Configuration Example: Configuring IPSec LAN-to-LAN VPN

Establishing a secure LAN-to-LAN VPN using IPSec involves building both Phase 1 (ISAKMP/IKE) and Phase 2 (IPSec) tunnels. This guide walks through the high-level steps required to configure this on Cisco routers.

Step 1: Configure the ISAKMP Tunnel (Phase 1)

The first step in building an IPSec VPN is establishing the ISAKMP tunnel, which runs over UDP port 500. This phase handles the negotiation of key parameters like authentication, encryption, hashing, and the Diffie-Hellman group for key exchange.

Here’s a sample configuration for Phase 1:

crypto isakmp policy 5
authentication pre-share
encryption aes
hash sha
group 5

You’ll also need to define the pre-shared key and remote peer:

crypto isakmp key key address remote-peer-address

Step 2: Configure the IPSec Tunnel (Phase 2)

Once ISAKMP is in place, you configure the IPSec transform set, which defines how the traffic will be protected in the data phase. This includes the encryption and hashing algorithms.

crypto ipsec transform-set tset-name esp-aes esp-sha-hmac

Step 3: Define the Interesting Traffic

To determine which traffic should be encrypted, you use an access list. This identifies the traffic that will trigger the tunnel.

access-list 101 permit ip local-subnet wildcard-mask remote-subnet wildcard-mask

Step 4: Create the Crypto Map

The crypto map ties together all your tunnel parameters, ISAKMP, transform set, peer, and access list, and applies them as a single configuration object.

crypto map map-name 10 ipsec-isakmp
match address acl-num
set peer remote-peer-address
set transform-set tset-name

Step 5: Apply Crypto Map to Interface

Finally, you apply the crypto map to the router’s outgoing interface, typically the one facing the WAN or remote peer.

interface g2
crypto map map-name

Bonus: Manual Mode (Not Recommended)

While it’s technically possible to bypass ISAKMP by configuring IPSec manually using:

crypto map map-name num ipsec-manual

Note: This method is rarely used in real-world deployments. It involves static keys and lacks the dynamic security benefits of ISAKMP. Using the same key for all encrypted traffic significantly increases vulnerability and is considered poor practice.