Scribd
Upload
12 views18 pages

Configure IPsec Tunnel Between Routers

The document outlines the configuration steps for establishing an IPsec tunnel between two routers, including interface setup, IP address assignments, and crypto map configurations. It details the commands used to set up ISAKMP policies, define access lists, and verify the status of the IPsec and ISAKMP security associations. The configuration ensures secure communication between the specified local and remote IP addresses.

Uploaded by

hitham
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
12 views18 pages

Configure IPsec Tunnel Between Routers

The document outlines the configuration steps for establishing an IPsec tunnel between two routers, including interface setup, IP address assignments, and crypto map configurations. It details the commands used to set up ISAKMP policies, define access lists, and verify the status of the IPsec and ISAKMP security associations. The configuration ensures secure communication between the specified local and remote IP addresses.

Uploaded by

hitham
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

config LAN-LAN IPSEC TUNNEL Bw 2-Routers.

pdf
..........................................
R1:

R1(config)#int f1/0
R1(config-if)#no sh
R1(config-if)#
*Jan 13 02:01:00.307: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to
up
*Jan 13 02:01:01.307: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet1/0, changed state to up
R1(config-if)#
R1(config-if)#ip address [Link] [Link]
R1(config-if)#int g0/0
R1(config-if)#no sh
R1(config-if)#
*Jan 13 02:01:28.967: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state
to up
*Jan 13 02:01:29.967: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/0, changed state to up
R1(config-if)#ip address [Link] [Link]
R1(config-if)#end
R1#
R1#wr
Warning: Attempting to overwrite an NVRAM configuration previously written
by a different version of the system image.
Overwrite the previous NVRAM configuration?[confirm]
Building configuration...

*Jan 13 02:02:01.047: %SYS-5-CONFIG_I: Configured from console by console[OK]


R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
crypto isakmp policy 1
encryption aes
hash sha
authentication pre-share
group 2
ex

crypto isakmp key 0 HITHAM address [Link]

crypto ipsec transform-set HITHAM1 esp-aes esp-sha-hmac


ex
crypto map HITHAM2 10 ipsec-isakmp
set peer [Link]
set transform-set HITHAM1
match address 100
end
access-list 100 permit ip host [Link] host [Link]
ip route [Link] [Link] [Link]
ip route [Link] [Link] [Link]
int f1/0
crypto map HITHAM2

R1(config-if)#
*Jan 13 02:50:33.959: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1(config-if)#
----r1 modify------
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip route [Link] [Link] [Link]
R1(config)#end
R1#
R1#wr
Building configuration...

*Jan 13 04:23:21.239: %SYS-5-CONFIG_I: Configured from console by console[OK]


R1#wr
Building configuration...
[OK]
R1#
R1#
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]
protected vrf: (none)
local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#
R1#
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#no ip route [Link] [Link] [Link]
R1(config)#no ip route [Link] [Link] [Link]
R1(config)#end
R1#
R1#
*Jan 13 04:25:32.843: %SYS-5-CONFIG_I: Configured from console by console
R1#wr
Building configuration...
[OK]
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#
R1#
R1#
R1#
R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status

IPv6 Crypto ISAKMP SA

R1#sh crypto isakmp sa


IPv4 Crypto ISAKMP SA
dst src state conn-id status

IPv6 Crypto ISAKMP SA

R1#sh crypto isakmp sa


IPv4 Crypto ISAKMP SA
dst src state conn-id status

IPv6 Crypto ISAKMP SA

R1#sh crypto isakmp sa


IPv4 Crypto ISAKMP SA
dst src state conn-id status

IPv6 Crypto ISAKMP SA

R1#sh crypto isakmp sa


IPv4 Crypto ISAKMP SA
dst src state conn-id status

IPv6 Crypto ISAKMP SA

R1#sh ip int br
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 unassigned YES unset administratively down down
GigabitEthernet0/0 [Link] YES manual up up
FastEthernet1/0 [Link] YES manual up up
FastEthernet1/1 unassigned YES unset administratively down down
FastEthernet2/0 unassigned YES unset administratively down down
FastEthernet2/1 unassigned YES unset administratively down down
FastEthernet3/0 unassigned YES unset administratively down down
FastEthernet3/1 unassigned YES unset administratively down down
GigabitEthernet4/0 unassigned YES unset administratively down down
GigabitEthernet5/0 unassigned YES unset administratively down down
GigabitEthernet6/0 unassigned YES unset administratively down down
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#$t 100 permit ip [Link] [Link] [Link] [Link]
vaccess-list 100 permit ip [Link] [Link] [Link] [Link]
^
% Invalid input detected at '^' marker.

