How to Configure IOS Site to Site VPN with RSA Signature IOS CA

by Baldev Singh | Jul 24, 2016 | VPN Free Study Material | 2 comments

interface fastEthernet 0/0
no shutdown
ip add 192.168.101.1 255.255.255.0
no shutdown
int s0/0
no shutdown
ip add 101.1.1.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 101.1.1.1

ISP

interface s0/0
no shutdown
ip add 101.1.1.1 255.255.255.0
no shutdown
int s0/1
no shutdown
ip add 102.1.1.1 255.255.255.0
no shutdown

interface fastEthernet 0/0
no shutdown
ip add 192.168.102.1 255.255.255.0
no shutdown
int s0/0
no shutdown
ip add 102.1.1.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 102.1.1.1

R1# ping 192.168.101.1

#Type escape sequence to abort.
#Sending 5, 100-byte ICMP Echos to 192.168.101.1, timeout is 2 seconds:
#!!!!!
#Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms

R1# ping 102.1.1.100

#Type escape sequence to abort.
#Sending 5, 100-byte ICMP Echos to 102.1.1.100, timeout is 2 seconds:
#!!!!!
#Success rate is 100 percent (5/5), round-trip min/avg/max = 1/22/72 ms

R2# ping 192.168.102.1

#Type escape sequence to abort.
#Sending 5, 100-byte ICMP Echos to 192.168.102.1, timeout is 2 seconds:
#!!!!!
#Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

R2#ping 101.1.1.100

#Type escape sequence to abort.
#Sending 5, 100-byte ICMP Echos to 101.1.1.100, timeout is 2 seconds:
#!!!!!
#Success rate is 100 percent (5/5), round-trip min/avg/max = 1/21/60 ms

ISP

ISP# clock set 14:35:00 18 jan 2016
ISP(config)# ntp master
ISP(config)# crypto key generate rsa general-keys exportable label shiva
#The name for the keys will be: shiva
#Choose the size of the key modulus in the range of 360 to 2048 for your
#General Purpose Keys. Choosing a key modulus greater than 512 may take
#a few minutes.

#How many bits in the modulus [512]: 1024
#% Generating 1024 bit RSA keys, keys will be exportable...[OK]

ISP(config)# Jan 18 14:35:34.839: %SSH-5-ENABLED: SSH 1.99 has been enabled

#ISP(config)#crypto key export rsa shiva pem url nvram: 3des cisco1234
#% Key name: shiva
#Usage: General Purpose Key
#Exporting public key...
#Destination filename [shiva.pub]?
#Writing file to nvram:shiva.pub
#Exporting private key...
#Destination filename [shiva.prv]?
#Writing file to nvram:shiva.prv

ISP(config)# ip http server
ISP(config)# crypto pki server trainonic
ISP(cs-server)# database level minimum
ISP(cs-server)# database url nvram:
#% Server database url was changed. You need to move the
#% existing database to the new location.
ISP(cs-server)# issuer-name cn=trainonic.tranonic.com l=pune c=in
ISP(cs-server)# lifetime certificate 365
ISP(cs-server)# grant auto
ISP(cs-server)# no shutdown
#Jan 18 14:37:43.371: %PKI-6-CS_GRANT_AUTO: All enrollment requests will be automatically granted.
ISP(cs-server)#no shutdown
#%Some server settings cannot be changed after CA certificate generation.
#% Please enter a passphrase to protect the private key
#% or type Return to exit
#Password: 999999999
#Re-enter password: 999999999
#% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
#% Exporting Certificate Server signing certificate and keys...
#% Certificate Server enabled.
#ISP(cs-server)# Jan 18 14:37:55.311: %PKI-6-CS_ENABLED: Certificate server now enabled.
#ISP#sh crypto pki server
#Certificate Server trainonic:
#Status: enabled
#State: enabled
#Server's configuration is locked (enter "shut" to unlock it)
#Issuer name: cn=trainonic.tranonic.com l=pune c=in
#CA cert fingerprint: AF6739AB E9C0F8F7 025FC2F3 27E482F5
#Granting mode is: auto
#Last certificate issued serial number: 0x1
#CA certificate expiration timer: 14:37:54 UTC Jan 17 2019
#CRL NextUpdate timer: 20:37:55 UTC Jan 18 2016
#Current primary storage dir: nvram:
#Database Level: Minimum - no cert data written to storage

R1(config)# ntp server 101.1.1.1

R2(config)#ntp server 101.1.1.1

R1(config)# crypto ca trustpoint ttt
R1(ca-trustpoint)# enrollment url http://101.1.1.1
R1(ca-trustpoint)# exit
R1(config)# crypto ca authenticate ttt
#Certificate has the following attributes:
#Fingerprint MD5: AF6739AB E9C0F8F7 025FC2F3 27E482F5
#Fingerprint SHA1: 3284C01C 16F29DE9 46168C1F D9B77DCA 100AC899

#% Do you accept this certificate? [yes/no]: yes
#Trustpoint CA certificate accepted.
#R1(config)#crypto ca enroll ttt
#%
#% Start certificate enrollment ..
#% Create a challenge password. You will need to verbally provide this
#password to the CA Administrator in order to revoke your certificate.
#For security reasons your password will not be saved in the configuration.
#Please make a note of it.

