Configuring Site to Site IPSec VPN Tunnel Between Cisco IOS Routers (route-based VPN)

The configuration of IPSec VPN of route-based between IOS Cisco routers are very similar to configure GRE with IPSec or DMVPN.

Note: Cisco ASA firewall DOES NOT SUPPORT route-based VPN

For further reference:
http://packetlife.net/blog/2011/aug/17/policy-based-vs-route-based-vpns-part-2/


Sample script:

IPSec VPN (route-based):   
Phase 1:
==========
1. Create policy on both routers
    crypto isakmp policy 10
    encr aes 256
    authentication pre-share
    group 5
   
2. Create a pre-shared key on both routers
    crypto keyring xxx
    pre-shared-key address <peer ip addr x.x.x.x> key xxxx
   
Phase 2
========   
1. Create an ISAKMP profile on both routers
    crypto isakmp profile RB-VPN-PROFILE
    keyring RB-VPN-KEY
    match identity address <peer ip x.x.x.x> 255.255.255.255
   
2. Define an IPsec transform-set on both routers
    crypto ipsec transform-set <name of TS> ESP-AES256-SHA1 esp-aes 256 esp-sha-hmac   
   
3. Create IPSec Profile for route-based VPN on both routers
    crypto ipsec profile RB_IPSEC_PROFILE
    set transform-set TS-VPN
   
4. Create a VPN tunnel interface on both end
    interface Tunnel0
    ip address 192.168.1.1 255.255.255.0
    tunnel source 12.12.12.1
    tunnel destination 12.12.12.2
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile RB_IPSEC_PROFILE
   
5. Enable dynamic routing (EIGRP or OSPF)   
    advertise network subnet you want to be reached
    router eigrp 10
    network 3.3.3.0 0.0.0.255
    network 10.10.10.0 0.0.0.255
    network 192.168.1.0
    passive-interface Ethernet0/0