R1(config)#access-list 100 permit ip [Link] [Link] [Link] 0.0$


R1(config)#
R1(config)#
R1(config)#end
R1#
R1#wr
*Jan 13 04:48:55.495: %SYS-5-CONFIG_I: Configured from console by console
R1#wr
Building configuration...
[OK]
R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status

IPv6 Crypto ISAKMP SA

R1#
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:


outbound esp sas:

outbound ah sas:

outbound pcp sas:

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]
protected vrf: (none)
local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 17, #pkts encrypt: 17, #pkts digest: 17
#pkts decaps: 17, #pkts decrypt: 17, #pkts verify: 17
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0xF563A354(4116947796)
PFS (Y/N): N, DH group: none

inbound esp sas:


spi: 0x8FCEE1FB(2412700155)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, sibling_flags 80004040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4171937/3579)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:


spi: 0xF563A354(4116947796)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, sibling_flags 80004040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4171937/3579)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#
R1#
R1#
R1#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


protected vrf: (none)
local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 372, #pkts encrypt: 372, #pkts digest: 372
#pkts decaps: 396, #pkts decrypt: 396, #pkts verify: 396
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0xF563A354(4116947796)
PFS (Y/N): N, DH group: none

inbound esp sas:


spi: 0x8FCEE1FB(2412700155)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, sibling_flags 80004040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4171893/3218)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:


spi: 0xF563A354(4116947796)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, sibling_flags 80004040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4171896/3218)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

outbound ah sas:

outbound pcp sas:


R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#
R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
[Link] [Link] QM_IDLE 1001 ACTIVE
IPv6 Crypto ISAKMP SA

R1#

.......................
R3

R3(config)#int f1/0
R3(config-if)#no sh
R3(config-if)#
*Jan 13 02:03:36.079: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to
up
*Jan 13 02:03:37.079: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet1/0, changed state to up
R3(config-if)#
R3(config-if)#ip address [Link] [Link]
R3(config-if)#int g0/0
R3(config-if)#no sh
R3(config-if)#
*Jan 13 02:04:13.939: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state
to up
*Jan 13 02:04:14.939: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/0, changed state to up
R3(config-if)#ip address [Link] [Link]
R3(config-if)#end
R3#
R3#wr
Warning: Attempting to overwrite an NVRAM configuration previously written
by a different version of the system image.
Overwrite the previous NVRAM configuration?[confirm]
*Jan 13 02:04:44.807: %SYS-5-CONFIG_I: Configured from console by console
[confirm]
Building configuration...
[OK]
R3#
R3#
R3#CONF T
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#encryption aes
R3(config-isakmp)#hash sha
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#group 2
R3(config-isakmp)#ex
R3(config)#crypto isakmp key 0 HITHAM address [Link]
R3(config)#crypto ipsec transform-set HITHAM1 esp-aes esp-sha-hmac
R3(cfg-crypto-trans)#ex
R3(config)#crypto map HITHAM2 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
R3(config-crypto-map)#set peer [Link]
R3(config-crypto-map)#set transform-set HITHAM1
R3(config-crypto-map)#match address 100
R3(config-crypto-map)#ex
R3(config)#access-list 100 permit ip host [Link] host [Link]
R3(config)#ip route [Link] [Link] [Link]
R3(config)#ip route [Link] [Link] [Link]
R3(config)#int f1/0
R3(config-if)#crypto map HITHAM2
R3(config-if)#
*Jan 13 03:17:55.667: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R3(config-if)#END
R3#
R3#
*Jan 13 03:18:17.519: %SYS-5-CONFIG_I: Configured from console by console
R3#wr
Building configuration...
------- R2 Modify------

R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#ip route [Link] [Link] [Link]
R3(config)#end
R3#
R3#
*Jan 13 04:23:55.287: %SYS-5-CONFIG_I: Configured from console by console
R3#wr
Building configuration...
[OK]
R3#
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#no ip route [Link] [Link] [Link]
R3(config)#no ip route [Link] [Link] [Link]
R3(config)#end
R3#
R3#
R3#wr
Building configuration...

