229
# Create IKEv2 keyring keyring_a.
[RouterA] ikev2 keyring keyring_a
# Create IKEv2 peer peer_a.
[RouterA-keyring-keyring_a] peer peer_a
# Configure the address range 2.2.2.2/16 for the peer.
[RouterA-keyring-keyring_a-peer-peer_a] address 2.2.2.2 16
# Use the plain text key 123 for both certificate signing and certificate authentication.
[RouterA-keyring-keyring_a-peer-peer_a] pre-shared-key simple 123
[RouterA-keyring-keyring_a-peer-peer_a] quit
[RouterA-keyring-keyring_a] quit
6. Configure an IKEv2 profile:
# Create IKEv2 profile profile_a.
[RouterA] ikev2 profile profile_a
# Set both the local and remote authentication methods to pre-shared key.
[RouterA-profile-profile_a] authentication local pre-share
[RouterA-profile-profile_a] authentication remote pre-share
# Use the FQDN router_a as the local identity information.
[RouterA-profile-profile_a] identity local fqdn router_a
# Use the keyring keyring_a.
[RouterA-profile-profile_a] keyring keyring_a
# Use remote FQDN router_b for IKEv2 profile matching.
[RouterA-profile-profile_a] match identity remote fqdn router_b
[RouterA-profile-profile_a] quit
7. Configure an IPsec policy that uses IKEv2.
[RouterA] ipsec policy map 1 isakmp
[RouterA-ipsec-policy-isakmp-map1-1] encapsulation-mode tunnel
[RouterA-ipsec-policy-isakmp-map1-1] security acl 3101
[RouterA-ipsec-policy-isakmp-map1-1] ikev2 profile profile_a
[RouterA-ipsec-policy-isakmp-map1-1] remote-address 2.2.2.2
[RouterA-ipsec-policy-isakmp-map1-1] local-address 1.1.1.1
[RouterA-ipsec-policy-isakmp-map1-1] transform-set transform_a
[RouterA-ipsec-policy-isakmp-map1-1] quit
8. Assign an IP address to interface Ethernet 1/2.
[RouterA] interface ethernet 1/2
[RouterA-Ethernet1/2] ip address 10.1.1.1 255.255.255.0
[RouterA-Ethernet1/2] quit
9. Assign an IP address to interface Ethernet 1/1.
[RouterA] interface ethernet 1/1
[RouterA-Ethernet1/1] ip address 1.1.1.1 255.255.0.0
10. Apply the IPsec policy group on interface Ethernet 1/1.
[RouterA-Ethernet1/1] ipsec policy map
[RouterA-Ethernet1/1] quit
11. Configure a static route to subnet 10.1.2.0/24.
[RouterA] ip route-static 10.1.2.0 255.255.255.0 2.2.2.2
Configure the security gateway Router B
1. Configure an ACL:
To Next Page
Loading...
