=====Lab 17: eBGP with OSPF underlay and IKEv2 between r2 and r3===== ====Prerequisites==== - Complete [[:cisco:labs:ios-xe:lab16|Lab 16: eBGP with OSPF underlay]]\\ ====Task Instructions for r2 and r3:==== - Configure an ACL to define which traffic to encrypt using the physical interfaces. - Configure IKEv2 proposal. - Configure IKEv2 policy. - Configure IKEv2 keyring. - Configure IKEv2 profile. - Configure ipsec transform-set in tunnel mode. - Configure crypto ipsec-isakmp map. - Configure the crypto map on the physical interface. - Verify crypto ipsec sa (may need to ping neighbor first). - Verify crypto IKEv2 sa. - Verify crypto between r2 and r3 using Wirehsark (optional). {{:cisco:labs:ios-xe:lab_17_-_ebgp_with_ospf_underlay_and_ikev2_between_r2_and_r3.png?500|}} ====Answer Section==== ===Task 1=== r2 ip access-list extended castle-acl 10 remark Permit statements equal traffic that shall be encrypted. 10 permit ip host 23.1.1.2 host 23.1.1.3 r3 ip access-list extended castle-acl 10 remark Permit statements equal traffic that shall be encrypted. 10 permit ip host 23.1.1.3 host 23.1.1.2 ---- ===Task 2=== r2 crypto ikev2 proposal rook-proposal encryption aes-cbc-256 integrity sha512 group 14 r3 crypto ikev2 proposal rook-proposal encryption aes-cbc-256 integrity sha512 group 14 ---- ===Task 3=== r2 crypto ikev2 policy svpn-policy proposal rook-proposal r3 crypto ikev2 policy svpn-policy proposal rook-proposal ---- ===Task 4=== r2 crypto ikev2 keyring lion-key peer peer-remote address 23.1.1.3 pre-shared-key cisco r3 crypto ikev2 keyring lion-key peer peer-remote address 23.1.1.2 pre-shared-key cisco ---- ===Task 5=== r2 crypto ikev2 profile side-profile match identity remote address 23.1.1.3 255.255.255.255 authentication remote pre-share authentication local pre-share keyring local lion-key r3 crypto ikev2 profile side-profile match identity remote address 23.1.1.2 255.255.255.255 authentication remote pre-share authentication local pre-share keyring local lion-key ---- ===Task 6=== r2 crypto ipsec transform-set tset esp-aes esp-sha512-hmac mode tunnel r3 crypto ipsec transform-set tset esp-aes esp-sha512-hmac mode tunnel ---- ===Task 7=== r2 crypto map svpn-map 10 ipsec-isakmp set peer 23.1.1.3 set transform-set tset set pfs group14 set ikev2-profile side-profile match address castle-acl r3 crypto map svpn-map 10 ipsec-isakmp set peer 23.1.1.2 set transform-set tset set pfs group14 set ikev2-profile side-profile match address castle-acl/code> ---- ===Task 8=== r2 interface GigabitEthernet2 crypto map svpn-map r3 interface GigabitEthernet2 crypto map svpn-map ---- ===Task 9=== r2 r2#show crypto ipsec sa interface: GigabitEthernet2 Crypto map tag: svpn-map, local addr 23.1.1.2 protected vrf: (none) local ident (addr/mask/prot/port): (23.1.1.2/255.255.255.255/0/0) remote ident (addr/mask/prot/port): (23.1.1.3/255.255.255.255/0/0) current_peer 23.1.1.3 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 8, #pkts encrypt: 8, #pkts digest: 8 #pkts decaps: 8, #pkts decrypt: 8, #pkts verify: 8 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 23.1.1.2, remote crypto endpt.: 23.1.1.3 plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet2 current outbound spi: 0xF48D2703(4102891267) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0xCDBEBD9A(3451829658) transform: esp-aes esp-sha512-hmac , in use settings ={Tunnel, } conn id: 2006, flow_id: CSR:6, sibling_flags FFFFFFFF80000048, crypto map: svpn-map sa timing: remaining key lifetime (k/sec): (4607999/3594) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xF48D2703(4102891267) transform: esp-aes esp-sha512-hmac , in use settings ={Tunnel, } conn id: 2005, flow_id: CSR:5, sibling_flags FFFFFFFF80000048, crypto map: svpn-map sa timing: remaining key lifetime (k/sec): (4607999/3594) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: r3 r3#show crypto ipsec sa interface: GigabitEthernet2 Crypto map tag: svpn-map, local addr 23.1.1.3 protected vrf: (none) local ident (addr/mask/prot/port): (23.1.1.3/255.255.255.255/0/0) remote ident (addr/mask/prot/port): (23.1.1.2/255.255.255.255/0/0) current_peer 23.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 8, #pkts encrypt: 8, #pkts digest: 8 #pkts decaps: 8, #pkts decrypt: 8, #pkts verify: 8 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 23.1.1.3, remote crypto endpt.: 23.1.1.2 plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet2 current outbound spi: 0xCDBEBD9A(3451829658) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0xF48D2703(4102891267) transform: esp-aes esp-sha512-hmac , in use settings ={Tunnel, } conn id: 2005, flow_id: CSR:5, sibling_flags FFFFFFFF80000048, crypto map: svpn-map sa timing: remaining key lifetime (k/sec): (4607999/3508) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xCDBEBD9A(3451829658) transform: esp-aes esp-sha512-hmac , in use settings ={Tunnel, } conn id: 2006, flow_id: CSR:6, sibling_flags FFFFFFFF80000048, crypto map: svpn-map sa timing: remaining key lifetime (k/sec): (4607999/3508) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: * Notice the inbound and outbound esp sas are populated. ---- ===Task 10=== r2 r2#show crypto ikev2 sa IPv4 Crypto IKEv2 SA Tunnel-id Local Remote fvrf/ivrf Status 1 23.1.1.2/500 23.1.1.3/500 none/none READY Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:14, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/411 sec r3 r3#show crypto ikev2 sa IPv4 Crypto IKEv2 SA Tunnel-id Local Remote fvrf/ivrf Status 1 23.1.1.3/500 23.1.1.2/500 none/none READY Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:14, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/449 sec ---- ===Task 11=== {{:cisco:labs:ios-xe:lab_17_-_ss1.png?500|}} * In a later lab, all transit traffic will be encrypted through a tunnel interface. ---- =====Backlinks===== [[:cisco|Cisco]]\\ [[:cisco:labs|Cisco Labs]]\\ [[:cisco:labs:ios-xe|Cisco-IOS-XE Labs]]\\