1. Home
    2. /
  2. Manuals
    3. /
  3. Cisco
    4. /
  4. 870-Series
    5. /
  5. 17
Page 81 / 196 Scroll up to view Page 76 - 80
7-3
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 7
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Configure the IKE Policy
Perform these steps to configure the Internet Key Exchange (IKE) policy, beginning in global
configuration mode:
Command or Action
Purpose
Step 1
crypto isakmp policy
priority
Example:
Router(config)#
crypto isakmp policy
1
Router(config-isakmp)#
Creates an IKE policy that is used during IKE
negotiation. The priority is a number from 1 to
10000, with 1 being the highest.
Also enters Internet Security Association and Key
Management Protocol (ISAKMP) policy
configuration mode.
Step 2
encryption
{
des
|
3des
|
aes
|
aes 192
|
aes 256
}
Example:
Router(config-isakmp)#
encryption 3des
Router(config-isakmp)#
Specifies the encryption algorithm used in the IKE
policy.
The example uses 168-bit Data Encryption
Standard (DES).
Step 3
hash
{
md5
|
sha
}
Example:
Router(config-isakmp)#
hash md5
Router(config-isakmp)#
Specifies the hash algorithm used in the IKE
policy.
The example specifies the Message Digest 5
(MD5) algorithm. The default is Secure Hash
standard (SHA-1).
Step 4
authentication {rsa-sig | rsa-encr | pre-share
}
Example:
Router(config-isakmp)#
authentication
pre-share
Router(config-isakmp)#
Specifies the authentication method used in the
IKE policy.
The example uses a pre-shared key.
Step 5
group {1 | 2 | 5
}
Example:
Router(config-isakmp)#
group 2
Router(config-isakmp)#
Specifies the Diffie-Hellman group to be used in
the IKE policy.
Step 6
lifetime
seconds
Example:
Router(config-isakmp)#
lifetime
480
Router(config-isakmp)#
Specifies the lifetime, 60–86400 seconds, for an
IKE security association (SA).
Step 7
exit
Example:
Router(config-isakmp)#
exit
Router(config)#
Exits IKE policy configuration mode, and enters
global configuration mode.
Page 82 / 196
7-4
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 7
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Configure Group Policy Information
Perform these steps to configure the group policy, beginning in global configuration mode:
Command or Action
Purpose
Step 1
crypto isakmp client configuration group
{
group-name | default}
Example:
Router(config)#
crypto isakmp client
configuration group rtr-remote
Router(config-isakmp-group)#
Creates an IKE policy group that contains
attributes to be downloaded to the remote client.
Also enters Internet Security Association Key
Management Protocol (ISAKMP) policy
configuration mode.
Step 2
key
name
Example:
Router(config-isakmp-group)#
key
secret-password
Router(config-isakmp-group)#
Specifies the IKE pre-shared key for the group
policy.
Step 3
dns
primary-server
Example:
Router(config-isakmp-group)#
dns
10.50.10.1
Router(config-isakmp-group)#
Specifies the primary Domain Name Service
(DNS) server for the group.
Note
You may also want to specify Windows
Internet Naming Service (WINS) servers
for the group by using the
wins
command.
Step 4
domain
name
Example:
Router(config-isakmp-group)#
domain
company.com
Router(config-isakmp-group)#
Specifies group domain membership.
Step 5
exit
Example:
Router(config-isakmp-group)#
exit
Router(config)#
Exits IKE group policy configuration mode, and
enters global configuration mode.
Step 6
ip local pool {default
|
poolname
}
[
low-ip-address
[
high-ip-address
]]
Example:
Router(config)#
ip local pool
dynpool
30.30.30.20 30.30.30.30
Router(config)#
Specifies a local address pool for the group.
For details about this command and additional
parameters that can be set, see the
Cisco IOS Dial
Technologies Command Reference
.
Page 83 / 196
7-5
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 7
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Enable Policy Lookup
Perform these steps to enable policy lookup through AAA, beginning in global configuration mode:
Command or Action
Purpose
Step 1
aaa new-model
Example:
Router(config)#
aaa new-model
Router(config)#
Enables the AAA access control model.
Step 2
aaa authentication login
{
default
|
list-name
}
method1
[
method2...
]
Example:
Router(config)#
aaa authentication login
rtr-remote local
Router(config)#
Specifies AAA authentication of selected users at
login, and specifies the method used.
This example uses a local authentication database.
You could also use a RADIUS server for this. See
the
Cisco IOS Security Configuration Guide
and
the
Cisco IOS Security Command Reference
for
details.
Step 3
aaa authorization {network | exec | commands
level
| reverse-access | configuration} {default |
list-name
} [
method1
[
method2...
]]
Example:
Router(config)#
aaa authorization network
