Readers will learn how to configure a Policy-Based Site-to-Site IPsec VPN between an EdgeRouter and a Cisco ISR router.
NOTES & REQUIREMENTS:
Applicable to the latest EdgeOS firmware on all EdgeRouter models. Knowledge of the Command Line Interface (CLI) and basic networking knowledge is required. Please see the Related Articles below for more information.
Devices used in this article:
Table of Contents
1. What site-to-site IPsec VPN types can be configured on EdgeOS?
2. What are the available encryption and hashing options (Security Associations / SAs) for Phase 1 (IKE) and Phase 2 (ESP)?
The network topology is shown below and the following interfaces are in use on the routers:
- eth0 (WAN) - 203.0.113.1
- eth1 (LAN) - 192.168.1.1/24
- gi0/0 (WAN) - 192.0.2.1
- gi0/1 (LAN) - 172.16.1.1/24
Configuring the Policy-Based VPN
CLI: Access the command line interface on the ER. You can do this using the CLI button in the GUI or by using a program such as PuTTY.
1. Enter configuration mode.
2. Enable the auto-firewall-nat-exclude feature.
set vpn ipsec auto-firewall-nat-exclude enable
3. Create the IKE / Phase 1 (P1) Security Associations (SAs).
set vpn ipsec ike-group FOO0 lifetime 28800
set vpn ipsec ike-group FOO0 proposal 1 dh-group 14
set vpn ipsec ike-group FOO0 proposal 1 encryption aes128
set vpn ipsec ike-group FOO0 proposal 1 hash sha1
4. Create the ESP / Phase 2 (P2) SAs and disable Perfect Forward Secrecy (PFS).
set vpn ipsec esp-group FOO0 lifetime 3600
set vpn ipsec esp-group FOO0 pfs disable
set vpn ipsec esp-group FOO0 proposal 1 encryption aes128
set vpn ipsec esp-group FOO0 proposal 1 hash sha1
5. Define the remote peering address (replace <secret> with your desired passphrase).
set vpn ipsec site-to-site peer 192.0.2.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 192.0.2.1 authentication pre-shared-secret <secret>
set vpn ipsec site-to-site peer 192.0.2.1 description ipsec
set vpn ipsec site-to-site peer 192.0.2.1 local-address 203.0.113.1
6. Link the SAs created above to the remote peer and define the
set vpn ipsec site-to-site peer 192.0.2.1 ike-group FOO0
set vpn ipsec site-to-site peer 192.0.2.1 tunnel 1 esp-group FOO0
set vpn ipsec site-to-site peer 192.0.2.1 tunnel 1 local prefix 192.168.1.0/24
set vpn ipsec site-to-site peer 192.0.2.1 tunnel 1 remote prefix 172.16.1.0/24
7. Commit the changes and save the configuration.
commit ; save
CLI: Access the command line interface (CLI) on the Cisco ISR.
1. Enter configuration mode.
2. Create an IKE policy.
crypto isakmp policy 100
encryption aes 128
3. Create the IPsec transform set (IPsec_TS) matching the defined SAs on the EdgeRouter.
crypto ipsec transform-set ipsec-ts esp-aes 128 esp-sha-hmac
4. Define the peer address (replace <secret> with your desired passphrase).
crypto isakmp key <secret> address 203.0.113.1
5. Create an IPsec access-list that defines the remote and local subnets.
ip access-list extended ipsec-acl
permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
6. Create a crypto map and link it to the
crypto map ipsec-cm 100 ipsec-isakmp
set peer 203.0.113.1
set transform-set ipsec-ts
match address ipsec-acl
set security-association lifetime seconds 3600
7. Assign the crypto map to the WAN interface.
crypto map ipsec-cm
8. Exclude the IPsec traffic from being translated by NAT.
ip access-list extended nat-acl
deny ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 172.16.1.0 0.0.0.255 any
ip nat inside source list nat-acl interface gi0/0 overload
9. Write the changes to the startup configuration.
copy running-config startup-config