Labs / cisco security

Site-to-Site VPN Basics with IPsec

intermediate EVE-NG / Cisco IOS routers vpnipsecnetwork-security

Scenario

Head Office (R1) and Branch Office (R2) are connected only over a simulated internet link (R1–R2), and their LANs currently cannot reach each other at all. Your goal is to build an IPsec site-to-site VPN so both LANs can communicate securely across that untrusted link.

Minimal addressing for this AddySec version

LinkNetwork
Head Office LAN (behind R1)192.168.10.0/24
Branch Office LAN (behind R2)192.168.20.0/24
R1–R2 (simulated internet)20.20.20.0/30

Step 1 — Prove the LANs cannot currently reach each other

HO-PC# ping 192.168.20.10

This fails — there is no route and no tunnel yet. This is your baseline.

Step 2 — Configure IKE Phase 1 (on both routers)

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 14
R1(config)# crypto isakmp key AddySecLab123 address 20.20.20.2

(Mirror this on R2, pointing the key to R1’s address 20.20.20.1.)

Step 3 — Define “interesting traffic” and configure IKE Phase 2

R1(config)# access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
R1(config)# crypto ipsec transform-set TSET esp-aes esp-sha-hmac
R1(config)# crypto map VPNMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer 20.20.20.2
R1(config-crypto-map)# set transform-set TSET
R1(config-crypto-map)# match address 100

The ACL here does not filter traffic — it defines which traffic should be sent through the tunnel, exactly as described in IPsec Fundamentals.

Step 4 — Apply the crypto map to the outbound interface

R1(config)# interface g0/1
R1(config-if)# crypto map VPNMAP

(Mirror steps 3–4 on R2 with matching, mirrored ACL and peer address.)

Step 5 — Trigger the tunnel and verify both phases separately

HO-PC# ping 192.168.20.10
R1# show crypto isakmp sa
R1# show crypto ipsec sa

Traffic matching the ACL triggers negotiation. Check Phase 1 (isakmp sa should show QM_IDLE, meaning it completed) and Phase 2 (ipsec sa should show non-zero encrypt/decrypt packet counters) as two separate checks — exactly the habit built in IPsec Fundamentals.

Break it

Change the Phase 2 ACL on R2 so it does not exactly mirror R1’s (for example, use a different subnet). Retest and observe Phase 1 can still succeed while Phase 2 fails — a live demonstration of why “the tunnel is up” doesn’t always mean traffic is protected.

Reference

  • AddySec original content — written for the Network Security track, building directly on VPN Fundamentals and IPsec Fundamentals.