ok thanks,

Can i use those same policies for different tunnels? Becuase when i tried to use one it basically combines the information on the crypto, making it not functionional. So if i wanted to use policy 52 again, how would i do it?

crypto isakmp enable outside
crypto isakmp identity address
crypto isakmp policy 52 hash md5
crypto isakmp policy 52 authentication pre-share
crypto isakmp policy 52 encryption aes-256
crypto isakmp policy 52 group 2
crypto isakmp policy 52 lifetime 86400
!
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
!
!
crypto map OUTSIDE_VPN_MAP 52 match address outside_cryptomap_52
crypto map OUTSIDE_VPN_MAP 52 set peer 123.123.123.123

crypto map OUTSIDE_VPN_MAP 52 set transform-set ESP-AES-256-MD5
crypto map OUTSIDE_VPN_MAP  interface outside
!

Ok, so first we need to have clear that ISAKMP policy is never bounded to a tunnel as the transform set is, with this I mean that the isakmp policy will be used for that specific tunnel if all the settings match.

Another thing to have in mind is that the fact that your tunnel has an ipsec transform set with settings A and B does not mean that you need to have an ISAKMP policy with settings A and B, this can actually be C and D.

So if your tunnel has an isakmp policy that matches an existing one then it should work if it does not fully match in:

encryption

hashing

authentication

and DG group

you need to create one that matches.

awesome. its starting to make sense....

So one more question, the number after my Crypto map name I.E. OUTSIDE_VPN_MAP 52, can that number 52 be anything? lets say i make it 100 what would happen?

crypto isakmp enable outside
crypto isakmp identity address
crypto isakmp policy 52 hash md5
crypto isakmp policy 52 authentication pre-share
crypto isakmp policy 52 encryption aes-256
crypto isakmp policy 52 group 2
crypto isakmp policy 52 lifetime 86400
!
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
!
!
crypto map OUTSIDE_VPN_MAP 52 match address outside_cryptomap_52
crypto map OUTSIDE_VPN_MAP 52 set peer 206.248.217.105
crypto map OUTSIDE_VPN_MAP 52 set transform-set ESP-AES-256-MD5
crypto map OUTSIDE_VPN_MAP  interface outside
!

That totally makes sense now.. thank you for your help!

Hello everybody,

I get a little confused by the IOS IPSEC configuration commands. I stumbled in this thread after googling.

Ivan Martinon, can you please explain what do you mean by that:

So if your tunnel has an isakmp policy that matches an existing one then it should work if it does not fully match in:
encryption
hashing
authentication
and DG group
you need to create one that matches.

Precisely: how do a tunnel define all its parameters ? The transform-set defines encryption and hash methods only, how to retrieve Authentication, Diffie-Hellman keys among many policies in the config ?

May

ok lets take this in steps....

You need two access lists... one to match the tunnel, and one nonat...

ACCESS LISTS

access-list outside_cryptomap_55 remark Link to Radiology Inc Tunnel (ITS ALWAYS GOOD TO HAVE A REMARK TO IDENTIFY TUNNEL)
access-list outside_cryptomap_55 extended permit ip 172.18.20.0 255.255.255.0 host 10.10.55.16 (THIS IS INDENTIFYING INTERESTING TRAFFIC)
(ALSO WITH THIS ACCESS LIST, ITS INDENTIFIES AN ENTIRE NETWORK WHICH IS 172.18.20.0 GOING TO ONLY ONE HOST 10.10.55.16)

ACCESS LIST WITH NONAT (THIS WILL BYPASS THE NAT)

access-list nonat extended permit ip 172.18.20.0 255.255.255.0 10.10.55.16 255.255.255.255

now for your phases of crypto

First, Your crypto isakmp policies...

crypto isakmp policy 1
  encryption aes 128
  hash sha
  authentication pre-share
  group 2
crypto isakmp policy 2
  encryption aes 128
  hash sha
  authentication
  group 1

Phase 1

for a router, you want your highest encrypted policies first.... such as the command encryption aes 256 or encryption aes 128 and for the hash you want SHA to be first...after your highest encrypted policies, then you start to trickle down your lower policies for lower encryption (encryption 3DES 128, or encryption des)...Here is why... when you start to send traffic through the tunnel to bring up the tunnel, its going to start PHASE 1 of the negotiation....which are the policies above. And if you have a ton of policies, your router will try to match up a policies that you already have configured to your remote router. keep in mind that these phase has no relation to your phase 2..its basically to get the process started...once your policies match up with your remote policies, then the REAL commands follow which is (phase 2)...also keep in mind, once phase 1 is over, then its over, there are no more negotiation dealing with phase..basically the router forgets about it and moves on to phase 2. YOU HAVE TO MATCH ENCRYPTION ON BOTH ENDS FOR THE ROUTER TO START SENDING INTERESTING TRAFFIC (PHASE 2).

Phase 2

during this process you will name your tunnel and set up peer addresses and transform sets. NOTE: THIS IS WHERE TRANSFORM SETS HAVE TO MATCH UP WITH EXISTING TRANSFORM SETS YOU HAVE CONFIGURED.

crypto map map1 10 ipsec-isakmp1

> 　 match address outside_cryptomap_55 (this matches the access list above)

> 　 set peer 11.11.11.2

> 　 set transform-set ts1 (FOR THIS COMMAND, I LIKE TO NAME MY TRANSFORM SETS WHAT THEY ARE TO MAKE IT EASIER TO IDENTIFY AND NOT TS1)

SO LETS RENAME IT.....

> 　 cryptop map (OUTSIDE_VPN_MAP 55) match address outside_cryptomap_55 (this matches the access list above, i used the # 55 to number my tunnel, this number also has no meaning to anything in above commands its just the difference between tunnel if you have more than 1)

> 　 set peer 11.11.11.2

> 　 set transform-set ESP-AES-256-MD5 (THIS HAS TO MATCH THE OTHER END OF THE TUNNEL)

Now you have to set it to an outside interface....

crypto map OUTSIDE_VPN_MAP interface outside

once everything is set up, you need a couple more commands to make it complete...

tunnel-group 11.11.11.2 type ipsec-l2l
tunnel-group 11.11.11.2 ipsec-attributes
pre-shared-key **********

NOW, once all that is done, you need to go on your core router and make a route to route the traffic inside...

for instance ip route 10.10.55.16 255.255.255.255 172.16.0.1 (this send all traffic to inside interface of your router coming from the remote host)

Make any more sense?

check out the attached document. it will make sense there. its all the commands you will need for a L2L ipsec tunnel...

check out the attached jpeg. its all commands you will need to complete your tunnel

Rate if helpful

Regards,

Dustin

So the router behaves like this:

to choose a policy for a new-created tunnel, match the first policy that have the same encryption and hash methods as the tunnel transform-set command (and of course the peer should have the same policy).

Thanks for your efforts cisco_himg.