Configure IPsec ciphers, parameters, and virtual template interface for the SD-WAN RA headend device using a CLI add-on template in Cisco SD-WAN Manager.
This task configures the IPsec settings required for the SD-WAN RA headend device to establish secure tunnel connections.
Use this procedure to set up IPsec encryption settings, security parameters, and the virtual template interface that enables secure communication for remote access connections.
Before you begin
Define the VRF for the service VPN before beginning this procedure. You can use a Cisco SD-WAN Manager feature template to define the VRF.
Follow these steps to configure IPsec ciphers, parameters, and template interface:
Procedure
-
Configure IPsec ciphers.
Example:
crypto ipsec transform-set sdwan-ra_transform_se ipsec-cipher
mode tunnel
Example:
crypto ipsec transform-set sdwan-ra_ipsec_ts esp-gcm 256
mode tunnel
-
Configure IPsec parameters.
Example:
crypto ipsec profile sdwan-ra_ipsec_profile
set transform-set sdwan-ra_transform_set
set security-association lifetime seconds ipsec_sa_life_sec
set security-association replay window-size window-size
set ikev2-profile sdwan-ra_ikev2_profile
Example:
crypto ipsec profile sdwan-ra_ipsec-profile
set security-association lifetime seconds 33600
set security-association replay window-size 64
set transform-set sdwan-ra_transform_set
set ikev2-profile sdwan-ra_ikev2_profile
-
Configure the IPsec virtual-template interface.
Example:
interface Loopback 65515
vrf forwarding sdwan-ra_service_vpn
ip address private_ipv4_addr subnet_mask
interface Virtual-Template sdwan-ra_vt_intf_num type tunnel
vrf forwarding sdwan-ra_service_vpn
tunnel mode ipsec ipv4
tunnel protection ipsec profile sdwan-ra_ipsec_profile
Example:
vrf definition sdwan-ra_service_vpn
!
interface interface Loopback 65515
vrf forwarding sdwan-ra_service_vpn
ip address 10.0.0.100 255.255.255.0
!
interface Virtual-Template101 type tunnel
vrf forwarding sdwan-ra_service_vpn
tunnel mode ipsec ipv4
tunnel protection ipsec profile sdwan-ra_ipsec-profile
The IPsec ciphers, parameters, and virtual template interface are configured for the SD-WAN RA headend device.