{"id":2393,"date":"2022-04-01T04:57:51","date_gmt":"2022-04-01T04:57:51","guid":{"rendered":"https:\/\/tungle.ca\/?p=2393"},"modified":"2022-04-02T01:34:14","modified_gmt":"2022-04-02T01:34:14","slug":"deploy-vpn-ipsec-site-to-site-between-cisco-csr-router-and-aws","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=2393","title":{"rendered":"Deploy VPN IPSEC site-to-site IKEv2 tunnel between Cisco CSR Router and AWS"},"content":{"rendered":"\n

This is a diagram that is used to deploy this lab.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Create a new VPC with CIDR is 10.0.0.0\/16. Then, create a new private subnet on AWS is 10.0.0.0\/24.<\/p>\n\n\n\n

Next, create a Customer gateway on AWS.<\/p>\n\n\n\n

\"\"
Create a virtual private gateway and attach this to your VPC.<\/figcaption><\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Create a site-to-site between AWS and Router CSR.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Click download configuration to configure on Cisco CSR.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Add another route to Cisco CSR LAN subnets on AWS Private route table.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Configure CoreSW.<\/p>\n\n\n\n

conf t\nhostname CoreSW\nip routing\nip dhcp excluded-address 172.16.10.1 172.16.10.10\n!\nip dhcp pool VLAN10\n network 172.16.10.0 255.255.255.0\n default-router 172.16.10.1\n dns-server 172.16.20.12\n\ninterface GigabitEthernet0\/0\n no switchport\n ip address 172.16.1.1 255.255.255.0\n!\ninterface GigabitEthernet0\/1\n switchport trunk allowed vlan 10,20,99\n switchport trunk encapsulation dot1q\n switchport trunk native vlan 99\n switchport mode trunk\n negotiation auto\n!\ninterface GigabitEthernet0\/2\n switchport trunk allowed vlan 10,20,99\n switchport trunk encapsulation dot1q\n switchport trunk native vlan 99\n switchport mode trunk\n\ninterface Vlan10\n ip address 172.16.10.1 255.255.255.0\n!\ninterface Vlan20\n ip address 172.16.20.1 255.255.255.0\n!\nrouter ospf 1\n router-id 1.1.1.1\n network 172.16.0.0 0.0.255.255 area 0\n!\nip route 0.0.0.0 0.0.0.0 172.16.1.254\n--\nConfigure VLAN\nCoreSW(config)#vlan 10\r\nCoreSW(config-vlan)#name PCs\r\nCoreSW(config-vlan)#vlan 20\r\nCoreSW(config-vlan)#name Servers\r\nCoreSW(config-vlan)#vlan 99\r\nCoreSW(config-vlan)#name Native\r\nCoreSW(config-vlan)#do sh vlan bri\r\n\r\nVLAN Name                             Status    Ports\r\n---- -------------------------------- --------- -------------------------------\r\n1    default                          active    Gi0\/3, Gi1\/0, Gi1\/1, Gi1\/2\r\n                                                Gi1\/3, Gi2\/0, Gi2\/1, Gi2\/2\r\n                                                Gi2\/3, Gi3\/0, Gi3\/1, Gi3\/2\r\n                                                Gi3\/3\r\n10   PCs                              active\r\n20   Servers                          active\r\n99   Native                           active\r<\/code><\/pre>\n\n\n\n
Configure Cisco CSR.<\/p>\n\n\n\n
interface GigabitEthernet1\n ip address dhcp\n ip nat outside\n negotiation auto\n no mop enabled\n no mop sysid\n!\ninterface GigabitEthernet2\n ip address 172.16.1.254 255.255.255.0\n ip nat inside\n negotiation auto\n no mop enabled\n no mop sysid\nrouter ospf 1\n router-id 3.3.3.3\n network 172.16.0.0 0.0.255.255 area 0\n!\nip nat inside source list 1 interface GigabitEthernet1 overload\nip route 0.0.0.0 0.0.0.0 142.232.198.254<\/code><\/pre>\n\n\n\n
Next, opens the file that you have downloaded on AWS, then copy and paste its configuration to Cisco CSR to create both IPSEC VPN site-to-site IKEv2 tunnels on the Router.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Cisco CSR configuration\n-------\ncrypto ikev2 proposal PROPOSAL1\n encryption aes-cbc-128\n integrity sha1\n group 2\n!\ncrypto ikev2 policy POLICY1\n match address local 142.232.198.195\n proposal PROPOSAL1\n!\ncrypto ikev2 keyring KEYRING1\n peer 3.209.99.165\n  address 3.209.99.165\n  pre-shared-key IuhDpOyPazd.NIHiEh.3Q_uY99mDw98X\n !\n peer 54.83.195.0\n  address 54.83.195.0 255.255.255.0\n  pre-shared-key tlDEo5uQkac9zzMt3s.kgU6ARGma5Cq8\n !