Site-to-Site VPN: Configuration for an IPv4/IPv6 Over IPv4 IPsec Tunnel Using Default Settings

An IPsec tunnel is configured by binding an IPsec profile to the virtual tunnel interface (VTI) at each end of the IPsec tunnel. When the default settings for the IPsec profile are used, minimal configuration is needed to establish the tunnel.

In the following example, Router1 and Router2 are the devices at each end of the tunnel. On each device, a default IPsec profile (profA) is created and bound to the VTI by using the tunnel protection ipsec profile command.

Site-to-Site Deployment of IPsec

Note: Tunnel endpoints may be multiple hops away and the base path reachable over any interior gateway protocols such as static routing, RIP, OSPF, BGP, and so on.

Note: Source and destination addresses of the outer header of the tunneled packet can be:

  • In a different VRF from the VRF for which the packet is received (including the default global VRF).

  • In the same VRF that receives the packet.

IPsec Default Settings

By default, an IPsec profile has the following settings:

  • Default IKEv2 profile: def-ike-profile

    • Default IKEv2 profile accepts any remote identity parameters

    • Uses default auth-proposal

  • Default IPsec proposal: def-ipsec-prop

    • Protocol: ESP

    • Encryption Protocol: aes-gcm-256

  • Default IKEv2 policy

    • VRF: match any

    • Local Address/Mask: 0.0.0.0/0.0.0.0 (match any)

    • Default IKEv2 Proposal: def-ike-prop

      • Encryption: aes256

      • Integrity: sha384

      • PRF: sha384

      • DH Group: 384_ECP/Group 20

Configurations

Router1

Router1(config)# ipsec profile profA 
Router1(config-ipsec-profile-profA)# exit

Router1(config)# interface tunnel 20 
Router1(config-tnif-20)# tunnel mode ipsec ipv4
Router1(config-tnif-20)# tunnel protection ipsec profile profA 
Router1(config-tnif-20)# tunnel source 10.1.1.1
Router1(config-tnif-20)# tunnel destination 10.1.1.2 
Router1(config-tnif-20)# ip address 10.0.0.1 255.255.255.0 
Router1(config-tnif-20)# exit

Router2

Router2(config)# ipsec profile profA 
Router2(config-ipsec-profile-profA)# exit

Router2(config)# interface tunnel 20 
Router2(config-tnif-20)# tunnel mode ipsec ipv4
Router2(config-tnif-20)# tunnel protection ipsec profile profA 
Router2(config-tnif-20)# tunnel source 10.1.1.2
Router2(config-tnif-20)# tunnel destination 10.1.1.1 
Router2(config-tnif-20)# ip address 10.0.0.2 255.255.255.0 
Router2(config-tnif-20)# exit

Note: IPv6 is supported over an IPv4 IPsec tunnel by configuring an IPv6 address under the tunnel interface. 

Router2(config)# interface tunnel 20 
Router2(config-tnif-20)# tunnel mode ipsec ipv4
Router2(config-tnif-20)# tunnel protection ipsec profile profA 
Router2(config-tnif-20)# tunnel source 10.1.1.2
Router2(config-tnif-20)# tunnel destination 10.1.1.1 
Router2(config-tnif-20)# ip address 10.0.0.2 255.255.255.0 
Router2(config-tnif-20)# ipv6 address 1000::1/64
Router2(config-tnif-20)# exit
Parent topic: Deployments