IPsec Cisco IOS - Revision history

Heth: /* GETVPN */

2021-03-10T06:23:55Z

‎GETVPN

2021-03-06T08:42:37Z

‎Links

2019-03-21T08:52:52Z

‎Site-to-Site VPN

2019-03-21T08:51:58Z

‎Site-to-Site VPN

2018-10-18T06:51:55Z

‎Links

2018-10-18T06:21:25Z

‎Links

2018-04-30T07:37:06Z

‎AH

2018-04-30T07:35:13Z

2018-03-13T08:25:10Z

2017-12-13T12:39:12Z

‎IPsec Site-to-Site configuration steps

@@ Line 421: / Line 421: @@
 Group Encrypted Transport VPN -
 *[https://www.cisco.com/c/dam/en/us/products/collateral/security/group-encrypted-transport-vpn/GETVPN_DIG_version_2_0_External.pdf Cisco Group Encrypted Transport VPN (GETVPN) Design and Implementation Guide]
 ===References===
   <references/>
 {{Source cli}}

@@ Line 418: / Line 418: @@
 *[http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/936-cisco-router-vpn-dynamic-endpoint.html CONFIGURING CISCO SITE TO SITE IPSEC VPN WITH DYNAMIC IP ENDPOINT CISCO ROUTERS]
 *[http://www.mustbegeek.com/configure-site-to-site-ipsec-vpn-tunnel-in-cisco-ios-router/ configure site-to-site ipsec vpn-tunnel]
 ===References===
   <references/>
 {{Source cli}}

@@ Line 100: / Line 100: @@
 *Cisco eksempel [[Media:IP sec site-to-site cli.pdf|IPsec Site-to-Site using CLI]] (Loads PDF)
 *Cisco eksempel [[Media:IP sec site-to-site sdm.pdf|IPsec Site-to-Site using SDM]] (Loads PDF)
-Before configuring IPsec make sure you can ping between the Routers.You must be able to ping the two endpoints of the tunnel. In the example below R1 endpoint is 192.168.100.103 on fastethernet 0/0 and R2 endpoint is 192.168.100.104 on fastethernet 0/0. The configuration Tunnels all trafic between 172.16.1.0/24 on R1 and 172.16.3.0/24 on R2.
+Before configuring IPsec make sure you can ping between the Routers.You must be able to ping the two endpoints of the tunnel. In the example below Router-A endpoint is 192.168.100.103 on fastethernet 0/0 and Router-B endpoint is 192.168.100.104 on fastethernet 0/0. The configuration Tunnels all trafic between 172.16.1.0/24 on Router-A and 172.16.3.0/24 on Router-B.
 |-
 |[[Image:Tegning1.png|left|600px|thumb|Picture 1: Site-to-Site IPsec VPN]]

@@ Line 102: / Line 102: @@
 Before configuring IPsec make sure you can ping between the Routers.You must be able to ping the two endpoints of the tunnel. In the example below R1 endpoint is 192.168.100.103 on fastethernet 0/0 and R2 endpoint is 192.168.100.104 on fastethernet 0/0. The configuration Tunnels all trafic between 172.16.1.0/24 on R1 and 172.16.3.0/24 on R2.
 |-
-|[[Image:Site-to-Site IPsec tunnel.png|left|600px|thumb|Picture 1: Site-to-Site IPsec VPN]]
+|[[Image:Tegning1.png|left|600px|thumb|Picture 1: Site-to-Site IPsec VPN]]
 |}
 === R1 config ===

@@ Line 417: / Line 417: @@
 ===Links===
 *[http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/936-cisco-router-vpn-dynamic-endpoint.html CONFIGURING CISCO SITE TO SITE IPSEC VPN WITH DYNAMIC IP ENDPOINT CISCO ROUTERS]
-*http://www.mustbegeek.com/configure-site-to-site-ipsec-vpn-tunnel-in-cisco-ios-router/
+*[http://www.mustbegeek.com/configure-site-to-site-ipsec-vpn-tunnel-in-cisco-ios-router/ configure site-to-site ipsec vpn-tunnel]
 ===References===
   <references/>
 {{Source cli}}

@@ Line 33: / Line 33: @@
 |-
 |}
-*HMAC = hash-based message authentication code. It may be used to simultaneously verify both the data integrity and the authentication of a message
+;HMAC
 Both MD5 and SHA-1 use a shared secret key for both the calculation and verification of the message authentication values. The cryptographic strength of the HMAC is dependent upon the properties of the underlying hash function. Both MD5 and SHA-1 take variable-length input data and create a fixed-length hash. The difference is the size and strength of the hash created. Although IPsec uses only the first 96 bits of the 160-bit SHA-1 hash, it is considered more secure than MD5 (although SHA-1 is computationally slower than MD5).
 == IPsec operation ==
 #Interesting traffic discovered (ACL list)

@@ Line 49: / Line 49: @@
   group 5
   lifetime 3600
 </source>
 * 2: Configure the IPsec transform set (IKE phase 2 and tunnel termination)