1.2 IPSec: Site to Site - Theory
Internet Protocol Security (IPSec)
RFC 2401
It is a framework of series of protocols

- Encapsulating Protocols

ESP | AH
Protocols number of 50 Confidentiality & Integrity Supports NAT, does not support PAT Anti-Replay using Sequence Nos. | Protocol number of 51 Only Integrity; Does not support Encryption Does not support both NAT and PAT Anti-Replay using Sequence Nos.

- Propogations of VPN Tunnels
- - AH Transport Mode
  - AH Tunnel Mode
  - ESP Transport Mode
  - ESP Tunnel Mode
  The ESP header contains the following fields:
  - Security Parameters Index: Identifies the correct security association for the communication when used in combination with the destination address and the security protocol (AH or ESP). The receiver uses this value to determine the security association with which this packet should be identified.
  - Sequence Number: Provides anti-replay protection for the packet. The sequence number is a 32-bit, incrementally increasing number (starting from 1) that indicates the packet number sent over the quick mode security association for the communication. The sequence number cannot repeat for the life of the quick mode security association. The receiver checks this field to verify that a packet for a security association with this number has not already been received. If one has been received, the packet is rejected.
  The ESP trailer contains the following fields:
  - Padding: Padding of 0 to 255 bytes is used to ensure that the encrypted payload with the padding bytes are on byte boundaries required by encryption algorithms.
  - Padding Length: Indicates the length of the Padding field in bytes. The receiver uses this field to remove padding bytes after the encrypted payload with the padding bytes has been decrypted.
  - Next Header: Identifies the type of data in the payload, such as TCP or UDP.
  The ESP authentication trailer contains the following field:
  - Authentication Data: Contains the integrity check value (ICV), also known as the message authentication code, which is used to verify both message authentication and integrity. The receiver calculates the ICV value and checks it against this value (which is calculated by the sender) to verify integrity. The ICV is calculated over the ESP header, the payload data, and the ESP trailer.
  The AH header contains the following fields:
  - Next Header: Identifies the IP payload by using the IP protocol ID. For example, a value of 6 represents TCP.
  - Length: Indicates the length of the AH header.
  - Security Parameters Index (SPI): Used in combination with the destination address and the security protocol (AH or ESP) to identify the correct security association for the communication. The receiver uses this value to determine with which security association the packet is identified.
  - Sequence Number: Provides anti-replay protection for the packet. The sequence number is a 32-bit, incrementally increasing number (starting from 1) that indicates the packet number sent over the security association for the communication. The sequence number cannot repeat for the life of the quick mode security association. The receiver checks this field to verify that a packet for a security association with this number has not already been received. If one has been received, the packet is rejected.
  - Authentication Data: Contains the integrity check value (ICV), also known as the message authentication code, which is used to verify both message authentication and integrity. The receiver calculates the ICV value and checks it against this value (which is calculated by the sender) to verify integrity. The ICV is calculated over the IP header, the AH header, and the IP payload.

- Encryptions Protocols [Refer Introduction]
- Hashing Protocols [Refer Introduction]
- ISAKMP (Internet Security Association Key Management Protocol)
- - Uses UDP 500
  - Defined in RFC 2408
- - IKE has 2 versions

- - Version 1 has 2 phases
- - - Phase 1 (ISAKMP Phase)
  - - - It has 2 Modes

- - - - - Main Mode
        - - It has 6 messages

- - - - - Aggressive Mode
      - - - It has 3 messages
        - - - Message 1 (A to B): ISAKMP Policy, Vendor Id, NAT-T, NONCE, Public Key
            - Message 2 (B to A): The Same as above except NONCE
            - Message 3 (A to B): PSK/PKI (Encrypted)
  - - Phase 2 (IKE Pha se)
  - - - It has only one mode, Quick Mode
      - Quick Mode can operate in Tunnel and Transport Mode
      - It has 3 messages
    - - - Message 1 (A to B): Transport Set, Proxy ID
        - Message 2 (B to A): The same as above
        - Message 3 (A to B): Hash (QM_IDLE state)
- - Security Associations

- - They are virtual connections that are formed in between tunnels
  - It is used to define the set of Algorithms and the keys used for those Algorithms
  - Each SA will be represented by a unique SPI number
  - SPI is a field in AH/ESP header
  - It is a 32 bit field
  - In Phase 1, only 1 SA is formed which is bi-directional from both the sides
  - In Phase 2, two SAs are formed which are uni-directional from both sides

