Site-to-Site IPsec VPN on Cisco Routers: Packet Tracer Lab

A VPN lets two private networks talk securely across the public internet as if they were on the same private wire. In this lab you will conn...

A VPN lets two private networks talk securely across the public internet as if they were on the same private wire. In this lab you will connect two branch offices through an ISP router and protect all traffic between them with IPsec, configured end to end on Cisco 2911 routers in Packet Tracer. By the end you will have a working tunnel and know how to prove it is up with show commands.

A Little VPN Theory First

There are two common shapes of VPN. A remote-access VPN connects a single device — a laptop running a VPN client — back to a corporate network, which is what you use when working from home. A site-to-site VPN, the one we build here, joins two whole networks through a pair of gateway routers. The users behind each router need no client software; the routers do all the encryption on their behalf.

IPsec is the framework that provides four security services. In my own words:

• Confidentiality means the data is encrypted, so anyone capturing packets on the internet sees only scrambled bytes. IPsec uses ciphers such as AES for this.
• Integrity means the receiver can tell whether a packet was altered along the way. A hash (such as SHA) is computed over the packet, and if even one bit changed the hash will not match.
• Authentication means each router proves it is really the peer it claims to be, so you are not building a tunnel to an impostor. In this lab we authenticate with a pre-shared key — a shared secret both routers know.
• Anti-replay means an attacker cannot record a valid encrypted packet and re-send it later to cause a repeated action. Each packet carries a sequence number the receiver tracks.

IPsec sets up the tunnel in two phases. Phase 1 (ISAKMP/IKE) builds a secure management channel between the two routers and authenticates them. Phase 2 (IPsec) then negotiates how the actual user data is protected. We configure both.

Topology

Two sites, each a 2911 router with a LAN behind it, connected through a third 2911 acting as the ISP. The ISP router knows nothing about IPsec — it just routes packets between the two public addresses.

Figure: Site-to-site IPsec lab – the ISP only routes between the public /30 links; the LANs talk through the tunnel

Device	Interface	IP address	Connected to
R1 (Site A)	G0/0	192.168.1.1 /24	PC-A LAN
R1 (Site A)	G0/1	209.165.100.1 /30	ISP
ISP	G0/0	209.165.100.2 /30	R1
ISP	G0/1	209.165.200.2 /30	R2
R2 (Site B)	G0/1	209.165.200.1 /30	ISP
R2 (Site B)	G0/0	192.168.2.1 /24	PC-B LAN
PC-A	NIC	192.168.1.10 /24 (GW 192.168.1.1)	R1
PC-B	NIC	192.168.2.10 /24 (GW 192.168.2.1)	R2

The public addresses here come from ranges Cisco uses for documentation. In a real deployment they would be addresses your ISP assigns.

Step 1: Basic IP and Routing

Before any crypto, the two public addresses must be able to reach each other. Configure interfaces and a default route on each site router pointing at the ISP.

On R1:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface g0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface g0/1
R1(config-if)# ip address 209.165.100.1 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip route 0.0.0.0 0.0.0.0 209.165.100.2

On R2:

Router> enable
Router# configure terminal
Router(config)# hostname R2
R2(config)# interface g0/0
R2(config-if)# ip address 192.168.2.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface g0/1
R2(config-if)# ip address 209.165.200.1 255.255.255.252
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# ip route 0.0.0.0 0.0.0.0 209.165.200.2

On the ISP router, configure both links. The ISP has no default route; it just needs to reach the two /30 subnets, which it does directly as connected networks:

Router> enable
Router# configure terminal
Router(config)# hostname ISP
ISP(config)# interface g0/0
ISP(config-if)# ip address 209.165.100.2 255.255.255.252
ISP(config-if)# no shutdown
ISP(config-if)# exit
ISP(config)# interface g0/1
ISP(config-if)# ip address 209.165.200.2 255.255.255.252
ISP(config-if)# no shutdown

Confirm that R1 can ping R2's public address: ping 209.165.200.1 from R1 should succeed. At this point the two LANs cannot reach each other, because the ISP has no route to 192.168.x.0 — and that is correct. Private traffic will travel inside the tunnel, with public source and destination addresses on the outside.

Step 2: Enable the Security License

Crypto commands on a 2911 are locked behind the securityk9 technology package. In Packet Tracer you must enable it and reload before the crypto commands appear. Do this on both R1 and R2:

R1(config)# license boot module c2900 technology-package securityk9
R1(config)# end
R1# copy running-config startup-config
R1# reload

Accept the end-user license agreement if prompted. After the reload, verify the package is active with show version and scroll to the license table:

R1# show version
...
Technology Package License Information for Module:'c2900'

----------------------------------------------------------------
Technology    Technology-package          Technology-package
              Current       Type          Next reboot
-----------------------------------------------------------------
ipbase        ipbasek9      Permanent     ipbasek9
security      securityk9    Evaluation    securityk9
uc            disable       None          None
data          disable       None          None

The security row must show securityk9 in the Current column. If you skip this step, the router rejects crypto isakmp policy with an invalid-input error, and many learners waste an hour here.

Step 3: Phase 1 — ISAKMP Policy and Pre-Shared Key

Phase 1 builds the authenticated management tunnel. The policy on both peers must match. On R1:

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 5
R1(config-isakmp)# lifetime 86400
R1(config-isakmp)# exit

Line by line: policy 10 is just a priority number (lower is tried first); encryption aes 256 protects the Phase 1 exchange; hash sha sets the integrity algorithm; authentication pre-share says we will use a shared secret; group 5 selects the Diffie-Hellman group used to agree on keys; and lifetime is how long the Phase 1 security association lasts in seconds before it is renegotiated (86400 is the default). DH group 5 and SHA-1 keep this lab compatible with Packet Tracer; on real routers today you would use IKEv2 with SHA-256 and DH group 14 or higher.