rtr-remote local
Router(config)#
Specifies AAA authorization of all
network-related service requests, including PPP,
and the method used to do so.
This example uses a local authorization database.
You could also use a RADIUS server for this. See
the
Cisco IOS Security Configuration Guide
and
the
Cisco IOS Security Command Reference
for
details.
Step 4
username
name
{
nopassword
|
password
password
|
password
encryption-type
encrypted-password
}
Example:
Router(config)#
username
cisco
password 0
cisco
Router(config)#
Establishes a username-based authentication
system.
This example implements a username of
cisco
with an encrypted password of
cisco
.
Configure IPSec Transforms and Protocols
A transform set represents a certain combination of security protocols and algorithms. During IKE
negotiation, the peers agree to use a particular transform set for protecting data flow.
During IKE negotiations, the peers search in multiple transform sets for a transform that is the same at
both peers. When such a transform set is found, it is selected and applied to the protected traffic as a part
of both peers’ configurations.
Page 84 / 196
7-6
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 7
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration
mode:
Command or Action
Purpose
Step 1
crypto ipsec transform-set
transform-set-name
transform1
[
transform2
] [
transform3
]
[
transform4
]
Example:
Router(config)#
crypto ipsec transform-set
vpn1 esp-3des esp-sha-hmac
Router(config)#
Defines a transform set—An acceptable
combination of IPSec security protocols and
algorithms.
See the
Cisco IOS Security Command Reference
for detail about the valid transforms and
combinations.
Step 2
crypto ipsec security-association lifetime
{
seconds
seconds
|
kilobytes
kilobytes
}
Example:
Router(config)#
crypto ipsec
security-association lifetime seconds
86400
Router(config)#
Specifies global lifetime values used when
negotiating IPSec security associations.
See the
Cisco IOS Security Command Reference
for details.
Note
With manually established security associations, there is no negotiation with the peer, and both sides
must specify the same transform set.
Configure the IPSec Crypto Method and Parameters
A dynamic crypto map policy processes negotiation requests for new security associations from remote
IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).
Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:
Command or Action
Purpose
Step 1
crypto dynamic-map
dynamic-map-name
dynamic-seq-num
Example:
Router(config)#
crypto dynamic-map
dynmap 1
Router(config-crypto-map)#
Creates a dynamic crypto map entry, and enters
crypto map configuration mode.
See the
Cisco IOS Security Command Reference
for more detail about this command.
Step 2
set transform-set
transform-set-name
[
transform-set-name2...transform-set-name6
]
Example:
Router(config-crypto-map)#
set
transform-set
vpn1
Router(config-crypto-map)#
Specifies which transform sets can be used with
the crypto map entry.
Page 85 / 196
7-7
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 7
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Apply the Crypto Map to the Physical Interface
The crypto maps must be applied to each interface through which IPSec traffic flows. Applying the
crypto map to the physical interface instructs the router to evaluate all the traffic against the security
associations database. With the default configurations, the router provides secure connectivity by
encrypting the traffic sent between remote sites. However, the public interface still allows the rest of the
traffic to pass and provides connectivity to the Internet.
Perform these steps to apply a crypto map to an interface, beginning in global configuration mode:
Step 3
reverse-route
Example:
Router(config-crypto-map)#
reverse-route
Router(config-crypto-map)#
Creates source proxy information for the crypto
map entry.
See the
Cisco IOS Security Command Reference
for details.
Step 4
exit
Example:
Router(config-crypto-map)#
exit
Router(config)#
Enters global configuration mode.
Step 5
crypto map
map-name seq-num
[
ipsec-isakmp
]
[
dynamic
dynamic-map-name
] [
discover
]
[
profile
profile-name
]
Example:
Router(config)#
crypto map static-map 1
ipsec-isakmp dynamic dynmap
Router(config)#
Creates a crypto map profile.
Command or Action
Purpose
Command or Action
Purpose
Step 1
interface
type number
Example:
Router(config)#
interface
fastethernet 4
Router(config-if)#
Enters interface configuration mode for the
interface to which you want to apply the crypto
map.

Rate

4.5 / 5 based on 2 votes.

Popular Cisco Models

Famous Router IPs
Famous Router Companies
Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top