Site-to-Site VPN: Configuration for an IPv4/IPv6 Over IPv4 IPsec Tunnel Using Nondefault Settings

An IPsec tunnel is configured by binding an IPsec profile to the virtual tunnel interface (VTI) at each end of the IPsec tunnel. With nondefault settings for the IPsec tunnel, the user-defined IKEv2 proposal, IKEv2 policy, IKEv2 auth-proposal, IKEv2 profile, IPsec proposal, and IPsec profile must be created at the two endpoints. The IKEv2 proposal is tied to the IKEv2 policy, the IKEv2 auth-proposal is tied to the IKEv2 profile, and the IKEv2 profile and IPsec proposal are tied to the IPsec profile.

In the following example, Router1 and Router2 are the devices at each end of the tunnel. On each device, a nondefault IPsec profile (profA) is created and bound to the VTI by using the tunnel protection ipsec profile command.

Site-to-Site Deployment of IPsec

Note: Tunnel endpoints may be multiple hops away and the base path reachable over any interior gateway protocols such as static routing, RIP, OSPF, BGP, and so on.

Note: Source and destination addresses of the outer header of the tunneled packet can be:

  • In a different VRF from the VRF for which the packet is received (including the default global VRF).

  • In the same VRF that receives the packet.

IPsec Nondefault Settings

The following nondefault settings are used to create an IPsec tunnel:

  • IKEv2 auth-proposal: auth_propA

  • IKEv2 profile: profA (All parameters are mandatory.)

    • local-identifier

    • remote-identifier

    • match-identity local: same as local-identifier

    • match-identity remote: same as remote-identifier

    • IKEv2 auth-proposal: auth_propA

    Note: By default, an IKE profile can be used for tunnels in any VRF (including def-vrf). The IKEv2 profile can be protected and restricted for usage in a specific VRF using the protected vrf-name configuration.

  • IKEv2 proposal: propA

    • Encryption: aes128

    • Integrity: sha256

    • PRF: sha256

    • DH Group: 256_ECP/Group 19

  • IKEv2 policy: polA

    • VRF

    • Local Address/Mask

    • IKEv2 Proposal: propA

  • IPsec proposal: propA

    • Protocol: ESP

    • Encryption: aes-gcm-128

  • IPsec profile: profA

    • IPsec proposal: propA

    • IKEv2 profile: profA

Configurations

Router1

Router1(config)# ikev2 auth-proposal auth_propA
Router1(config-ike-auth-proposal-auth_propA)# pre-shared-key test123
Router1(config-ike-auth-proposal-auth_propA)# exit

Router1(config)# ikev2 proposal propA
Router1(config-ike-proposal-propA)# dhgroup 19
Router1(config-ike-proposal-propA)# no dhgroup 20
Router1(config-ike-proposal-propA)# prf sha256
Router1(config-ike-proposal-propA)# no prf sha384
Router1(config-ike-proposal-propA)# encryption aes-cbc-128
Router1(config-ike-proposal-propA)# no encryption aes-cbc-256
Router1(config-ike-proposal-propA)# integrity sha256
Router1(config-ike-proposal-propA)# no integrity sha384
Router1(config-ike-proposal-propA)# exit

Router1(config)# ikev2 profile profA
Router1(config-ike-profile-profA)# authentication auth_propA
Router1(config-ike-profile-profA)# local-identifier address 1.1.1.1
Router1(config-ike-profile-profA)# remote-identifier address 2.2.2.2
Router1(config-ike-profile-profA)# match-identity local address 1.1.1.1
Router1(config-ike-profile-profA)# match-identity remote address 2.2.2.2
Router1(config-ike-profile-profA)# exit

Router1(config)# ikev2 policy polA
Router1(config-ike-policy-polA)# proposal propA
Router1(config-ike-policy-polA)# match address-local 10.1.1.1 255.255.255.255
Router1(config-ike-policy-polA)# exit

