Site-to-Site IPsec VPN: IKEv1/v2

Step 1

IKEv1 بمقابلہ IKEv2: IKEv1 میں Phase 1 کے 2 modes (main/aggressive) اور 6-9 میسجز۔ IKEv2 میں صرف 4 میسجز، ایک ہی exchange، NAT-T اور EAP authentication built-in۔ نیا standard IKEv2 ہے۔IKEv1 vs IKEv2: IKEv1 mein Phase 1 ke 2 modes (main/aggressive) aur 6-9 messages. IKEv2 mein sirf 4 messages, ek hi exchange, NAT-T aur EAP authentication built-in. Naya standard IKEv2 hai.IKEv1 vs IKEv2: IKEv1 has 2 Phase 1 modes (main/aggressive) and 6-9 messages. IKEv2 has only 4 messages, a single exchange, NAT-T and EAP authentication built in. IKEv2 is the new standard.

Step 2

R1 پر IKEv2 proposal بنائیں (encryption، integrity، DH group) اور اسے policy میں ڈالیں۔ دونوں طرف یہ same ہونا چاہیے۔R1 par IKEv2 proposal banao (encryption, integrity, DH group) aur usay policy mein daalo. Dono taraf ye same hona chahiye.Create the IKEv2 proposal on R1 (encryption, integrity, DH group) and put it in a policy. It must match on both sides.

enable
configure terminal
crypto ikev2 proposal MY-PROPOSAL
encryption aes-cbc-256
integrity sha256
group 14
exit
crypto ikev2 policy MY-POLICY
proposal MY-PROPOSAL
exit

Step 3

Keyring میں peer کا IP اور pre-shared key بتائیں۔ Profile میں بتائیں کہ کس peer سے بات کرنی ہے اور authentication کیسے ہوگی۔Keyring mein peer ka IP aur pre-shared key batao. Profile mein batao ke kis peer se baat karni hai aur authentication kaise hogi.In the keyring, define the peer's IP and pre-shared key. In the profile, define which peer to talk to and how authentication happens.

crypto ikev2 keyring MY-KEYRING
peer PEER1
address 203.0.113.2
pre-shared-key MYSECRET
exit
exit
crypto ikev2 profile MY-PROFILE
match identity remote address 203.0.113.2 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local MY-KEYRING
exit

Step 4

Transform-set میں اصل encryption (ESP) بتائیں اور IPsec profile بنائیں جو transform-set اور IKEv2 profile کو جوڑے۔Transform-set mein asal encryption (ESP) batao aur IPsec profile banao jo transform-set aur IKEv2 profile ko jore.Define the actual encryption (ESP) in the transform-set and create an IPsec profile that joins the transform-set and the IKEv2 profile.

crypto ipsec transform-set MY-SET esp-aes 256 esp-sha256-hmac
mode tunnel
exit
crypto ipsec profile MY-IPSEC-PROFILE
set transform-set MY-SET
set ikev2-profile MY-PROFILE
exit

Step 5

Tunnel انٹرفیس بنائیں اور اسے IPsec profile سے محفوظ کریں۔ tunnel protection لائن ہی ٹنل کو encrypt کرتی ہے۔Tunnel interface banao aur usay IPsec profile se mehfooz karo. tunnel protection line hi tunnel ko encrypt karti hai.Create the tunnel interface and protect it with the IPsec profile. The tunnel protection line is what encrypts the tunnel.

interface tunnel 0
ip address 10.0.0.1 255.255.255.252
tunnel source s0/0/0
tunnel destination 203.0.113.2
tunnel protection ipsec profile MY-IPSEC-PROFILE
exit

Step 6

R2 پر آئینے والی کانفگ کریں (IP اور peer الٹ)۔ پھر R1 پر دوسری سائٹ کا route ٹنل کے ذریعے دیں۔R2 par aaine wali config karo (IP aur peer ulat). Phir R1 par doosri site ka route tunnel ke through do.Do the mirror config on R2 (IPs and peer reversed). Then on R1 route the other site's network through the tunnel.

ip route 192.168.30.0 255.255.255.0 10.0.0.2
exit

Step 7

ٹیسٹنگ: PC1 سے PC2 پنگ کریں۔ show crypto ikev2 sa میں SA بنی ہوئی نظر آئے، اور show crypto ipsec sa میں encaps/decaps بڑھ رہے ہوں۔Testing: PC1 se PC2 ping karo. show crypto ikev2 sa mein SA bani hui nazar aaye, aur show crypto ipsec sa mein encaps/decaps barh rahe hon.Testing: ping PC2 from PC1. The SA should appear in show crypto ikev2 sa, and encaps/decaps should be increasing in show crypto ipsec sa.

show crypto ikev2 sa
show crypto ipsec sa