IPSec: Site to Site - Routers
Configuration Steps

- - Phase 1

- - Step 1: Configure Mirrored ACL/Crypto ACL for Interesting Traffic
- - - (config)# access-list <#> permit host host
- - Step 2: Configure ISAKMP Policy
- - - (config)# crypto isakmp policy
  - - - (config-policy)#encryption
      - (config-policy)# hash
      - (config-policy)# group
      - (config-policy)# authentication
      - (config-policy)# lifetime [Default: 86400]
- - Step 3: Configure ISAKMP Key
- - - (config)# crypto isakmp key <#> address
- - Phase 2

- - Step 4: Configure Transform Set
- - - (config)# crypto ipsec transform-set
- - Step 5: Configure Crypto Map
- - - (config)# crypto map <#> ipsec-isakmp
  - - - (config-crypto-map)# set peer
      - (config-crypto-map)# match address
      - (config-crypto-map)# set transform-set
- - Step 6: Apply Crypto Map to an Interface
- - - (config-if)#crypto map

To debug for Phase 1 and Phase 2. Store it in buffer without displaying logs on terminal.
Router#debug crpyto isakmp
Router#debug crpyto ipsec
Router(config)# logging buffer 7
Router(config)# logging buffer 99999
Router(config)# logging console 6
Router# clear logging
------------------------------------------------------------------------------------------------------
Rules to form IPSEC Tunnel(Excluding GRE)
1. VPN Terminating Devices (R1 and R2) should have reachability between each other interface IP.(R1 F0/0 & R2 F0/0)
2. VPN Terminating Devices (R1 and R2) should have route to VPN END Points.(R1 L0 & R2 L0).
2. Transit Devices (Internet) no need to have route to VPN END Points.(R1 L0 & R2 L0).
Class Tasks
Configuration
In R1:

- (config)# access-list 101 permit ipo host 10.1.1.1 host 10.1.2.1
- (config)# crypto isakmp policy 10
- - (config-policy)# encryption 3des
  - (config-policy)# authentication pre-share
  - (config-policy)# group 2
  - (config-policy)# hash sha1
- (config)# crypto isakmp key 0 cisco address 2.2.2.1
- (config)# crypto ipsec transform-set TSET esp-3des sha-aes-hmac
- (config)# crypto map CMAP 10 ipsec-isakmp
- - (config-crypto-map)# set peer 2.2.2.1
  - (config-crypto-map)# match address 101
  - (config-crypto-map)# set transform-set TSET
- (config)# int f0/0
- - (config-if)# crypto map CMAP

Similarly in R2
Verification Commands

- #show crypto isakmp SA
- #show crypto ipsec SA

Change to Transport Mode, add the following command in Step 4:

- (config-tranform-set)# mode transport

Even after doing this change, the ipsec negotiation will still be done through tunnel mode if pinged from Loopback to Loopback. To overcome this we make changes to ACL.
Change to Aggressive Mode, replace the Step 3 command with these commands in R1:

- (config)# crypto isakmp peer address 2.2.2.1
- - (config-peer)# set aggressive-mode password cisco
  - (config-peer)# set aggressive-mode client-endpoint ipv4-address 2.2.2.1

