16.2.2 Packet Tracer - Configure and Verify a Site-to-Site IPsec VPN Using CLI (Answers)

R1(config)# license boot module c1900 technology-package securityk9

R1(config)# access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 5
R1(config-isakmp)# exit
R1(config)# crypto isakmp key vpnpa55 address 10.2.2.2

R1(config)# crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac

R1(config)# crypto map VPN-MAP 10 ipsec-isakmp
R1(config-crypto-map)# description VPN connection to R3
R1(config-crypto-map)# set peer 10.2.2.2
R1(config-crypto-map)# set transform-set VPN-SET
R1(config-crypto-map)# match address 110
R1(config-crypto-map)# exit

R1(config)# interface s0/0/0
R1(config-if)# crypto map VPN-MAP

R3(config)# access-list 110 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255

R3(config)# crypto isakmp policy 10
R3(config-isakmp)# encryption aes 256
R3(config-isakmp)# authentication pre-share
R3(config-isakmp)# group 5
R3(config-isakmp)# exit
R3(config)# crypto isakmp key vpnpa55 address 10.1.1.2

R3(config)# crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac

R3(config)# crypto map VPN-MAP 10 ipsec-isakmp
R3(config-crypto-map)# description VPN connection to R1
R3(config-crypto-map)# set peer 10.1.1.2
R3(config-crypto-map)# set transform-set VPN-SET
R3(config-crypto-map)# match address 110
R3(config-crypto-map)# exit

R3(config)# interface s0/0/1
R3(config-if)# crypto map VPN-MAP

! ==============================================================
!--- 16.2.2 Packet Tracer - Configure and Verify a Site-to-Site IPsec VPN Using CLI
!--- ANSWER SCRIPT FOR ROUTER R1
!--- Usage: copy this whole file and paste it into the R1 terminal (start at the R1> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Scope: console/vty/enable passwords, SSH, IP addressing and OSPF 101
!--- are already pre-configured per the activity's own Background note -
!--- this script only enables the Security Technology package and builds
!--- the site-to-site IPsec VPN to R3.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1, Step 2: Enable the Security Technology package - IPsec/VPN
!--- features are licensed separately and are off by default.
! --------------------------------------------------------------

license boot module c1900 technology-package securityk9
yes
end

!--- The license only takes effect after a save and a reload.
copy running-config startup-config

reload

! --------------------------------------------------------------
!--- Part 1, Step 3: Identify interesting traffic - only LAN-to-LAN
!--- traffic between R1 and R3 should trigger the VPN. Everything else
!--- hits the implicit deny and is simply routed unencrypted, not blocked.
! --------------------------------------------------------------

configure terminal

access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255

! --------------------------------------------------------------
!--- Part 1, Step 4: IKE Phase 1 (ISAKMP) policy - only the non-default
!--- parameters need to be set explicitly (AES 256, DH group 5); pre-share
!--- authentication and SHA-1 hashing are already IOS defaults.
! --------------------------------------------------------------

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 5
 exit

!--- Pre-shared key, tied to R3's WAN address (10.2.2.2) as the remote peer.
crypto isakmp key vpnpa55 address 10.2.2.2

! --------------------------------------------------------------
!--- Part 1, Step 5: IKE Phase 2 (IPsec) policy - the transform set defines
!--- how traffic is protected, and the crypto map ties the transform set,
!--- the peer, and the interesting-traffic ACL together.
! --------------------------------------------------------------

crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac

crypto map VPN-MAP 10 ipsec-isakmp
 description VPN connection to R3
 set peer 10.2.2.2
 set transform-set VPN-SET
 match address 110
 exit

