Configuration R1:
==============
!
aaa new-model
!
!
aaa authentication login VPN local
aaa authorization network VPN local
!
!
aaa session-id common
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
!
crypto isakmp client configuration group CISCOSYSTEM
key cisco
dns 4.2.2.2
domain cisco.com
pool VPN-POOL
acl 100
save-password
netmask 255.255.255.0
banner ^C This is a test banner ! ^C
crypto isakmp profile ISAKMP_PROFILE
match identity group CISCOSYSTEM
isakmp authorization list VPN
client configuration address respond
virtual-template 1
!
!
crypto ipsec transform-set TS esp-des esp-sha-hmac
!
crypto ipsec profile IPSEC_PROFILE
set transform-set TS
set isakmp-profile ISAKMP_PROFILE
!
!
!
!
!
!
username kamran password 0 shakil
archive
log config
hidekeys
!
!
!
!
!
interface Loopback0
ip address 192.168.20.1 255.255.255.0
!
interface FastEthernet0/0
ip address 100.1.1.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Virtual-Template1 type tunnel
ip unnumbered FastEthernet0/0
tunnel source FastEthernet0/0
tunnel mode ipsec ipv4
tunnel protection ipsec profile IPSEC_PROFILE
!
!
router eigrp 10
network 192.168.1.0
network 192.168.20.0
no auto-summary
!
ip local pool VPN-POOL 10.1.1.1 10.1.1.2
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
!
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip 192.168.20.0 0.0.0.255 any
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
Output:
=======
R1#sh crypto route
VPN Routing Table: Shows RRI and VTI created routes
Codes: RRI - Reverse-Route, VTI- Virtual Tunnel Interface
S - Static Map ACLs
Routes created in table GLOBAL DEFAULT
10.1.1.2/255.255.255.255 [1/0] via 100.1.1.2
on Virtual-Access2 RRI
R1#
R1#
R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
100.1.1.1 100.1.1.2 QM_IDLE 1002 0 ACTIVE
ISAKMP_PROFILE
IPv6 Crypto ISAKMP SA
R1#
R1#sh crypto session
Crypto session current status
Interface: Virtual-Access2
Profile: ISAKMP_PROFILE
Group: CISCOSYSTEM
Assigned address: 10.1.1.2
Session status: UP-ACTIVE
Peer: 100.1.1.2 port 500
IKE SA: local 100.1.1.1/500 remote 100.1.1.2/500 Active
IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 host 10.1.1.2
Active SAs: 2, origin: crypto map
R1#sh crypto ENgine CONNections act
Crypto Engine Connections
ID Interface Type Algorithm Encrypt Decrypt IP-Address
1 Fa0/0 IPsec DES+SHA 0 199 100.1.1.1
2 Fa0/0 IPsec DES+SHA 100 0 100.1.1.1
1001 Fa0/0 IKE SHA+DES 0 0 100.1.1.1
R1#
R2(REMOTE VPN ROUTER)
Configuration of R2 :
===============
!
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
!
!
!
!
!
crypto ipsec client ezvpn EZVPN
connect auto
group CISCOSYSTEM key cisco
local-address FastEthernet0/0
mode client
peer 100.1.1.1
username kamran password shakil
xauth userid mode local
!
!
!
!
!
!
username kamran password 0 shakil
archive
log config
hidekeys
!
!
!
!
!
interface Loopback0
ip address 192.168.1.1 255.255.255.0
crypto ipsec client ezvpn EZVPN inside
!
interface FastEthernet0/0
ip address 100.1.1.2 255.255.255.0
ip virtual-reassembly
duplex auto
speed auto
crypto ipsec client ezvpn EZVPN
!
interface Virtual-Template1 type tunnel
no ip address
ip virtual-reassembly
tunnel mode ipsec ipv4
!
router eigrp 10
network 192.168.0.0
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
!
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
Outputs
======
R2#sh crypto session brief
Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N -
Negotiating
K - No IKE
ivrf = (none)
Peer I/F Username Group/Phase1_id Uptime
Status 100.1.1.1
Fa0/0 100.1.1.1 00:03:53 UA
R2#
R2#PING 100.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 124/138/176 ms
R2#ping 192.168.20.1 source 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/140/212 ms
R2#
R2#sh crypto ipsec client ezvpn
Easy VPN Remote Phase: 6
Tunnel name : EZVPN
Inside interface list: Loopback0
Outside interface: FastEthernet0/0
Current State: IPSEC_ACTIVE
Last Event: MTU_CHANGED
Address: 10.1.1.2 (applied on Loopback10000)
Mask: 255.255.255.255
DNS Primary: 4.2.2.2
Default Domain: cisco.com
Save Password: Allowed
Split Tunnel List: 1
Address : 192.168.20.0
Mask : 255.255.255.0
Protocol : 0x0
Source Port: 0
Dest Port : 0
Current EzVPN Peer: 100.1.1.1
R2#
R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
100.1.1.1 100.1.1.2 QM_IDLE 1002 0 ACTIVE
r2#sh crypto engine connections active
Crypto Engine Connections
ID Interface Type Algorithm Encrypt Decrypt IP-Address
1 Fa0/0 IPsec DES+SHA 0 100 100.1.1.2
2 Fa0/0 IPsec DES+SHA 199 0 100.1.1.2
1001 Fa0/0 IKE SHA+DES 0 0 100.1.1.2
BUT ROUTE TO 192.168.20.0/24 is NOT PRESENT IN THE ROUTING TABLE ????? "How
can i install it " .... i think due to default route it is able to reach
192.168.20.1 , but i believe there should be 192.168.20.0/24 subnet
available in R2 -Remote end router routing table ... please correct me if i
am wrong!!!!
R2#sh ip ro
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static
route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
100.0.0.0/24 is subnetted, 1 subnets
C 100.1.1.0 is directly connected, FastEthernet0/0
10.0.0.0/32 is subnetted, 1 subnets
C 10.1.1.1 is directly connected, Loopback10000
C 192.168.1.0/24 is directly connected, Loopback0
S* 0.0.0.0/0 is directly connected, FastEthernet0/0
R2#
This config works FINE BUT......................................*NOTE : " If
i remote the static default routes to fa0/0 with router ospf and advertise
link 100.0.0.0 with area 0 , the things stops working ...why i dont know,
and this is my query..."*
_______________________________________________
For more information regarding industry leading CCIE Lab training, please visit
www.ipexpert.com
