Cisco Small Business Managed Router Feature Configuration Guide
SRP500 Site to Site IPSec VPNs
Page 1: ...Cisco Small Business Managed Router Feature Configuration Guide SRP500 Site to Site IPSec VPNs ...
Page 2: ...1 SRP541W running v1 1 19 004 Site 2 SRP521W running v1 2 0 023 Site 3 SR520 running IOS 15 1 1 T Configuring the SRP500 for IPSec The following screenshots illustrate how to configure the SRP500 IKE and IPSec policies for connecting to a remote IOS device Connecting to a remote SRP500 can follow exactly the same approach allowing of course the appropriate address and subnet in that case IKE Polic...
Page 3: ...This document is Cisco Public Information Page 3 of 9 This configuration is summarised as follows once the configuration is submitted IPSec Policy Configuration An IPSec policy must be created for each site to site tunnel Each SRP500 device may define up to five IPSec policies ...
Page 4: ...ish a VPN tunnel to the IOS device at site 3 Access the VPN IPSec Policy SRP500 page and click Add Entry to define a new policy For these configurations it should be sufficient to use the Auto Policy type setting Once submitted the IPSec policy is summarised as follows Note that in this case IPSec NAT traversal NAT T is not required NAT Traversal may be configured using the VPN NAT Traversal page ...
Page 5: ... are configured the VPN tunnel will automatically establish The SRP500 Status VPN page can be used to verify that the connection has been established This page may also be used to manually Disconnect Connect the tunnel if required To monitor the VPN connection process on the IOS device you may use the debug crypto isakmp and debug crypto ipsec features The following capture illustrates the connect...
Page 6: ...AKMP 0 Acceptable atts life 0 ISAKMP 0 Fill atts in sa vpi_length 4 ISAKMP 0 Fill atts in sa life_in_seconds 86355 ISAKMP 0 Returning Actual lifetime 28800 ISAKMP 0 Started lifetime timer 28800 ISAKMP 0 processing vendor id payload ISAKMP 0 vendor ID seems Unity DPD but major 0 mismatch ISAKMP 0 processing vendor id payload ISAKMP 0 vendor ID is DPD ISAKMP 0 Input IKE_MESG_INTERNAL IKE_PROCESS_MAI...
Page 7: ... RESPONDER_LIFETIME protocol 1 spi 2227348128 message ID 1956323662 ISAKMP 2026 sending packet to 192 168 200 162 my_port 500 peer_port 500 R MM_KEY_EXCH ISAKMP 2026 Sending an IKE IPv4 Packet ISAKMP 2026 purging node 1956323662 ISAKMP Sending phase 1 responder lifetime 28800 ISAKMP 2026 Input IKE_MESG_INTERNAL IKE_PROCESS_COMPLETE ISAKMP 2026 Old State IKE_R_MM5 New State IKE_P1_COMPLETE ISAKMP 2...
Page 8: ...192 168 9 0 dst addr 192 168 15 0 protocol 0 src port 0 dst port 0 IPSEC crypto_ipsec_sa_find_ident_head reconnecting with the same proxies and peer 192 168 200 162 IPSEC policy_db_add_ident src 192 168 9 0 dest 192 168 15 0 dest_port 0 IPSEC create_sa sa created sa sa_dest 192 168 200 146 sa_proto 50 sa_spi 0xBDE1EBFF 3185699839 sa_trans esp 3des esp sha hmac sa_conn_id 353 sa_lifetime k sec 4519...
Page 9: ... 0 type 4 remote_proxy 192 168 15 0 255 255 255 0 0 0 type 4 ISAKMP 2026 received packet from 192 168 200 162 dport 500 sport 500 Global R QM_IDLE ISAKMP set new node 1973569393 to QM_IDLE ISAKMP 2026 processing HASH payload message ID 1973569393 ISAKMP 2026 processing DELETE payload message ID 1973569393 ISAKMP 2026 peer does not do paranoid keepalives ISAKMP 2026 deleting SA reason No reason sta...