Router1(config)# ipsec proposal propA
Router1(config-ipsec-proposal-propA)# encryption-algorithm aes-gcm-128
Router1(config-ipsec-proposal-propA)# no encryption-algorithm aes-gcm-256
Router1(config-ipsec-proposal-propA)# exit

Router1(config)# ipsec profile profA 
Router1(config-ipsec-profile-profA)# proposal propA
Router1(config-ipsec-profile-profA)# ike-profile profA
Router1(config-ipsec-profile-profA)# exit

Router1(config)# interface tunnel 20 
Router1(config-tnif-20)# tunnel mode ipsec ipv4
Router1(config-tnif-20)# tunnel protection ipsec profile profA 
Router1(config-tnif-20)# tunnel source 10.1.1.1
Router1(config-tnif-20)# tunnel destination 10.1.1.2 
Router1(config-tnif-20)# ip address 10.0.0.1 255.255.255.0 
Router1(config-tnif-20)# exit

Router2

Router2(config)# ikev2 auth-proposal auth_propA
Router2(config-ike-auth-proposal-auth_propA)# pre-shared-key test123
Router2(config-ike-auth-proposal-auth_propA)# exit

Router2(config)# ikev2 proposal propA
Router2(config-ike-proposal-propA)# dhgroup 19
Router2(config-ike-proposal-propA)# no dhgroup 20
Router2(config-ike-proposal-propA)# prf sha256
Router2(config-ike-proposal-propA)# no prf sha384
Router2(config-ike-proposal-propA)# encryption aes-cbc-128
Router2(config-ike-proposal-propA)# no encryption aes-cbc-256
Router2(config-ike-proposal-propA)# integrity sha256
Router2(config-ike-proposal-propA)# no integrity sha384
Router2(config-ike-proposal-propA)# exit

Router2(config)# ikev2 profile profA
Router2(config-ike-profile-profA)# authentication auth_propA
Router2(config-ike-profile-profA)# local-identifier address 2.2.2.2
Router2(config-ike-profile-profA)# remote-identifier address 1.1.1.1
Router2(config-ike-profile-profA)# match-identity local address 2.2.2.2
Router2(config-ike-profile-profA)# match-identity remote address 1.1.1.1
Router2(config-ike-profile-profA)# exit

Router2(config)# ikev2 policy polA
Router2(config-ike-policy-polA)# proposal propA
Router2(config-ike-policy-polA)# match address-local 10.1.1.2 255.255.255.255
Router2(config-ike-policy-polA)# exit

Router2(config)# ipsec proposal propA
Router2(config-ipsec-proposal-propA)# encryption-algorithm aes-gcm-128
Router2(config-ipsec-proposal-propA)# no encryption-algorithm aes-gcm-256
Router2(config-ipsec-proposal-propA)# exit

Router2(config)# ipsec profile profA 
Router2(config-ipsec-profile-profA)# proposal propA
Router2(config-ipsec-profile-profA)# ike-profile profA
Router2(config-ipsec-profile-profA)# exit

Router2(config)# interface tunnel 20 
Router2(config-tnif-20)# tunnel mode ipsec ipv4
Router2(config-tnif-20)# tunnel protection ipsec profile profA 
Router2(config-tnif-20)# tunnel source 10.1.1.2
Router2(config-tnif-20)# tunnel destination 10.1.1.1 
Router2(config-tnif-20)# ip address 10.0.0.2 255.255.255.0 
Router2(config-tnif-20)# exit

Note: IPv6 is supported over an IPv4 IPsec tunnel by configuring an IPv6 address under the tunnel interface. 

Router2(config)# interface tunnel 20 
Router2(config-tnif-20)# tunnel mode ipsec ipv4
Router2(config-tnif-20)# tunnel protection ipsec profile profA 
Router2(config-tnif-20)# tunnel source 10.1.1.2
Router2(config-tnif-20)# tunnel destination 10.1.1.1 
Router2(config-tnif-20)# ip address 10.0.0.2 255.255.255.0 
Router2(config-tnif-20)# ipv6 address 1000::1/64
Router2(config-tnif-20)# exit
Parent topic: Deployments