5

I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this :

Network Diagram

I am trying to mount an IPSEC tunnel between Router A & Router B, with a L3 switch in the middle to simulate an ISP.

Without the IPSEC tunnel I could ping everything without any problems. As soon as I started building the tunnel, the pings stopped getting through.

Here are the configurations :

RouterA

crypto isakmp policy 2
 authentication pre-share
crypto isakmp key cisco123 address 172.17.1.1
!
crypto ipsec transform-set Router-IPSEC esp-des esp-sha-hmac
 mode tunnel
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to172.17.1.1
 set peer 172.17.1.1
 set transform-set Router-IPSEC
 match address 100
!
interface FastEthernet4
 switchport access vlan 10
 no ip address
 spanning-tree portfast

interface GigabitEthernet0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0.1
 encapsulation dot1Q 100
 ip address 172.16.1.1 255.255.255.0
 crypto map SDM_CMAP_1
!
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 172.16.1.2
!
access-list 100 permit ip 10.10.10.0 0.0.0.255 10.20.10.0 0.0.0.255 log
access-list 110 deny   ip 10.10.10.0 0.0.0.255 10.20.10.0 0.0.0.255 log
access-list 110 permit ip 10.10.10.0 0.0.0.255 any log
!
route-map nonat permit 10
 match ip address 110

RouterB

!
crypto isakmp policy 2
 authentication pre-share
crypto isakmp key cisco123 address 172.16.1.1
!
crypto ipsec transform-set Router-IPSEC esp-des esp-sha-hmac
 mode tunnel
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to172.16.1.1
 set peer 172.16.1.1
 set transform-set Router-IPSEC
 match address 100
!
interface FastEthernet4
 switchport access vlan 20
 no ip address
 spanning-tree portfast
!
interface GigabitEthernet0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0.1
 encapsulation dot1Q 200
 ip address 172.17.1.1 255.255.255.0
 crypto map SDM_CMAP_1
!
interface Vlan20
 ip address 10.20.10.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 172.17.1.2    
!
access-list 100 permit ip 10.20.10.0 0.0.0.255 10.10.10.0 0.0.0.255 log
access-list 110 deny   ip 10.20.10.0 0.0.0.255 10.10.10.0 0.0.0.255 log
access-list 110 permit ip 10.20.10.0 0.0.0.255 any log
!
route-map nonat permit 10
 match ip address 110

L3 Switch

!
system mtu routing 1500
ip subnet-zero
ip routing
!
interface FastEthernet1/0/1
 description *** Interco L2L ***
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100
 switchport mode trunk
!
interface FastEthernet1/0/2
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 200
 switchport mode trunk
!
interface Vlan100
 ip address 172.16.1.2 255.255.255.0
!
interface Vlan200
 ip address 172.17.1.2 255.255.255.0
!

When I try checking the IKE security associations, I find that no SA is made.

RouterB# show crypto isakmp sa

dst             src             state          conn-id slot status

However I can see IPSEC Security Associations...

RouterB# show crypto ipsec sa
    interface: FastEthernet0
Crypto map tag: SDM_CMAP_1, local addr 172.17.1.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.20.10.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)
   current_peer 172.16.1.1 port 500

Also, the ACL 100 & 110 show no matches even when I tring pinging one of the remote hosts from the local host.

What could be the issue? The fact that the ACL are not getting any hits seem strange to me.

Thanks for your answers.

Jeremy

  • Please add the ACLS and the 0/0 route on Router B. Also, which ACL 110 do you refer to? Do a debug on ISAKMP BTW, you'll propably immediately spot any problem. – Łukasz Bromirski May 12 '14 at 21:26
  • Lukasz : I forgot to add that a debug on both routers for ISAKMP return nothing. (term mon is enabled). Also ACLs & default ip route for both routers are already added above. – Jeremy G. May 12 '14 at 21:28
  • 2
    Which version of IOS is it? Try to remove the 'log' keyword from ACLs, on old IOSes process-switching meant problems with establishing of the VPN. Next, if it still doesn't come up (please ping continously between remote PCs) add 'no-xauth' to the definition of peer in isakmp ('crypto isakmp key cisco123 address 172.16.1.1'). If it doesn't work still, try to define the address as 0.0.0.0 for testing purposes. – Łukasz Bromirski May 12 '14 at 21:45
  • Ah, and BTW, 802.1q from config don't match what you have on the topology drawing... – Łukasz Bromirski May 12 '14 at 21:54
  • Hi, I edited the topology to remove the typo. Now it's working, I think there was a problem with my ACLs. I added a "permit ip any any" line and recreated them more precisely, now the isakmp SA are mounting. Thanks for the help – Jeremy G. May 13 '14 at 8:16
4

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers.

In this case there are several problems in your configuration as far as I can tell:

First of all - you need to establish a GRE (Unencrypted) tunnel between the two routers like so:

Router A:

    interface Tunnel100
     tunnel source 172.16.1.1
     tunnel destination 172.17.1.1
     ip address [inner ip-address] [inner subnet-mask]

Router B:

    interface Tunnel100
     tunnel source 172.17.1.1
     tunnel destination 172.16.1.1
     ip address [inner ip-address] [inner subnet-mask]

Now, in order for this to work there needs to be end-to-end connectivity between 172.16.1.1 and 172.17.1.1. In your config this is achieved with the ip route 0.0.0.0 0.0.0.0 172.[...] line but I would suggest strongly against that, as you will probably want to route all of your traffic through the tunnel later.

Change it to ip route 172.16.0.0 255.254.0.0 172.[...] instead (at least) - so only traffic in the 172.16/15 subnet is routed through the interface.

Once Tunnel100 is up - the tunnel ends (inner ip addresses) should be pingable, e.g if the inner ip-addresses are (A) - 192.168.0.1 and (B) - 192.168.0.2 you should be able to ping 192.168.0.2 from Router A:

ping 192.168.0.2 source 192.168.0.1
[...]
!!!!!

If this is working you would probably want to add a default route through the tunnel - as mentioned above:

ip route 0.0.0.0 0.0.0.0 192.168.0.[1 or 2]

Now, the next thing that should be done is encryption or "tunnel protection":

interface Tunnel100
 tunnel protection ipsec profile [isakmp-profile]

Check out this guide for a detailed explanation on isakmp profiles. It is also possible to use default

Also, you might be interested in this guide for deploying an IPSec vpn using ikev2 signaling (rather than isakmp) - the main difference being the (lack of) need to configure crypto-maps.

Cisco are slowly deprecating isakmp in a venture to replace it by ikev2, so it might be a good practice to deploy that configuration instead.

Hope this helped.

Regards,

Iliya

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.