#Password: Jan 18 14:40:41.754: RSA key size needs to be atleast 768 bits for ssh version 2
#Jan 18 14:40:41.762: %SSH-5-ENABLED: SSH 1.5 has been enabled
#Re-enter password: Jan 18 14:40:41.766: %CRYPTO-6-AUTOGEN: Generated new 512 bit key pair

#% The subject name in the certificate will include: R1.lab.local
#% Include the router serial number in the subject name? [yes/no]: no
#% Include an IP address in the subject name? [no]: no
#Request certificate from CA? [yes/no]: yes
#% Certificate request sent to Certificate Authority
#% The 'show crypto ca certificate ttt verbose' commandwill show the fingerprint.


#R1(config)#
#Jan 18 14:40:47.434: CRYPTO_PKI: Certificate Request Fingerprint MD5: F5481D75 64EE2063 D74E65CB 9BBB71D0
#Jan 18 14:40:47.434: CRYPTO_PKI: Certificate Request Fingerprint SHA1: 5CFCE3C9 A7465BC2 8F564692 8409365D 8F1F30B6
#R1(config)#
#Jan 18 14:40:48.994: %PKI-6-CERTRET: Certificate received from Certificate Authority

R2(config)# crypto ca trustpoint ttt
R2(ca-trustpoint)# enrollment url http://101.1.1.1
R2(ca-trustpoint)# exit
R2(config)# crypto ca authenticate ttt
#Certificate has the following attributes:
#Fingerprint MD5: AF6739AB E9C0F8F7 025FC2F3 27E482F5
#Fingerprint SHA1: 3284C01C 16F29DE9 46168C1F D9B77DCA 100AC899

#% Do you accept this certificate? [yes/no]: yes
#Trustpoint CA certificate accepted.
#R2(config)#crypto ca enroll ttt
#%
#% Start certificate enrollment ..
#% Create a challenge password. You will need to verbally provide this
#password to the CA Administrator in order to revoke your certificate.
#For security reasons your password will not be saved in the configuration.
#Please make a note of it.
#Password: Jan 18 14:50:58.472: RSA key size needs to be atleast 768 bits for ssh version 2
#Jan 18 14:50:58.484: %SSH-5-ENABLED: SSH 1.5 has been enabled
#Re-enter password: % The subject name in the certificate will include: R2.lab.local
#% Include the router serial number in the subject name? [yes/no]:
#Jan 18 14:50:58.484: %CRYPTO-6-AUTOGEN: Generated new 512 bit key pair
#% Include an IP address in the subject name? [no]: n
#Request certificate from CA? [yes/no]: yes
#% Certificate request sent to Certificate Authority
#% The 'show crypto ca certificate ttt verbose' commandwill show the fingerprint.

#R2(config)# Jan 18 14:51:02.371: CRYPTO_PKI: Certificate Request Fingerprint MD5: 9FF644E8 5D68CC49 B63885CA FD1050F7
#Jan 18 14:51:02.371: CRYPTO_PKI: Certificate Request Fingerprint SHA1: A9F73C2F 674E6BF0 950AD55B 563AD24F 62513774
#R2(config)# Jan 18 14:51:04.975: %PKI-6-CERTRET: Certificate received from Certificate Authority

R1#sh crypto ca certificates
#Certificate
#Status: Available
#Certificate Serial Number: 0x2
#Certificate Usage: General Purpose
#Issuer:
#cn=trainonic.tranonic.com l\=pune c\=in
#Subject:
#Name: R1.lab.local
#hostname=R1.lab.local
#Validity Date:
#start date: 14:40:48 UTC Jan 18 2016
#end date: 14:40:48 UTC Jan 17 2017
#Associated Trustpoints: ttt

#CA Certificate
#Status: Available
#Certificate Serial Number: 0x1
#Certificate Usage: Signature
#Issuer:
#cn=trainonic.tranonic.com l\=pune c\=in
#Subject:
#cn=trainonic.tranonic.com l\=pune c\=in
#Validity Date:
#start date: 14:37:54 UTC Jan 18 2016
#end date: 14:37:54 UTC Jan 17 2019
#Associated Trustpoints: ttt

R2#sh crypto ca certificates
#Certificate
#Status: Available
#Certificate Serial Number: 0x3
#Certificate Usage: General Purpose
#Issuer:
#cn=trainonic.tranonic.com l\=pune c\=in
#Subject:
#Name: R2.lab.local
#hostname=R2.lab.local
#Validity Date:
#start date: 14:51:04 UTC Jan 18 2016
#end date: 14:51:04 UTC Jan 17 2017
#Associated Trustpoints: ttt

