Site-to-Site IPsec VPN Cisco Router to Cisco Router

Image

SOURCE: http://blog.webernetz.net/2015/02/02/ipsec-site-to-site-vpn-fortigate-cisco-router/

ROUTER1
# sh run
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname RTR2811a
boot-start-marker
boot system flash:c2800nm-adventerprisek9-mz.151-4.M10.bin
warm-reboot count 10 uptime 7
boot-end-marker
aaa new-model
aaa session-id common
dot11 syslog
ip source-route
ip cef
ip dhcp excluded-address 10.0.31.201 10.0.31.254
ip dhcp excluded-address 10.0.31.1 10.0.31.100
ip dhcp pool pool10.0.31.0
network 10.0.31.0 255.255.255.0
default-router 10.0.31.1
dns-server 8.8.8.8 8.8.4.4
no ip domain lookup
ip domain name nbctcp.com
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
multilink bundle-name authenticated
redundancy
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28800
crypto isakmp key P@ssw0rd address 0.0.0.0 0.0.0.0
crypto ipsec transform-set TS esp-3des esp-md5-hmac
crypto ipsec profile 3DESMD5
set transform-set TS
set pfs group2
!
interface Tunnel1
ip unnumbered FastEthernet0/0.206
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.207
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel2
ip unnumbered FastEthernet0/0.221
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.221
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel3
ip unnumbered FastEthernet0/0.224
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.224
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel4
ip unnumbered FastEthernet0/0.226
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.226
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel5
ip unnumbered FastEthernet0/0.228
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.228
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel6
ip unnumbered FastEthernet0/0.230
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.230
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel7
ip unnumbered FastEthernet0/0.232
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.232
tunnel protection ipsec profile 3DESMD5
!
interface FastEthernet0/0
ip address 10.0.10.206 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 10.0.31.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.0.10.1
ip route 10.0.41.0 255.255.255.0 Tunnel1
ip route 10.0.42.0 255.255.255.0 Tunnel2
ip route 10.0.43.0 255.255.255.0 Tunnel3
ip route 10.0.44.0 255.255.255.0 Tunnel4
ip route 10.0.45.0 255.255.255.0 Tunnel5
ip route 10.0.46.0 255.255.255.0 Tunnel6
ip route 10.0.47.0 255.255.255.0 Tunnel7
access-list 101 permit ip 10.0.31.0 0.0.0.255 any
!
control-plane
mgcp fax t38 ecm
mgcp profile default
line con 0
line aux 0
line vty 0 4
transport input all
line vty 5 15
transport input ssh
scheduler allocate 20000 1000
end
ROUTER2
# sh run
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname RTR2811b
boot-start-marker
boot system tftp c2800nm-adventerprisek9-mz.151-4.M10.bin 255.255.255.255
boot-end-marker
enable secret 5 $1$HxGi$4TMRgVfSqzWAsRyLheMjP1
aaa new-model
aaa session-id common
dot11 syslog
ip source-route
ip cef
ip dhcp excluded-address 10.0.41.201 10.0.41.254
ip dhcp excluded-address 10.0.41.1 10.0.41.100
ip dhcp pool pool10.0.41.0
network 10.0.41.0 255.255.255.0
default-router 10.0.41.1
dns-server 8.8.8.8 8.8.4.4
no ip domain lookup
ip domain name nbctcp.com
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
multilink bundle-name authenticated
voice-card 0
crypto pki token default removal timeout 0
redundancy
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28800
crypto isakmp key P@ssw0rd address 10.0.10.206
crypto ipsec transform-set TS esp-3des esp-md5-hmac
!
crypto ipsec profile 3DESMD5
set transform-set TS
set pfs group2
!
interface Tunnel1
ip unnumbered FastEthernet0/0.206
tunnel source 10.0.10.207
tunnel mode ipsec ipv4
tunnel destination 10.0.10.206
tunnel protection ipsec profile 3DESMD5
!
interface FastEthernet0/0
ip address 10.0.10.207 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 10.0.41.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
 speed auto
interface Serial0/0/0
no ip address
shutdown
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.0.10.1
ip route 10.0.31.0 255.255.255.0 Tunnel1
access-list 101 permit ip 10.0.41.0 0.0.0.255 any
!
control-plane
mgcp profile default
line con 0
line aux 0
line vty 0 4
transport input all
line vty 5 15
transport input ssh
scheduler allocate 20000 1000
end

You can try ping from PC1 to PC2 now

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s