*Jan 13 04:26:05.899: %SYS-5-CONFIG_I: Configured from console by console[OK]


R3#
R3#sh ip int br
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 unassigned YES unset administratively down down
GigabitEthernet0/0 [Link] YES manual up up
FastEthernet1/0 [Link] YES manual up up
FastEthernet1/1 unassigned YES unset administratively down down
FastEthernet2/0 unassigned YES unset administratively down down
FastEthernet2/1 unassigned YES unset administratively down down
FastEthernet3/0 unassigned YES unset administratively down down
FastEthernet3/1 unassigned YES unset administratively down down
GigabitEthernet4/0 unassigned YES unset administratively down down
GigabitEthernet5/0 unassigned YES unset administratively down down
GigabitEthernet6/0 unassigned YES unset administratively down down
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#no access-list 100 permit ip host [Link] host [Link]
R3(config)#$ 100 permit ip [Link] [Link] [Link] [Link]
R3(config)#do wr
Building configuration...
[OK]
R3(config)#
R3(config)#ed
^
% Invalid input detected at '^' marker.
R3(config)#
R3(config)#end
R3#
R3#
*Jan 13 04:48:33.995: %SYS-5-CONFIG_I: Configured from console by console
R3#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R3#
R3#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R3#
R3#
R3#
R3#
R3#
R3#
R3#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={}
#pkts encaps: 47, #pkts encrypt: 47, #pkts digest: 47
#pkts decaps: 47, #pkts decrypt: 47, #pkts verify: 47
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x8FCEE1FB(2412700155)
PFS (Y/N): N, DH group: none

inbound esp sas:


spi: 0xF563A354(4116947796)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4331857/3548)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:


spi: 0x8FCEE1FB(2412700155)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4331857/3548)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

outbound ah sas:

outbound pcp sas:

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R3#
R3#
R3#
R3#
R3#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={}
#pkts encaps: 77, #pkts encrypt: 77, #pkts digest: 77
#pkts decaps: 77, #pkts decrypt: 77, #pkts verify: 77
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: [Link], remote crypto endpt.: [Link]
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x8FCEE1FB(2412700155)
PFS (Y/N): N, DH group: none

inbound esp sas:


spi: 0xF563A354(4116947796)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4331854/3518)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:


spi: 0x8FCEE1FB(2412700155)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4331854/3518)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

outbound ah sas:

outbound pcp sas:

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:


outbound ah sas:

outbound pcp sas:


R3#
R3#
R3#
R3#
R3#
R3#
R3#
R3#
R3#
R3#
R3#sh crypto ipsec sa

interface: FastEthernet1/0
Crypto map tag: HITHAM2, local addr [Link]

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={}
#pkts encaps: 380, #pkts encrypt: 380, #pkts digest: 380
#pkts decaps: 356, #pkts decrypt: 356, #pkts verify: 356
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x8FCEE1FB(2412700155)
PFS (Y/N): N, DH group: none

inbound esp sas:


spi: 0xF563A354(4116947796)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4331821/3234)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:


spi: 0x8FCEE1FB(2412700155)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: HITHAM2
sa timing: remaining key lifetime (k/sec): (4331818/3234)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:

outbound pcp sas:

protected vrf: (none)


local ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
remote ident (addr/mask/prot/port): ([Link]/[Link]/0/0)
current_peer [Link] port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: [Link], remote crypto endpt.: [Link]


path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:


R3#
R3#
R3#
R3#
R3#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
[Link] [Link] QM_IDLE 1001 ACTIVE

IPv6 Crypto ISAKMP SA

R3#

You might also like