Now set the pre-shared key and tell the router which peer it belongs to. On R1, the peer is R2's public address:

R1(config)# crypto isakmp key MyS3cretKey address 209.165.200.1

Repeat the identical policy on R2, and set the matching key pointing back at R1:

R2(config)# crypto isakmp policy 10
R2(config-isakmp)# encryption aes 256
R2(config-isakmp)# hash sha
R2(config-isakmp)# authentication pre-share
R2(config-isakmp)# group 5
R2(config-isakmp)# lifetime 86400
R2(config-isakmp)# exit
R2(config)# crypto isakmp key MyS3cretKey address 209.165.100.1

The key string must be exactly the same on both routers, and each router points at the other router's public IP.

Step 4: Phase 2 — Transform Set and Crypto ACL

The transform set defines how user data is protected. We use ESP with AES for encryption and SHA-HMAC for integrity. On R1:

R1(config)# crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac

Next, an access list defines which traffic should be encrypted — this is called the crypto ACL or "interesting traffic." We want traffic from Site A's LAN to Site B's LAN protected. On R1:

R1(config)# ip access-list extended VPN-TRAFFIC
R1(config-ext-nacl)# permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
R1(config-ext-nacl)# exit

A permit in a crypto ACL does not mean "allow" in the firewall sense — it means "encrypt this." The source and destination here are the two LANs, and the wildcard masks (0.0.0.255) cover the whole /24.

On R2 the ACL is mirrored: its own LAN is the source, R1's LAN the destination.

R2(config)# crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
R2(config)# ip access-list extended VPN-TRAFFIC
R2(config-ext-nacl)# permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
R2(config-ext-nacl)# exit

Step 5: Crypto Map and Applying It to the Interface

The crypto map ties everything together: the peer, the interesting-traffic ACL, and the transform set. On R1:

R1(config)# crypto map CMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer 209.165.200.1
R1(config-crypto-map)# set transform-set TSET
R1(config-crypto-map)# match address VPN-TRAFFIC
R1(config-crypto-map)# exit

You may see a warning that the map will remain disabled until a peer and a valid ACL are set — that clears once all three lines are present. Now apply the map to the outside interface, the one facing the ISP:

R1(config)# interface g0/1
R1(config-if)# crypto map CMAP
R1(config-if)# exit

The router confirms with ISAKMP is ON. Apply the mirror configuration on R2:

R2(config)# crypto map CMAP 10 ipsec-isakmp
R2(config-crypto-map)# set peer 209.165.100.1
R2(config-crypto-map)# set transform-set TSET
R2(config-crypto-map)# match address VPN-TRAFFIC
R2(config-crypto-map)# exit
R2(config)# interface g0/1
R2(config-if)# crypto map CMAP
R2(config-if)# exit

Step 6: Bring the Tunnel Up and Verify

IPsec tunnels are built on demand. Nothing happens until interesting traffic appears, so generate some: from PC-A, ping PC-B.

C:\> ping 192.168.2.10

The first ping or two may time out while the tunnel negotiates, then replies come through. Now check Phase 1 on R1:

R1# show crypto isakmp sa

IPv4 Crypto ISAKMP SA
dst             src             state          conn-id  status
209.165.200.1   209.165.100.1   QM_IDLE           1001  ACTIVE

A state of QM_IDLE with status ACTIVE means Phase 1 is up and the peers authenticated. Now check Phase 2:

R1# show crypto ipsec sa

interface: GigabitEthernet0/1
    Crypto map tag: CMAP, local addr 209.165.100.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
   current_peer 209.165.200.1 port 500

    #pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
    #pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4

Your exact counts will differ, because the first ping is usually lost while the tunnel comes up. The counters are what prove the tunnel is really working. #pkts encrypt rising on the sending side and #pkts decrypt rising on the receiving side means your pings are actually being protected by IPsec, not just routed. Ping again and watch the numbers climb.

Common Mistakes

• Forgetting the securityk9 license. Without it, crypto commands are rejected. Enable it and reload first.
• Mismatched Phase 1 parameters. Encryption, hash, DH group, and authentication must be identical on both peers, or Phase 1 never reaches QM_IDLE.
• Different pre-shared keys. A single character difference stops authentication. show crypto isakmp sa stays stuck in a Main Mode state such as MM_KEY_EXCH instead of reaching QM_IDLE.
• Crypto ACLs that are not mirror images. R1's source/destination must be the exact reverse of R2's, or Phase 2 fails to establish and you see no encrypt/decrypt counts.
• Crypto map on the wrong interface. It must go on the public-facing interface (G0/1 here), not the LAN interface.
• Testing from the router instead of the PC. A ping sourced from the router's own interface may not match the crypto ACL. Ping from PC to PC so the source is the LAN subnet.

Summary

A site-to-site IPsec VPN is five building blocks stacked in order: an ISAKMP policy and a pre-shared key for Phase 1, a transform set and a crypto ACL for Phase 2, and a crypto map that joins them and is applied to the outside interface. Enable securityk9 first, keep both peers symmetrical, and verify with show crypto isakmp sa (look for QM_IDLE) and show crypto ipsec sa (watch the encrypt and decrypt counters). Once those counters move, your two sites are talking privately across the public internet.

Build this topology yourself in Packet Tracer using the addressing table above, then work through the steps in order.

Related tutorials

• Static Routes vs Default Routes
• Standard vs Extended ACLs
• NAT and PAT on Cisco Routers
• Basic Cisco Router Setup

Sources

• RFC 4301, "Security Architecture for the Internet Protocol"
• RFC 2409, "The Internet Key Exchange (IKE)"
• Cisco IOS Security Configuration Guide – Configuring IPsec VPNs