Demonstrates practical configuration scenarios for VPN interface IPsec, offering sample setups to guide secure deployment and integration within network environments.
Basic configuration
The following is an example of the basic IPsec tunnel interface configuration.
crypto
interface tunnel ifnum
no shutdown
vrf forwarding vrf_id
ip address ip_address[mask]
tunnel source wanif_ip
tunnel mode {ipsec ipv4 | gre ip}
tunnel destination gateway_ip
tunnel protection ipsec profile ipsec_profile_name
Dead-Peer detection
The following is an example of Internet key exchange (IKE) dead-peer detection (DPD) configuration.
crypto
ikev2
profile ikev2_profile_name
dpd 10-3600 2-60 {on-demand | periodic}IKE
The following is an example of ISAKMP CLI configuration for IKEv1.
crypto
isakmp
keepalive 60-86400 2-60 {on-demand | periodic}
policy policy_num
encryption {AES128-CBC-SHA1 | AES256-CBC-SHA1}
hash {sha384 | sha256 | sha}
authentication pre-share
group {2 | 14 | 16 | 19 | 20 | 21}
lifetime 60-86400
profile ikev1_profile_name
match identity address ip_address [mask]
keyring keyring_nameThe following is an example of IPsec CLI configuration for IKEv1.
profile ipsec_profile_name
set transform-set transform_set_name
set isakmp-profile ikev1_profile_name
set security-association
lifetime {kilobytes disable | seconds 120-2592000}
replay {disable | window-size [64 | 128 | 256 | 512 | 1024]}
set pfs group {14 | 16 | 19 | 20 | 21}
keyring keyring_name
pre-shared-key address ip_address [mask] key key_string
ipsec transform-set transform_set_name {esp-gcm 256 | esp-aes 256 [esp-sha384-hmac | esp-sha256-hmac] mode tunnelThe following is an example configuration for IKE2.
crypto
ikev2
proposal proposal_name
encryption {3des | aes-cbc-128 | aes-cbc-192 | aes-cbc-256 | des}
integrity {sha256 | sha384 | sha512}
group {2 | 14 | 15 | 16}
keyring idev2_keyring_name
peer peer_name
address tunnel_dest_ip [mask]
pre-shared-key key_string
profile ikev2_profile_name
match identity remote address ip_address
authentication {remote | local} pre-share
keyring local ikev2_keyring_name
lifetime 120-86400 IPsec tunnel
The following is an example configuration of IPsec tunnels.
crypto
ipsec
profile ipsec_profile_name
set ikev2-profile ikev2_profile_name
set security-association
lifetime {seconds 120-2592000 | kilobytes disable}
replay {disable | window-size {64 | 128 | 256 | 512 | 1024 | 4096 | 8192}
set pfs group {2 | 14 | 15 | 16 | none}
set transform-set transform_set_name