! --------------------------------------------------------------
!--- Part 1, Step 6: Apply the crypto map on the outgoing WAN interface -
!--- this is what actually activates IPsec on traffic leaving R1.
! --------------------------------------------------------------

interface serial 0/0/0
 crypto map VPN-MAP
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show version                    -> Security Technology package: Enabled
!---   show crypto isakmp policy       -> policy 10: AES 256, SHA, pre-share, DH group 5, 86400s
!---   show crypto map                 -> VPN-MAP: peer 10.2.2.2, transform VPN-SET, ACL 110
!---   show crypto ipsec sa            -> before Part 3 Step 2, all packet counters at 0
!---   ping 192.168.3.3 (from PC-A)     -> Part 3 Step 2, "interesting traffic"
!---   show crypto ipsec sa            -> after the ping, packet counters > 0 (tunnel active)
!---   ping 192.168.2.3 (from PC-A)     -> Part 3 Step 4, "uninteresting" (not matched by ACL 110)
!---   show crypto ipsec sa            -> after that ping, counters unchanged - confirms it wasn't encrypted
!--- Note: no functional errors found versus the lab's own Instructions -
!--- the ISAKMP/IPsec parameters, peer addresses and ACL direction all
!--- match the Addressing Table and the two policy tables.
! ==============================================================

! ==============================================================
!--- 16.2.2 Packet Tracer - Configure and Verify a Site-to-Site IPsec VPN Using CLI
!--- ANSWER SCRIPT FOR ROUTER R3
!--- Usage: copy this whole file and paste it into the R3 terminal (start at the R3> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Scope: console/vty/enable passwords, SSH, IP addressing and OSPF 101
!--- are already pre-configured per the activity's own Background note.
!--- Part 2, Step 1 says to check "show version" first - if the Security
!--- Technology package is not already enabled on R3, run the same
!--- "license boot module c1900 technology-package securityk9" + save +
!--- reload sequence used on R1 (see its script) before continuing below.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2, Step 2: Identify interesting traffic - the mirror image of
!--- R1's ACL 110 (source and destination swapped), so traffic in either
!--- direction between the two LANs is recognized as interesting.
! --------------------------------------------------------------

access-list 110 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255

! --------------------------------------------------------------
!--- Part 2, Step 3: IKE Phase 1 (ISAKMP) policy - must match R1's policy
!--- 10 parameters exactly, or the two peers won't negotiate.
! --------------------------------------------------------------

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 5
 exit

!--- Same pre-shared key as R1, tied to R1's WAN address (10.1.1.2) as the
!--- remote peer.
crypto isakmp key vpnpa55 address 10.1.1.2

! --------------------------------------------------------------
!--- Part 2, Step 4: IKE Phase 2 (IPsec) policy - same transform set name
!--- and crypto map name as R1, with peer and ACL mirrored for this side.
! --------------------------------------------------------------

crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac

crypto map VPN-MAP 10 ipsec-isakmp
 description VPN connection to R1
 set peer 10.1.1.2
 set transform-set VPN-SET
 match address 110
 exit

! --------------------------------------------------------------
!--- Part 2, Step 5: Apply the crypto map on the outgoing WAN interface -
!--- R3's link toward R2/R1, not its LAN interface.
! --------------------------------------------------------------

interface serial 0/0/1
 crypto map VPN-MAP
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show version                    -> Security Technology package: Enabled
!---   show crypto isakmp policy       -> policy 10 matches R1's exactly
!---   show crypto map                 -> VPN-MAP: peer 10.1.1.2, transform VPN-SET, ACL 110
!---   show crypto ipsec sa            -> after PC-A pings PC-C (Part 3), packet counters > 0 on both routers
!--- Note: the lab's own "Script for R3" has an indentation slip - the line
!--- "crypto map VPN-MAP 10 ipsec-isakmp" is shown indented with a leading
!--- space right after "crypto ipsec transform-set ...", as if it were a
!--- sub-command of the transform-set line. It isn't: "crypto map" is its
!--- own global-config command that opens the "config-crypto-map" sub-mode
!--- on the following lines. This script places it correctly, un-indented,
!--- as its own command - cosmetic in Packet Tracer (leading whitespace is
!--- trimmed on paste), but worth fixing in the published script for clarity.
! ==============================================================