Basic Site To Site VPN

This is how you can setup an encrypted site-to-site VPN connection. This is good for when you need a secure way to transfer data over the internet or some other insecure medium fairly permanently.

We do this by deciding what traffic will be using the VPN.

Next we’ll be enabling and defining ISAKMP policies; these are what define how your VPN works: do you want to use DES or AES and what bit. These policies must match 100% if there are any differences they won’t be used.

Next we’ll be defining the pre-shared key and the IP of the other end of the VPN. The router will use an MD5 or SHA1 hash of this for authentication.

Then we’ll create a transform-set, which is an acceptable combination of security protocols and algorithms.

Set the other end of the VPN and reference the traffic that is going over the VPN.

Select the asymmetric VPN protocol you want to use: such as Diffie Hellman or RSA.

Select the transform-set we defined before.

And finally select which interface the VPN will be running on.

The major concept to understand about the site-to-site VPNs is the key exchange/encryption. Both routers have a public and private key. The public key is used to decrypt the traffic from the private key and private key is used to decrypt the public key. The part I could never get was that though the awesome power of math you can’t decrypt the traffic from the public key if you have both the traffic and the key, only the private key can decrypt the the public key. The public keys are then transferred between the 2 routers and both use the other one’s public key to encrypt everything. The reason why it doesn’t stop there is cause asymmetric key encryption is VERY resource intensive (more than 100x more intensive than symmetric encryption). So the routers use this uber-encryption to send over keys for symmetric encryption. By default a new symmetric key is generated every ~4mb of traffic or 1 day (which ever comes 1st).

R1 Config w/ Inline Notes

!This defines an ACL that says what traffic will being going over the VPN
ip access-list extended VPN
permit ip host 10.0.0.1 host 10.0.0.2
permit icmp host 10.0.0.1 host 10.0.0.2

!Enables ISAKMP
crypto isakmp enable

!This is per connection: you can have lots of VPNs coming to 1 router, each one has a policy number
crypto isakmp policy 100

!Sets up what symmetric encryption key to use: in this case AES 128 bit
encryption aes 128

!Set this to use pre-shared key for verification such as; 

making sure George is George instead of bad-guy pretending to be George
authentication pre-share

!Sets it up to use the Diffie Hellman 1024-bit encryption for the asymmetric encryption
group 2

!Use the SHA hash file type which is MD5's new replacement
hash sha

!Make a new key in 86400 sec (24 hours)
lifetime 86400

!Sets the pre-shared key (MONKEY) that the other router (10.0.0.2) should have
crypto isakmp key MONKEY address 10.0.0.2

!Define an acceptable combination of security protocols and algorithms 

(defined as DLOTS in this case) this is called transform-set
crypto ipsec transform-set DLOTS esp-aes 128 esp-sha-hmac

!Sets the following that will be referenced in an interface
crypto map MAP 100 ipsec-isakmp

!References the VPN ACL noted earlier
match address VPN
!Sets the other end of the VPN
set peer 10.0.0.2

!Specifies that IPSec should use the 1024-bit Diffie-Hellman
set pfs group2

!References the "crypto ipsec transform-set DLOTS esp-aes 128 esp-sha-hmac" line above
set transform-set DLOTS 

!Says what port to associated  with the "crypto map MAP 100 ipsec-isakmp" line above
int fa0/0
crypto map MAP
ip address 10.0.0.1 255.255.255.0

R2 Config

ip access-list extended VPN
permit ip host 10.0.0.2 host 10.0.0.1
permit icmp host 10.0.0.2 host 10.0.0.1

crypto isakmp enable
crypto isakmp policy 100
encryption aes 128
authentication pre-share
group 2
hash sha
lifetime 86400

crypto isakmp key MONKEY address 10.0.0.1

crypto ipsec transform-set DLOTS esp-aes 128 esp-sha-hmac

crypto map MAP 100 ipsec-isakmp
match address VPN
set peer 10.0.0.1
set pfs group2
set transform-set DLOTS

int fa0/0
ip address 10.0.0.2 255.255.255.0
crypto map MAP