Similarly on R2.
The below process is for the negotiation using RSA-SIG (PKI) as authentication type
Debug Process:
After we debug, we can see the negotiation between the two peers. The first packet of the interesting traffic triggers the ISAKMP (Phase1) negotiation. Important messages are marked in BOLD and explanation in RED
R2(config)#do ping 10.1.1.1 so lo0 // Interesting Traffic
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
Mar 2 16:18:42.939: ISAKMP:(0): SA request profile is (NULL) // Router tried to find any IPSec SA matching the outgoing connection but no valid SA has been found in Security Association Database (SADB)
Mar 2 16:18:42.939: ISAKMP: Created a peer struct for 20.1.1.10, peer port 500
Mar 2 16:18:42.939: ISAKMP: New peer created peer = 0x46519678 peer_handle = 0x8000000D
Mar 2 16:18:42.939: ISAKMP: Locking peer struct 0x46519678, refcount 1 for isakmp_initiator
Mar 2 16:18:42.939: ISAKMP: local port 500, remote port 500
Mar 2 16:18:42.939: ISAKMP: set new node 0 to QM_IDLE
Mar 2 16:18:42.939: ISAKMP:(0):insert sa successfully sa = 4542B818
Mar 2 16:18:42.939: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. // Not an error. By default it is configured for Main Mode
Mar 2 16:18:42.939: ISAKMP:(0):No pre-shared key with 20.1.1.10! // Since we are using RSA Signature, this message. If we use pre-share, this is where it would indicate so!
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-07 ID
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-03 ID
Mar 2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-02 ID
Mar 2 16:18:42.939: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
Mar 2 16:18:42.939: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
Mar 2 16:18:42.943: ISAKMP:(0): beginning Main Mode exchange
Mar 2 16:18:42.943: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_NO_STATE // Sending ISAKMP Policy to peer
Mar 2 16:18:42.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
Mar 2 16:18:42.943: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_NO_STATE // Sending ISAKMP Policy to peer
Mar 2 16:18:42.947: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 2 16:18:42.947: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2
Mar 2 16:18:42.947: ISAKMP:(0): processing SA payload. message ID = 0
Mar 2 16:18:42.947: ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch // Do not worry about this! Not an ERROR!
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
Mar 2 16:18:42.947:.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
R2(config)# ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0): processing IKE frag vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0):Support for IKE Fragmentation not enabled
Mar 2 16:18:42.947: ISAKMP : Scanning profiles for xauth ...
Mar 2 16:18:42.947: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
Mar 2 16:18:42.947: ISAKMP: encryption 3DES-CBC
Mar 2 16:18:42.947: ISAKMP: hash SHA
Mar 2 16:18:42.947: ISAKMP: default group 2
Mar 2 16:18:42.947: ISAKMP: auth RSA sig
Mar 2 16:18:42.947: ISAKMP: life type in seconds
Mar 2 16:18:42.947: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
Mar 2 16:18:42.947: ISAKMP:(0):atts are acceptable. Next payload is 0
Mar 2 16:18:42.947: ISAKMP:(0):Acceptable atts:actual life: 0
Mar 2 16:18:42.947: ISAKMP:(0):Acceptable atts:life: 0
Mar 2 16:18:42.947: ISAKMP:(0):Fill atts in sa vpi_length:4
Mar 2 16:18:42.947: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
Mar 2 16:18:42.947: ISAKMP:(0):Returning Actual lifetime: 86400
Mar 2 16:18:42.947: ISAKMP:(0)::Started lifetime timer: 86400.
Mar 2 16:18:42.947: ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
Mar 2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
Mar 2 16:18:42.947: ISAKMP:(0): processing vendor id payload
Mar 2 16:18:42.951: ISAKMP:(0): processing IKE frag vendor id payload
Mar 2 16:18:42.951: ISAKMP:(0):Support for IKE Fragmentation not enabled
Mar 2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM2
Mar 2 16:18:42.951: ISAKMP (0): constructing CERT_REQ for issuer cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
Mar 2 16:18:42.951: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_SA_SETUP // Sending Key Exchange Information to peer
Mar 2 16:18:42.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
Mar 2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3
Mar 2 16:18:42.955: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_SA_SETUP // Receive key exchange information from peer
Mar 2 16:18:42.955: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 2 16:18:42.955: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_I_MM4
Mar 2 16:18:42.959: ISAKMP:(0): processing KE payload. message ID = 0
Mar 2 16:18:43.003: ISAKMP:(0): processing NONCE payload. message ID = 0
Mar 2 16:18:43.007: ISAKMP:(1008): processing CERT_REQ payload. message ID = 0
Mar 2 16:18:43.007: ISAKMP:(1008): peer wants a CT_X509_SIGNATURE cert
Mar 2 16:18:43.007: ISAKMP:(1008): peer wants cert issued by cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
Mar 2 16:18:43.007: Choosing trustpoint CA_Server as issuer
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008): vendor ID is Unity
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008): vendor ID seems Unity/DPD but major 180 mismatch
Mar 2 16:18:43.007: ISAKMP:(1008): vendor ID is XAUTH
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008): speaking to another IOS box!
Mar 2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.007: ISAKMP:(1008):vendor ID seems Unity/DPD but hash mismatch
Mar 2 16:18:43.007: ISAKMP:received payload type 20
