crypto isakmp policy ?
encry 3des
hash md5
authenti pre-share
group 2
lifetime ?
crypto isakmp sets up the policy
3des (triple des) is the encryption method (strong)
md5 (message digest 5) is the hash
pre-shared key is the authentication method
group 2 is the diffie-hellman group
and 86400 is the key's session lifetime
crypto isakmp key suck-key add 1.1.1.2
reverse the address on the peer
this is the key shared with 1.1.1.2
a transform set is needed for data protection, we can call it tset
crypto ipsec transform-set tset esp-3des esp-md5-hmac
mode transport
next associate an ipsec profile to the transform set
crypto ipsec profile gre-lock
set security-association lifetime seconds 86400
set transform-set tset
apply it to the tunnel
int tun 0
tunnel protection ipsec profile gre-lock
do the same for the peer
i1(config)#crypto isakmp policy ?
<1 -10000="-10000"> Priority of protection suite
i1(config)#crypto isakmp policy 1
i1(config-isakmp)#encry 3des
i1(config-isakmp)#hash md5
i1(config-isakmp)#authenti pre-share
i1(config-isakmp)#group 2
i1(config-isakmp)#lifetime ?
<60 -86400="-86400"> lifetime in seconds
i1(config-isakmp)#lifetime 86400
i1(config-isakmp)#exit
i1(config)#crypto isakmp key suck-key add 1.1.1.2
i1(config)#crypto ipsec transform-set tset esp-3des esp-md5-hmac
i1(cfg-crypto-trans)#mode transport
i1(cfg-crypto-trans)#crypto ipsec profile gre-lock
i1(ipsec-profile)#set security-association lifetime seconds 86400
i1(ipsec-profile)#set transform-set tset
i1(ipsec-profile)#exit
i1(config)#int tun 0
i1(config-if)#tunnel protection ipsec profile gre-lock
i1(config-if)#
*Aug 18 06:35:13: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
i1(config-if)#end
i1#
*Aug 18 06:37:38: %SYS-5-CONFIG_I: Configured from console by console
i1#ping 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/17/36 ms
i1#sh crypto session
Crypto session current status
Interface: Tunnel0
Session status: UP-ACTIVE
Peer: 1.1.1.2 port 500
IKEv1 SA: local 1.1.1.1/500 remote 1.1.1.2/500 Active
IPSEC FLOW: permit 47 host 1.1.1.1 host 1.1.1.2
Active SAs: 2, origin: crypto map
push... uuuuuuuuuuuunnnhhh... you just gave birth to a simple vpn... how'd that feel...
