ISO Site-2-Site VPN from CLI

Since ASDM and CCP are mature enough, almost no one goes to CLI naturally when configuring Site-2-Site VPN. However manual stuff are always handy. I found this recipe in my Archive from when I was learning for CCSP… Still pretty neat after 4.5 years.


1. Document your IKE Phase 1 negotiation criteria (example below)

o Encryption algorithm: AES-128

o Hashing: SHA-1

o Authentication: pre-shared

o Key exchange: Diffie-Hellman Group 2 

2. Document your IPSec (IKE Phase 2) negotiation criteria (example below)

o Encryption algorithm: esp-aes 128

o Authentication: esp-sha-hmac

Configuring IKE Phase 1: 

1. Enable ISAKMP: Router(config)#crypto isakmp enable

2. Create ISAKMP Policy: Router(config)#crypto isakmp policy <1-10000>

o Router(config)#crypto isakmp policy 10

· Router(config-isakmp)#encryption aes 128

· Router(config-isakmp)#authentication pre-share

· Router(config-isakmp)#group 2

· Router(config-isakmp)#hash sha

3. Configure ISAKMP Identity: Router(config)#crypto isakmp identity

4. Configure pre-shared keys: Router(config)#crypto isakmp key address

Configuring IKE Phase 2:

1. Create transform sets: Router(config)#crypto ipsec transform-set

o Router(config)#crypto ipsec transform-set L2L-VPN-SET esp-aes 128 esp-sha-hmac

2. (optional) Configure IPSec lifetime: Router(config)#crypto ipsec security-association lifetime 

3. Create mirrored extended numbered/named ACLs matching traffic to be encrypted and the traffic expected to be received encrypted 

4. Set up IPSec crypto-map: Router(config)#crypto map ipsec-isakmp

o Router(config)#crypto map L2L-VPN-MAP 10 ipsec-isakmp

· Router(config-crypto-map)#match address

· Router(config-crypto-map)#set peer

· Router(config-crypto-map)#set pfs (optional)

· Router(config-crypto-map)#set transform-set

5. Apply the crypto map to interface that VPN will initiate and terminate:

o Router(config)#interface

o Router(config-if)#crypto map L2L-VPN-MAP 


o show crypto isakmp policy

o show crypto ipsec transform-set

o show crypto isakmp sa (Phase 1)

o show crypto ipsec sa (Phase 2)

o show crypto map

o debug crypto isakmp (Phase 1)

o debug crypto ipsec(Phase 2)


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s