0

I'm trying to new IPSec connection recommended by Cisco, here

Now i reserved a DevNet CML Sandbox and using the IOS-XE routers in there, which is Dist-RT01 and Dist-RT02.

Since CML sandbox using mgmt VRF and i don't want to confuse with VRF configuration, i disabled OSPF in mgmt VRF. Also since i'm trying IPSec, ı disabled OSPF for P2P link between Dist-RT-01 and Dist-RT-02. I created L3 loopbacks on both side and added both tunnel & loopback interfaces to OSPF. I did this because, i tried already ping to tunnel destinations on both router with no luck.

Here is my outputs: R1

dist-rtr01#show running-config | section ospf
router ospf 1
 no log-adjacency-changes
 network 1.1.1.1 0.0.0.0 area 0
 network 192.168.1.0 0.0.0.255 area 0
dist-rtr01#show running-config in
dist-rtr01#show running-config interface tun
dist-rtr01#show running-config interface tunnel0
Building configuration...

Current configuration : 195 bytes
!
interface Tunnel0
 ip address 192.168.1.1 255.255.255.252
 tunnel source GigabitEthernet6
 tunnel mode ipsec ipv4
 tunnel destination 172.16.252.18
 tunnel protection ipsec profile ipspro
end

dist-rtr01#show running-config interface loo
dist-rtr01#show running-config interface loopback 1
Building configuration...

Current configuration : 63 bytes
!
interface Loopback1
 ip address 1.1.1.1 255.255.255.255
end

dist-rtr01#show running-config | secti ipsec
crypto ipsec transform-set tset esp-aes 192 esp-sha256-hmac
 mode tunnel
crypto ipsec profile ipspro
 set transform-set tset
 set ikev2-profile ikepro
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ipspro
dist-rtr01#show running-config | secti ikev2
crypto ikev2 profile ikepro
 match identity remote address 172.16.252.18 255.255.255.255
 authentication remote pre-share key C1sco12345
 authentication local pre-share key C1sco12345
 set ikev2-profile ikepro
dist-rtr01#show ip route
      1.0.0.0/32 is subnetted, 1 subnets
C        1.1.1.1 is directly connected, Loopback1
      172.16.0.0/16 is variably subnetted, 10 subnets, 2 masks
C        172.16.252.0/30 is directly connected, GigabitEthernet4
L        172.16.252.2/32 is directly connected, GigabitEthernet4
C        172.16.252.8/30 is directly connected, GigabitEthernet5
L        172.16.252.10/32 is directly connected, GigabitEthernet5
C        172.16.252.16/30 is directly connected, GigabitEthernet6
L        172.16.252.17/32 is directly connected, GigabitEthernet6
C        172.16.252.20/30 is directly connected, GigabitEthernet2
L        172.16.252.21/32 is directly connected, GigabitEthernet2
C        172.16.252.24/30 is directly connected, GigabitEthernet3
L        172.16.252.25/32 is directly connected, GigabitEthernet3
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/30 is directly connected, Tunnel0
L        192.168.1.1/32 is directly connected, Tunnel0
dist-rtr01#show ip int bri
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet1       10.10.20.175    YES NVRAM  up                    up
GigabitEthernet2       172.16.252.21   YES NVRAM  up                    up
GigabitEthernet3       172.16.252.25   YES NVRAM  up                    up
GigabitEthernet4       172.16.252.2    YES NVRAM  up                    up
GigabitEthernet5       172.16.252.10   YES NVRAM  up                    up
GigabitEthernet6       172.16.252.17   YES NVRAM  up                    up
Loopback0              unassigned      YES unset  administratively down down
Loopback1              1.1.1.1         YES manual up                    up
Tunnel0                192.168.1.1     YES manual up                    up
dist-rtr01#show ip ospf
 Routing Process "ospf 1" with ID 172.16.252.25
 Start time: 00:02:37.200, Time elapsed: 01:19:42.628
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Supports NSSA (compatible with RFC 3101)
 Supports Database Exchange Summary List Optimization (RFC 5243)
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 50 msecs
 Minimum hold time between two consecutive SPFs 200 msecs
 Maximum wait time between two consecutive SPFs 5000 msecs
 Incremental-SPF disabled
 Initial LSA throttle delay 50 msecs
 Minimum hold time for LSA throttle 200 msecs
 Maximum wait time for LSA throttle 5000 msecs
 Minimum LSA arrival 100 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 EXCHANGE/LOADING adjacency limit: initial 300, process maximum 300
 Number of external LSA 1. Checksum Sum 0x00A760
 Number of opaque AS LSA 0. Checksum Sum 0x000000
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0) (Inactive)
        Number of interfaces in this area is 2 (1 loopback)
        Area has no authentication
        SPF algorithm last executed 00:22:33.879 ago
        SPF algorithm executed 23 times
        Area ranges are
        Number of LSA 16. Checksum Sum 0x08187A
        Number of opaque link LSA 0. Checksum Sum 0x000000
        Number of DCbitless LSA 4
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0
dist-rtr01#show crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 172.16.252.17

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 172.16.252.18 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.252.17, remote crypto endpt.: 172.16.252.18
     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet6
     current outbound spi: 0x2595E1E1(630579681)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xA6856113(2793758995)
        transform: esp-192-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2391, flow_id: CSR:391, sibling_flags FFFFFFFF80000048, crypto map: Tunnel0-head-0
         sa timing: remaining key lifetime (k/sec): (4608000/3590)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x2595E1E1(630579681)
        transform: esp-192-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2392, flow_id: CSR:392, sibling_flags FFFFFFFF80000048, crypto map: Tunnel0-head-0
         sa timing: remaining key lifetime (k/sec): (4608000/3590)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

R2

dist-rtr02#show running-config | section ospf
router ospf 1
 no log-adjacency-changes
 network 2.2.2.2 0.0.0.0 area 0
 network 192.168.1.0 0.0.0.255 area 0
dist-rtr02#show running-config interface tunnel0
Building configuration...