Mar 2 16:18:43.007: ISAKMP (1008): His hash no match - this node outside NAT
Mar 2 16:18:43.007: ISAKMP:received payload type 20
Mar 2 16:18:43.007: ISAKMP (1008): No NAT Found for self or peer
Mar 2 16:18:43.007: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 2 16:18:43.007: ISAKMP:(1008):Old State = IKE_I_MM4 New State = IKE_I_MM4
Mar 2 16:18:43.011: ISAKMP:(1008):Send initial contact
Mar 2 16:18:43.011: ISAKMP:(1008):My ID configured as IPv4 Addr, but Addr not in Cert!
Mar 2 16:18:43.011: ISAKMP:(1008):Using FQDN as My ID
Mar 2 16:18:43.011: ISAKMP:(1008):SA is doing RSA signature authentication using id type ID_FQDN
Mar 2 16:18:43.011: ISAKMP (1008): ID payload
next-payload : 6
type : 2
FQDN name : R2
protocol : 17
port : 500
length : 10
Mar 2 16:18:43.011: ISAKMP:(1008):Total payload length: 10
Mar 2 16:18:43.019: ISAKMP (1008): constructing CERT payload for hostname=R2+serialNumber=FHK1502F2H8
Mar 2 16:18:43.019: ISAKMP:(1008): using the CA_Server trustpoint's keypair to sign
Mar 2 16:18:43.035: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_KEY_EXCH
Mar 2 16:18:43.035: ISAKMP:(1008):Sending an IKE IPv4 Packet.
Mar 2 16:18:43.035: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 2 16:18:43.035: ISAKMP:(1008):Old State = IKE_I_MM4 New State = IKE_I_MM5
Mar 2 16:18:43.047: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_KEY_EXCH
// "MM_KEY_EXCH" indicates that the peers have exchanged DH Public keys and generated a shared secret!
Mar 2 16:18:43.047: ISAKMP:(1008): processing ID payload. message ID = 0
Mar 2 16:18:43.047: ISAKMP (1008): ID payload
next-payload : 6
type : 2
FQDN name : ASA1
protocol : 0
port : 0
length : 12
Mar 2 16:18:43.047: ISAKMP:(0):: peer matches *none* of the profiles // Normal Message! Not an error!
Mar 2 16:18:43.047: ISAKMP:(1008): processing CERT payload. message ID = 0
Mar 2 16:18:43.047: ISAKMP:(1008): processing a CT_X509_SIGNATURE cert
Mar 2 16:18:43.051: ISAKMP:(1008): peer's pubkey isn't cached
Mar 2 16:18:43.059: ISAKMP:(1008): Unable to get DN from certificate!
Mar 2 16:18:43.059: ISAKMP:(1008): Cert presented by peer contains no OU field.
Mar 2 16:18:43.059: ISAKMP:(0):: peer matches *none* of the profiles
Mar 2 16:18:43.063: ISAKMP:(1008): processing SIG payload. message ID = 0
Mar 2 16:18:43.067: ISAKMP:received payload type 17
Mar 2 16:18:43.067: ISAKMP:(1008): processing vendor id payload
Mar 2 16:18:43.067: ISAKMP:(1008): vendor ID is DPD
Mar 2 16:18:43.067: ISAKMP:(1008):SA authentication status:
authenticated
Mar 2 16:18:43.067: ISAKMP:(1008):SA has been authenticated with 20.1.1.10
Mar 2 16:18:43.067: ISAKMP: Trying to insert a peer 40.1.1.1/20.1.1.10/500/, and inserted successfully 46519678. // SA inserted into SADB
Mar 2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM5 New State = IKE_I_MM6
Mar 2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM6 New State = IKE_I_MM6
Mar 2 16:18:43.071: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 2 16:18:43.071: ISAKMP:(1008):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE
Mar 2 16:18:43.071: ISAKMP:(1008):beginning Quick Mode exchange, M-ID of -1523793378
Mar 2 16:18:43.071: ISAKMP:(1008):QM Initiator gets spi
Mar 2 16:18:43.075: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE
Mar 2 16:18:43.075: ISAKMP:(1008):Sending an IKE IPv4 Packet.
Mar 2 16:18:43.075: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
Mar 2 16:18:43.075: ISAKMP:(1008):Old State = IKE_QM_READY New State = IKE_QM_I_QM1
Mar 2 16:18:43.075: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Mar 2 16:18:43.075: ISAKMP:(1008):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Mar 2 16:18:43.079: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) QM_IDLE // IPSec Policies
Mar 2 16:18:43.079: ISAKMP:(1008): processing HASH payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008): processing SA payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008):Checking IPSec proposal 1
Mar 2 16:18:43.079: ISAKMP: transform 1, ESP_3DES
Mar 2 16:18:43.079: ISAKMP: attributes in transform:
Mar 2 16:18:43.079: ISAKMP: SA life type in seconds
Mar 2 16:18:43.079: ISAKMP: SA life duration (basic) of 3600
Mar 2 16:18:43.079: ISAKMP: SA life type in kilobytes
Mar 2 16:18:43.079: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
Mar 2 16:18:43.079: ISAKMP: encaps is 1 (Tunnel)
Mar 2 16:18:43.079: ISAKMP: authenticator is HMAC-SHA
Mar 2 16:18:43.079: ISAKMP:(1008):atts are acceptable. // IPSec attributes are acceptable!
Mar 2 16:18:43.079: ISAKMP:(1008): processing NONCE payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
Mar 2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
Mar 2 16:18:43.083: ISAKMP:(1008): Creating IPSec SAs
Mar 2 16:18:43.083: inbound SA from 20.1.1.10 to 40.1.1.1 (f/i) 0/ 0
(proxy 1.1.1.1 to 2.2.2.2)
Mar 2 16:18:43.083: has spi 0xA9A66D46 and conn_id 0
Mar 2 16:18:43.083: lifetime of 3600 seconds
Mar 2 16:18:43.083: lifetime of 4608000 kilobytes
Mar 2 16:18:43.083: outbound SA from 40.1.1.1 to 20.1.1.10 (f/i) 0/0
(proxy 2.2.2.2 to 1.1.1.1)
Mar 2 16:18:43.083: has spi 0x2B367FB4 and conn_id 0
Mar 2 16:18:43.083: lifetime of 3600 seconds
Mar 2 16:18:43.083: lifetime of 4608000 kilobytes
Mar 2 16:18:43.083: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE
Mar 2 16:18:43.083: ISAKMP:(1008):Sending an IKE IPv4 Packet.
Mar 2 16:18:43.083: ISAKMP:(1008):deleting node -1523793378 error FALSE reason "No Error"
Mar 2 16:18:43.083: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
Mar 2 16:18:43.083: ISAKMP:(1008):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE // At this point tunnels are up and ready to pass traffic!
Verification Commands