\n\n!crypto ikev2 profile IKEV2-PROFILE\n match address local 142.232.198.195\n match identity remote address 3.209.99.165 255.255.255.255\n match identity remote address 54.83.195.0 255.255.255.0\n authentication remote pre-share\n authentication local pre-share\n keyring local KEYRING1\n lifetime 28800\n dpd 10 10 on-demand\ncrypto isakmp keepalive 10 10\n!\ncrypto ipsec security-association replay window-size 128\n!\ncrypto ipsec transform-set ipsec-prop-vpn-0857221ac6c8785fe-0 esp-aes esp-sha-hmac\n mode tunnel\ncrypto ipsec transform-set ipsec-prop-vpn-0857221ac6c8785fe-1 esp-aes esp-sha-hmac\n mode tunnel\ncrypto ipsec df-bit clear\n!\ncrypto ipsec profile ipsec-vpn-0857221ac6c8785fe-0\n set transform-set ipsec-prop-vpn-0857221ac6c8785fe-0\n set pfs group2\n set ikev2-profile IKEV2-PROFILE\n!\ncrypto ipsec profile ipsec-vpn-0857221ac6c8785fe-1\n set transform-set ipsec-prop-vpn-0857221ac6c8785fe-1\n set pfs group2\n set ikev2-profile IKEV2-PROFILE\ninterface Tunnel1\n ip address 169.254.143.114 255.255.255.252\n ip tcp adjust-mss 1379\n tunnel source 142.232.198.195\n tunnel mode ipsec ipv4\n tunnel destination 3.209.99.165\n tunnel protection ipsec profile ipsec-vpn-0857221ac6c8785fe-0\n ip virtual-reassembly\n!\ninterface Tunnel2\n ip address 169.254.192.6 255.255.255.252\n ip tcp adjust-mss 1379\n tunnel source 142.232.198.195\n tunnel mode ipsec ipv4\n tunnel destination 54.83.195.0\n tunnel protection ipsec profile ipsec-vpn-0857221ac6c8785fe-1\n ip virtual-reassembly\n!\ninterface GigabitEthernet1\n ip address dhcp\n ip nat outside\n negotiation auto\n no mop enabled\n no mop sysid\n!\ninterface GigabitEthernet2\n ip address 172.16.1.254 255.255.255.0\n ip nat inside\n negotiation auto\n no mop enabled\n no mop sysid\nrouter ospf 1\n router-id 3.3.3.3\n network 172.16.0.0 0.0.255.255 area 0\n!\nip nat inside source list 1 interface GigabitEthernet1 overload\nip route 0.0.0.0 0.0.0.0 142.232.198.254\nip route 10.0.0.0 255.255.255.0 Tunnel1\nip route 10.0.0.0 255.255.255.0 Tunnel2\n!\nip access-list standard 1\n 10 permit any<\/code><\/pre>\n\n\n\n
show CSR interfaces.<\/code><\/pre>\n\n\n\n
CSR# sh ip int brief\nInterface              IP-Address      OK? Method Status                Protocol\nGigabitEthernet1       142.232.198.195 YES DHCP   up                    up\nGigabitEthernet2       172.16.1.254    YES manual up                    up\nGigabitEthernet3       unassigned      YES unset  administratively down down\nGigabitEthernet4       unassigned      YES unset  administratively down down\nTunnel1                169.254.143.114 YES manual up                    up\nTunnel2                169.254.192.6   YES manual up                    up<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
show ip ospf neighbor<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
show ip route<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
show crypt ikev2 sa<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
show crypto ipsec sa<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
show crypto ipsec sa<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Pings Linux instance on AWS from a machine on CSR LAN subnet.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Pings a Windows machine on CSR LAN subnet from the Linux instance on AWS.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Both tunnels are up on AWS and CSR Router.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"This<\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
This is a diagram that is used to deploy this lab. Create a new VPC with CIDR is 10.0.0.0\/16. Then, create a new private subnet on AWS is 10.0.0.0\/24. Next, create a Customer gateway on AWS. Create a site-to-site between AWS and Router CSR. Click download configuration to configure on Cisco CSR. Add another route […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,19,11],"tags":[15,20],"class_list":["post-2393","post","type-post","status-publish","format-standard","hentry","category-cisco","category-cloud","category-security","tag-cisco","tag-cloud"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2393"}],"version-history":[{"count":4,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2393\/revisions"}],"predecessor-version":[{"id":2479,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2393\/revisions\/2479"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}