FLEX VPN (S2S) USING PKI

BASIC CONFIGURATION

R1:

int f0/0

ip address 1.1.1.1 255.255.255.0

no shut

int l0

ip address 10.1.1.1 255.255.255.255

ip route 0.0.0.0 0.0.0.0 1.1.1.2

R2:

int f0/0

ip address 2.2.2.1 255.255.255.0

no shut

int l0

ip address 10.1.2.1 255.255.255.255

ip route 0.0.0.0 0.0.0.0 2.2.2.2

R4:

int f0/0

ip address 3.3.3.1 255.255.255.0

no shut

ip route 0.0.0.0 0.0.0.0 3.3.3.2

R3:

int f2/0

ip address 3.3.3.2 255.255.255.0

no shut

int f0/0

ip address 1.1.1.2 255.255.255.0

no shut

int f0/1

ip address 2.2.2.2 255.255.255.0

no shut

NTP CONFIGURATION

R3:

clock set 07:21:00 01 DEC 2013
ntp master 1
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
R1:
ntp server 1.1.1.2
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
R2:
ntp server 2.2.2.2
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
R4:
ntp server 3.3.3.2
ntp authentication-key 1 md5 cisco
ntp trusted-key 1
ntp authenticate
CERTIFICATE CONFIGURATION
R4:
ip http server
crypto key generate rsa modulus 1024 label PKI exportable
crypto pki server CA_Server
issuer-name CN=ca_server OU=cisco C=India S=Karnataka L=Bangalore
lifetime ca-certificate 3
lifetime certificate 2
grant auto
no shut
R1:
crypto pki trustpoint CA
enrollment url http://3.3.3.1
revocation-check none
crypto pki authenticate CA
crypto pki enroll CA
R2:
crypto pki trustpoint CA
enrollment url http://3.3.3.1
revocation-check none
crypto pki authenticate CA
crypto pki enroll CA
IKEV2 CONFIGURATION
R1:
access-list 101 permit ip host 10.1.1.1 host 10.1.2.1
crypto ikev2 proposal PRO
encryption aes-cbc-128
integrity sha1
group 2
!
crypto ikev2 policy 10
proposal PRO
!
crypto ikev2 profile PROFILE
match fvrf any
match identity remote fqdn PEER
identity local fqdn PEER
authentication local rsa-sig
authentication remote rsa-sig
pki trustpoint CA
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
!
crypto map CMAP 10 ipsec-isakmp
set peer 2.2.2.1
set transform-set TSET
set ikev2-profile PROFILE
match address 101
!
int f0/0
crypto map CMAP
R2:
access-list 101 permit ip host 10.1.2.1 host 10.1.1.1
crypto ikev2 proposal PRO
encryption aes-cbc-128
integrity sha1
group 2
!
crypto ikev2 policy 10
proposal PRO
!
crypto ikev2 profile PROFILE
match fvrf any
match identity remote fqdn PEER
identity local fqdn PEER
authentication local rsa-sig
authentication remote rsa-sig
pki trustpoint CA
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
!
crypto map CMAP 10 ipsec-isakmp
set peer 2.2.2.1
set transform-set TSET
set ikev2-profile PROFILE
match address 101
!
int f0/0
crypto map CMAP