#CA Certificate
#Status: Available
#Certificate Serial Number: 0x1
#Certificate Usage: Signature
#Issuer:
#cn=trainonic.tranonic.com l\=pune c\=in
#Subject:
#cn=trainonic.tranonic.com l\=pune c\=
#Validity Date:
#start date: 14:37:54 UTC Jan 18 2016
#end date: 14:37:54 UTC Jan 17 2019
#Associated Trustpoints: ttt

crypto isakmp policy 1
authentication rsa-sig
encryption aes
hash sha
group 5
lifetime 1800
exit
crypto ipsec transform-set t-set esp-aes esp-sha-hmac
mode tunnel
exit
crypto ipsec profile shiva
set transform-set t-set
int t0
ip add 192.168.1.1 255.255.255.0
tunnel source serial 0/0
tunnel destination 102.1.1.100
tunnel mode ipsec ipv4
tunnel protection ipsec profile shiva

crypto isakmp policy 1
authentication rsa-sig
encryption aes
hash sha
group 5
lifetime 1800
exit
crypto ipsec transform-set t-set esp-aes esp-sha-hmac
mode tunnel
exit
crypto ipsec profile shiva
set transform-set t-set
int t0
ip add 192.168.1.2 255.255.255.0
tunnel source s0/0
tunnel destination 101.1.1.100
tunnel mode ipsec ipv4
tunnel protection ipsec profile shiva

R1(config)#router eigrp 100
R1(config-router)#no auto
R1(config-router)#network 192.168.0.0 0.0.255.255

R2(config-if)#router eigrp 100
R2(config-router)# no auto
R2(config-router)# network 192.168.0.0 0.0.255.255

R2#sh ip eigrp neighbors
#IP-EIGRP neighbors for process 100
#H Address Interface Hold Uptime SRTT RTO Q Seq
#(sec) (ms) Cnt Num
#0 192.168.1.1 Tu0 10 00:00:37 89 5000 0 3
R2#sh ip route eigrp
#D 192.168.101.0/24 [90/297270016] via 192.168.1.1, 00:00:38, Tunnel0

R1#sh ip eigrp neighbors
#IP-EIGRP neighbors for process 100
#H Address Interface Hold Uptime SRTT RTO Q Seq
#(sec) (ms) Cnt Num
#0 192.168.1.2 Tu0 12 00:00:54 73 5000 0 3
R1#sh ip ro
R1#sh ip route e
R1#sh ip route eigrp
#D 192.168.102.0/24 [90/297270016] via 192.168.1.2, 00:00:56, Tunnel0

R1#ping 192.168.102.1 source fastEthernet 0/0 repeat 100

#Type escape sequence to abort.
#Sending 100, 100-byte ICMP Echos to 192.168.102.1, timeout is 2 seconds:
#Packet sent with a source address of 192.168.101.1
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#Success rate is 100 percent (100/100), round-trip min/avg/max = 28/52/92 ms

R1#sh crypto ipsec sa

interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 101.1.1.100

#protected vrf: (none)
#local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
#remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
#current_peer 102.1.1.100 port 500
#PERMIT, flags={origin_is_acl,}
#pkts encaps: 127, #pkts encrypt: 127, #pkts digest: 127
#pkts decaps: 123, #pkts decrypt: 123, #pkts verify: 123
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 101.1.1.100, remote crypto endpt.: 102.1.1.100
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0xCAF5E37A(3405112186)

inbound esp sas:
spi: 0x44AE3E07(1152269831)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: SW:1, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4570691/3464)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0xCAF5E37A(3405112186)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: SW:2, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4570691/3462)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE

outbound ah sas:

outbound pcp sas:

R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
101.1.1.100 102.1.1.100 QM_IDLE 1001 0 ACTIVE

IPv6 Crypto ISAKMP SA

R2# ping 192.168.101.1 source fastEthernet 0/0 repeat 100

#Type escape sequence to abort.
#Sending 100, 100-byte ICMP Echos to 192.168.101.1, timeout is 2 seconds:
#Packet sent with a source address of 192.168.102.1
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#Success rate is 100 percent (100/100), round-trip min/avg/max = 24/50/76 ms

R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
101.1.1.100 102.1.1.100 QM_IDLE 1001 0 ACTIVE

IPv6 Crypto ISAKMP SA

R2#sh crypto ipsec sa

interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 102.1.1.100

protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 101.1.1.100 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 239, #pkts encrypt: 239, #pkts digest: 239
#pkts decaps: 244, #pkts decrypt: 244, #pkts verify: 244
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 102.1.1.100, remote crypto endpt.: 101.1.1.100
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x44AE3E07(1152269831)

inbound esp sas:
spi: 0xCAF5E37A(3405112186)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: SW:1, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4521958/3388)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0x44AE3E07(1152269831)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: SW:2, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4521958/3386)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE

outbound ah sas:

outbound pcp sas: