on client router

sh ip eigrp nei

sh ip route eigrp

sh ip eigrp topology

Basic GRE config:

R1:

config t

int tunnel 0

ip address 192.168.0.1 255.255.255.0 <assign itself internal IP facing to public>

tunnel source <pub IP of itself>

tunnel destination <pub IP of R2>

tunnel key xxxx <optional for authentication>

R2:

config t

int tunnel 0

ip address 192.168.0.2 255.255.255.0 <assign itself internal IP facing to public>

tunnel source <pub IP of itself or interface name>

tunnel destination <pub IP of R1>

tunnel key xxxx <optional for authentication>

Basic mGRE (DMVPN) config:

R1 (HUB):

config t

int tunnel 0

ip address 192.168.0.1 255.255.255.0

tunnel source <pub IP of itself or interface name>

tunnel mode gre multipoint

tunnel key xxxx <!-- must be matched with all routers -->

ip nhrp network-id 1 <!-- network id just like AS number, must be matched with all Routers -->

ip nhrp authentication <password> <!-- must be matched with all routers -->

ip nhrp map multicast dynamic

ip mtu 1400 <! -- lower the mtu value if you experience tunnel to hub is flapping -->

ip tcp adjust-mss 1360 <! -- mtu & tcp adjust are best practice settings -->

no ip next-hop-self eigrp 100 <! -- this is required if we configure EIGRP routing for DMVPN, this help to spoke-spoke communication instead of spoke-hub-spoke communitcation -->

no ip split-horizon eigrp 100 <! -- this is required if we configure EIGRP routing for DMVPN -->

R2 & R3 (SPOKE):

config t

int tunnel 0

ip address 192.168.0.2 255.255.255.0

tunnel source <pub IP of itself or interface name> 

tunnel mode gre multipoint

tunnel key xxxx

ip nhrp network-id 1 <!-- network id just like AS number, must be matched with all Routers -->

ip nhrp authentication <password>

ip nhrp map multicast dynamic

ip nhrp nhs 192.168.0.1

ip nhrp map 192.168.0.1 <pub IP of R1>

ip nhrp map multicast <pub IP of R1>

ip mtu 1400

ip tcp adjust-mss 1360 

Adding IPSec on top of mGRE:

apply these settings on both HUB & SPOKE routers

crypto isakmp policy 1

 encr 3des

 hash md5

 authentication pre-share

 group 2

 lifetime 86400

crypto isakmp key cisco address 0.0.0.0

crypto ipsec transform-set mGRE-TS esp-3des esp-md5-hmac

crypto ipsec profile IPSec-mGRE

 set security-association lifetime seconds 86400

 set transform-set mGRE-TS

interface Tunnel 0

tunnel protection ipsec profile IPSec-mGRE

Sample script template:
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
crypto isakmp key cisco address 100.100.15.1
!
!
crypto ipsec transform-set TS-DMVPN esp-3des esp-sha-hmac
 mode tunnel
!
crypto ipsec profile IPSEC-DMVPN-PROFILE
 set transform-set TS-DMVPN
!
interface tunnel0
tunnel mode ipsec ipv4
tunnel protection ipsec profile IPSEC-DMVPN-PROFILE
tunnel mode gre multipoint