- #show crypto isakmp SA
- #show crypto ipsec SA

Change to Transport Mode, add the following command in Step 4:

- (config-tranform-set)# mode transport

Even after doing this change, the ipsec negotiation will still be done through tunnel mode if pinged from Loopback to Loopback. To overcome this we make changes to ACL.
Change to Aggressive Mode, replace the Step 3 command with these commands in R1:

- (config)# crypto isakmp peer address 2.2.2.1
- - (config-peer)# set aggressive-mode password cisco
  - (config-peer)# set aggressive-mode clien-endpoint ipv4-address 2.2.2.1

Similarly on R2.

IPSEC VPN CONFIGURATION (AGRESSIVE MODE):

R1#

access-list 101 permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp peer address 100.0.0.2
set aggressive-mode password cisco
set aggressive-mode client-endpoint ipv4-address 100.0.0.2
crypto ipsec transform-set TSET esp-3des esp-md5-hmac
crypto map CMAP 10 ipsec-isakmp
match address 101
set peer 100.0.0.2
set transform-set TSET
Inter f0/0
crypto map CMAP

R2#

crypto isakmp policy 10

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp peer address 100.0.0.1

set aggressive-mode password cisco

set aggressive-mode client-endpoint ipv4-address 100.0.0.1

crypto ipsec transform-set TSET esp-3des esp-md5-hmac

crypto map CMAP 10 ipsec-isakmp

match address 101

set peer 100.0.0.1

set transform-set TSET

access-list 101 permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255

inter f0/0

crypto map CMAP

Verification:

Show crypto isakmp sa

Peer IP, type as L2L, MM_ACTIVE, role=responder/intiator

Show crypto isakmp sa detail

Will show Conn ID, Local ip, remote-ip, Enc, hash, auth, DH group, lifetime

Show crypto ipsec sa

Local IP, remote IP, interface name, crypto-map name, PROXY-ACL, packet encryption, hashing

Mode, transform-set, life-time

SPI - security parameter index - index for array of SA's - receiving router will find matching for phase 2 SA

To clear

Clear crypto isakmp

Clear crypto ipsec sa

Home Work Task
Q) Configure IPSec L2L using PSK on R1 and R2 using the following parameters