Current configuration : 195 bytes
!
interface Tunnel0
 ip address 192.168.1.2 255.255.255.252
 tunnel source GigabitEthernet6
 tunnel mode ipsec ipv4
 tunnel destination 172.16.252.17
 tunnel protection ipsec profile ipspro
end
dist-rtr02#show running-config interface loopback 1
Building configuration...

Current configuration : 63 bytes
!
interface Loopback1
 ip address 2.2.2.2 255.255.255.255
end
dist-rtr02#show running-config | secti ipsec
crypto ipsec transform-set tset esp-aes 192 esp-sha256-hmac
 mode tunnel
crypto ipsec profile ipspro
 set transform-set tset
 set ikev2-profile ikepro
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ipspro
dist-rtr02#show running-config | secti ikev2
crypto ikev2 profile ikepro
 match identity remote address 172.16.252.17 255.255.255.255
 authentication remote pre-share key C1sco12345
 authentication local pre-share key C1sco12345
 set ikev2-profile ikepro
dist-rtr02#show ip route
Gateway of last resort is not set

      2.0.0.0/32 is subnetted, 1 subnets
C        2.2.2.2 is directly connected, Loopback1
      172.16.0.0/16 is variably subnetted, 10 subnets, 2 masks
C        172.16.252.4/30 is directly connected, GigabitEthernet4
L        172.16.252.6/32 is directly connected, GigabitEthernet4
C        172.16.252.12/30 is directly connected, GigabitEthernet5
L        172.16.252.14/32 is directly connected, GigabitEthernet5
C        172.16.252.16/30 is directly connected, GigabitEthernet6
L        172.16.252.18/32 is directly connected, GigabitEthernet6
C        172.16.252.28/30 is directly connected, GigabitEthernet2
L        172.16.252.29/32 is directly connected, GigabitEthernet2
C        172.16.252.32/30 is directly connected, GigabitEthernet3
L        172.16.252.33/32 is directly connected, GigabitEthernet3
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/30 is directly connected, Tunnel0
L        192.168.1.2/32 is directly connected, Tunnel0
dist-rtr02#show ip ospf
 Routing Process "ospf 1" with ID 172.16.252.33
 Start time: 00:03:39.770, Time elapsed: 01:56:05.716
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Supports NSSA (compatible with RFC 3101)
 Supports Database Exchange Summary List Optimization (RFC 5243)
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 50 msecs
 Minimum hold time between two consecutive SPFs 200 msecs
 Maximum wait time between two consecutive SPFs 5000 msecs
 Incremental-SPF disabled
 Initial LSA throttle delay 50 msecs
 Minimum hold time for LSA throttle 200 msecs
 Maximum wait time for LSA throttle 5000 msecs
 Minimum LSA arrival 100 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 EXCHANGE/LOADING adjacency limit: initial 300, process maximum 300
 Number of external LSA 1. Checksum Sum 0x00A760
 Number of opaque AS LSA 0. Checksum Sum 0x000000
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0) (Inactive)
        Number of interfaces in this area is 2 (1 loopback)
        Area has no authentication
        SPF algorithm last executed 00:35:09.549 ago
        SPF algorithm executed 52 times
        Area ranges are
        Number of LSA 13. Checksum Sum 0x06D723
        Number of opaque link LSA 0. Checksum Sum 0x000000
        Number of DCbitless LSA 4
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0

dist-rtr02#show crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 172.16.252.18

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 172.16.252.17 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.252.18, remote crypto endpt.: 172.16.252.17
     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet6
     current outbound spi: 0xC181FB47(3246521159)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xAE0353D(182465853)
        transform: esp-192-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2584, flow_id: CSR:584, sibling_flags FFFFFFFF80000048, crypto map: Tunnel0-head-0
         sa timing: remaining key lifetime (k/sec): (4608000/3597)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xC181FB47(3246521159)
        transform: esp-192-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2583, flow_id: CSR:583, sibling_flags FFFFFFFF80000048, crypto map: Tunnel0-head-0
         sa timing: remaining key lifetime (k/sec): (4608000/3597)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
dist-rtr02#

I would appreciate any ideas.

Thanks.

Edit:

dist-rtr01#show crypto ikev2 sa
 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status
2         172.16.252.17/500     172.16.252.18/500     none/none            READY
      Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:19, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/4258 sec

 IPv6 Crypto IKEv2  SA

dist-rtr02#show crypto ikev2 sa
 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status
1         172.16.252.18/500     172.16.252.17/500     none/none            READY
      Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:19, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/4335 sec

 IPv6 Crypto IKEv2  SA

@Ron Trunk I added your request.

4
  • Are the VPN tunnels established? show crypto ikev2 sa
    – Ron Trunk
    Feb 3, 2023 at 19:17
  • Thanks for advice. Outputs in post
    – frknl
    Feb 3, 2023 at 19:42
  • show crypto ikev2 session
    – Ron Trunk
    Feb 3, 2023 at 20:31
  • Ok, i started another lab and used same config on here, it works. CML Sandbox has some instability issiues. @Ron Trunk thanks anyway
    – frknl
    Feb 4, 2023 at 0:29

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.