Arista vEOS, Configuration Manual, Page: 114 / 128

This example shows a basic VTI IPsec tunnel configuration for a CSR peer router instance.
Example
CSR(config)#interface Tunnel0
CSR(config-if)#ip address 1.0.3.1 255.255.255.0
CSR(config-if)#tunnel source 10.3.31.30
CSR(config-if)#tunnel destination 10.2.201.149
CSR(config-if)#tunnel mode ipsec ipv4
CSR(config-if)#tunnel protection ipsec profile vrouter-ikev1-ipsec-profile
Note: Make sure you use the correct procedure based on the version of IKE you need to use.
Sharing IPsec Connections
On CSR, the user can configure multiple GRE tunnels to use the same IPsec connection.
The user needs to add an extra shared keyword after the profile name on every tunnel interface that is to be
shared.
veos(config)#interface Tunnel0
veos(config-if)#tunnel protection ipsec profile vrouter-ikev2-ipsec-profile
shared
veos(config-if)#exit
IKEv1 Configuration
The CSR configuration to create a GRE over IPsec tunnel is similar the vEOS Router setup using ikev1
version
.
To ensure that the v EOS Router can establish a tunnel with CSR, it needs to set the ikev1 version as follows:
veos(config)#ip security
veos(config-ipsec)#ike policy ike-peerRtr
veos(config-ipsec-ike)#version 1
1. Enter the configuration terminal mode to configure IPsec.
CSR#config terminal
2. Configure a pre-shared key for the vEOS Router and CSR to authenticate each other. Create a keyring to
hold the keys.
CSR(config)#crypto keyring vrouter-keyring
CSR(conf-keyring)#pre-shared-key address 1.0.0.2 key arista
3. Create an ISAKMP policy. The policy's function is to communicate with the peer to establish IKE Phase 1.
In the example below, a policy with AES256 is created with the following parameters: SHA1, DH group
15, authentication pre-share, and a lifetime of 28800 seconds.
CSR(config)#crypto isakmp policy 1
CSR(config-isakmp)#encr aes 256
CSR(config-isakmp)#hash sha
CSR(config-isakmp)#authentication pre-share
CSR(config-isakmp)#group 15
CSR(config-isakmp)#lifetime 28800
4. Create an ISAKMP profile associated with the vEOS Router to match its outside IP Address and the keyring
that was created earlier to identify the pre-shared secret.
CSR(config)#crypto isakmp profile vrouter-ikev1-isakmp-profile
CSR(conf-isa-prof)#keyring vrouter-keyring
vEOS Router Configuration Guide 114