The content provided here explains how you can configure an IPsec tunnel with NECIX2000 Series Router. The objective is to protect devices behind the NEC IX2000 Series Router through a route-based IPsec tunnel. Follow these steps to connect the Cisco router to Secure Access.

Refer to Supported IPsec Parameters.

Before you begin

The following prerequisites must be met for the tunnel to work successfully.

Licensing

A valid Cisco Secure Access account.
A Cisco Secure Access organization ID. For more information, see Find Your Organization ID.

Network Access

You must select a Secure Access data center IP address when creating the Network Tunnel Group (IPsec tunnel). In the sample commands, <sse_primary_dc_ip,sse_secondary_dc_ip> refers to this IP address. We recommend choosing the IP address based on the data center located closest to your device.
Open UDP ports 500 and 4500 before connecting to the tunnel.

NEC IX router devices do not require public static IPv4 address(es) configured on the interface that will connect to the public internet and Cisco Secure Access Network Tunnel Group. They can be behind a NAT device. This is because we can specify a text as its IKE ID. This ID in combination with the PSK is used to successfully authenticate the NEC IX router devices with the Cisco Secure Access Network Tunnel Group. Refer to NEC IX router Configuration Guide (Example).

Procedure

Follow the steps mentioned in Add a Network Tunnel Group.

Configure the WAN and the LAN interface.

interface GigaEthernet0.0
  description WAN1
  ip address <WAN ip-address>
  ip tcp adjust-mss auto

interface GigaEthernet1.0
  description LAN1
  ip address <LAN ip-address>

Create an IKEv2 authentication.

ikev2 authentication psk id rfc822-addr <sse-primary-tunnel-id (e.g. xxxx@xxxx-xxxx-sse.cisco.com)> key char <sse-tunnel-passphrase>
ikev2 authentication psk id rfc822-addr <sse-secondary-tunnel-id (e.g. xxxx@xxxx-xxxx-sse.cisco.com)> key char <sse-tunnel-passphrase>

Create an IKEv2 profile.

ikev2 profile SSE-primary
  child-lifetime 3600
  child-pfs off
  child-proposal enc aes-gcm-256-16
  child-proposal integrity sha1
  dpd interval 10
  local-authentication psk id rfc822-addr <sse-primary-tunnel-id (e.g. xxxx@xxxx-xxxx-sse.cisco.com)>
  sa-lifetime 14400
  sa-proposal enc aes-gcm-256-16
  sa-proposal dh 2048-bit 

ikev2 profile SSE-secondary
  child-lifetime 3600
  child-pfs off
  child-proposal enc aes-gcm-256-16
  child-proposal integrity sha1
  dpd interval 10
  local-authentication psk id rfc822-addr <sse-secondary-tunnel-id (e.g. xxxx@xxxx-xxxx-sse.cisco.com)>
  sa-lifetime 14400
  sa-proposal enc aes-gcm-256-16
  sa-proposal dh 2048-bit

Create a tunnel interface.

interface Tunnel0.0
  tunnel mode ipsec-ikev2
  ip address 169.254.0.4/31
  ip tcp adjust-mss 1280
  ikev2 connect-type auto
  ikev2 local-authentication id rfc822-addr <sse-primary-tunnel-id (e.g. xxxx@xxxx-xxxx-sse.cisco.com)>
  ikev2 nat-traversal keepalive 20
  ikev2 peer <sse_primary_dc_ip> 

interface Tunnel1.0
  tunnel mode ipsec-ikev2
  ip address 169.254.0.8/31
  ip tcp adjust-mss 1280
  ikev2 connect-type auto
  ikev2 local-authentication id rfc822-addr <sse-secondary-tunnel-id (e.g. xxxx@xxxx-xxxx-sse.cisco.com)>
  ikev2 nat-traversal keepalive 20
  ikev2 peer <sse_secondary_dc_ip>

Create a BGP routing.

router bgp <local AS number>
  neighbor 169.254.0.5 remote-as 32644
  neighbor 169.254.0.5 update-source Tunnel0.0
  neighbor 169.254.0.9 remote-as 32644
  neighbor 169.254.0.9 update-source Tunnel1.0
  address-family ipv4 unicast
    network <advertised route>

Create two static routes for the BGP peer addresses.

ip route 169.254.0.5/32(BGP peer address) Tunnel0.0
ip route 169.254.0.9/32(BGP peer address) Tunnel1.0

Apply the IKEv2 outgoing interface to the tunnel interfaces.

interface Tunnel0.0
  ikev2 outgoing-interface GigaEthernet0.0 <WAN next-hop-ip-address>
interface Tunnel1.0
  ikev2 outgoing-interface GigaEthernet0.0 <WAN next-hop-ip-address>

Permit for tunnel establishment between sse dc ip addresses.

ip access-list sse-ipsec permit ip src <sse_primary_dc_ip> dest any
ip access-list sse-ipsec permit ip src <sse_secondary_dc_ip> dest any
ip route <sse_primary_dc_ip> <WAN next-hop-ip-address>
ip route <sse_secondary_dc_ip> <WAN next-hop-ip-address>
interface GigaEthernet0.0
  ip filter sse-ipsec 1 in

After completing the NEC IX router deployment and updating the route table, the deployment is ready for testing. Use the following commands on the NEC IX router to verify the tunnel connectivity status and traffic processing:
```
show ikev2 sa
show ikev2 child-sa
show logging (logging subsystem ikev2)
show ip bgp
show ip route
```

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.