- Preshare: cisco123
- ISAKMP Policy
- - AES 256
  - Hash SHA
  - DH 2
- Phase 2:
- - Encryption 3DES
  - Hash MD5
  - Mode : Transport

Solution: As we can see the mode required by the task is TRANSPORT. As we know transport mode is used when creating tunnels between 2 end points with traffic originating and terminating at these end points. Hence we create the ACL for the interesting traffic from R1 to R2 and vice versa. Even if we give mode transport and give the crypto ACL hosts as hosts behind the terminating end points, the negotiation will happen in tunnel mode.
AT R1:

- (config)# access-list 101 permit ip host 1.1.1.1 host 2.2.2.1 // Interesting Traffic between R1 and R2
- (config)# crypto isakmp policy 10
- - (config-isakmp)# encryption aes 256
  - (config-isakmp)# authentication pre share
  - (config-isakmp)# hash sha
  - (config-isakmp)# group 2
- (config)# crypto isakmp key 0 cisco123 address 2.2.2.1
- (config)# crypto ipsec transform-set TSET esp-3des esp-md5-hmac
- - (cfg-crypto-trans)#mode transport // Mode Transport
- (config)# crypto map CMAP 10 ipsec-isakmp
- - (config-crypto-map)# set peer 2.2.2.1
  - (config-crypto-map)# set transform-set TSET
  - (config-crypto-map)# match address 101
- (config)# interface f0/0
- - (config-if)# crypto map CMAP

AT R2:

- (config)# access-list 101 permit host 2.2.2.1 ip host 1.1.1.1 // Interesting Traffic between R1 and R2
- (config)# crypto isakmp policy 10
- - (config-isakmp)# encryption aes 256
  - (config-isakmp)# authentication pre share
  - (config-isakmp)# hash sha
  - (config-isakmp)# group 2
- (config)# crypto isakmp key 0 cisco123 address 1.1.1.1
- (config)# crypto ipsec transform-set TSET esp-3des esp-md5-hmac
- - (cfg-crypto-trans)#mode transport // Mode Transport
- (config)# crypto map CMAP 10 ipsec-isakmp
- - (config-crypto-map)# set peer 1.1.1.1
  - (config-crypto-map)# set transform-set TSET
  - (config-crypto-map)# match address 101
- (config)# interface f0/0
- - (config-if)# crypto map CMAP

Q) Configure IPSec L2L using PSK on R1 and R3 using the following parameters protecting the loopback traffics!

- Preshare: ccie123
- ISAKMP Policy: Remains the same as Task 1
- IPSec Phase 2 Policy:
- - Encryption using AH using MD5
  - Mode: Tunnel

Solution:
AT R1:

- (config)# access-list 102 permit ip 10.1.1.0 255.255.255.0 10.1.3.0 255.255.255.0 // Interesting Traffic between R1 and R3 loopbacks
- (config)# crypto isakmp policy 15
- - (config-isakmp)# encryption 3des
  - (config-isakmp)# authentication pre share
  - (config-isakmp)# hash sha
  - (config-isakmp)# group 2
- (config)# crypto isakmp key 0 ccie123 address 3.3.3.1
- (config)# crypto ipsec transform-set TSET1 ah-md5
- - (cfg-crypto-trans)#mode tunnel
- (config)# crypto map CMAP 15 ipsec-isakmp
- - (config-crypto-map)# set peer 3.3.3.1
  - (config-crypto-map)# set transform-set TSET1
  - (config-crypto-map)# match address 102
- Already we've applied crypto map on the interface in previous question, So no need to apply again.

AT R2:

- (config)# access-list 101 permit 10.1.3.0 255.255.255.0 10.1.1.0 255.255.255.0 // Interesting Traffic between R1 and R3 loopbacks
- (config)# crypto isakmp policy 10
- - (config-isakmp)# encryption 3des
  - (config-isakmp)# authentication pre share
  - (config-isakmp)# hash sha
  - (config-isakmp)# group 2
- (config)# crypto isakmp key 0 ccie123 address 1.1.1.1
- (config)# crypto ipsec transform-set TSET1 ah-md5
- - (cfg-crypto-trans)#mode tunnel
- (config)# crypto map CMAP 10 ipsec-isakmp
- - (config-crypto-map)# set peer 1.1.1.1
  - (config-crypto-map)# set transform-set TSET
  - (config-crypto-map)# match address 101
- (config)# interface f0/0
- - (config-if)# crypto map CMAP

WIRESHARK CAPTURED PACKETS
IPSec Using PSK.pcapng