VPN IPSec Site à Site

conf t
hostname R1

! Interface LAN — côté réseau client Site A
interface GigabitEthernet0/1
  ip address 192.168.1.254 255.255.255.0
  no shutdown
exit

! Interface WAN — lien vers R2 (la crypto map VPN sera ici)
interface GigabitEthernet0/0
  ip address 10.1.1.1 255.255.255.252
  no shutdown
exit

! Routage RIPv2
router rip
  version 2
  network 10.0.0.0
  network 192.168.1.0
  no auto-summary
exit

end
write memory

conf t
hostname R2

interface fa0/0
  ip address 10.1.1.2 255.255.255.252
  no shutdown
exit

interface fa0/1
  ip address 10.2.2.2 255.255.255.252
  no shutdown
exit

router rip
  version 2
  network 10.1.1.0
  network 10.2.2.0
  no auto-summary
exit

end
write memory

conf t
hostname R3

! Interface LAN — côté réseau serveur Site B
interface GigabitEthernet0/0
  ip address 192.168.3.254 255.255.255.0
  no shutdown
exit

! Interface WAN — lien vers R2 (la crypto map VPN sera ici)
interface GigabitEthernet0/1
  ip address 10.2.2.1 255.255.255.252
  no shutdown
exit

router rip
  version 2
  network 10.0.0.0
  network 192.168.3.0
  passive-interface GigabitEthernet0/0
  no auto-summary
exit

end
write memory

! Depuis le PC (192.168.1.1) :
ping 192.168.1.254   ! PC → R1 (passerelle)
ping 10.1.1.2        ! PC → R2 (WAN)
ping 10.2.2.1        ! PC → R3 (WAN)
ping 192.168.3.1   ! PC → Serveur Web

! Depuis R1 :
ping 10.1.1.2    ! R1 → R2
ping 10.2.2.1    ! R1 → R3

! Résultat attendu (tous les pings) :
Reply from 192.168.3.1: bytes=32 time<1ms TTL=125

conf t

! Source : port connecté vers R1
monitor session 1 source interface g0/23

! Destination : port connecté au PC Wireshark
monitor session 1 destination interface g0/1

end

conf t

crypto isakmp policy 10
  authentication pre-share
  encr aes 256
  hash md5
  group 2
  lifetime 21600
exit

! Clé pré-partagée — DOIT être identique sur R3 !
! "flute" = clé · 10.2.2.1 = IP WAN de R3 (le peer)
crypto isakmp key flute address 10.2.2.1

! 1. Transform-set
crypto ipsec transform-set TS_VPN ah-sha-hmac esp-aes 256
  mode tunnel
exit

! 2. ACL : trafic à chiffrer (Site A → Site B)
ip access-list extended VPN
  10 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
exit

! 3. Crypto map
crypto map MAP_VPN 1 ipsec-isakmp
  set peer 10.2.2.1
  set transform-set TS_VPN
  match address VPN
exit

! 4. Appliquer sur l'interface WAN (Gi0/0)
interface GigabitEthernet0/0
  crypto map MAP_VPN
exit

end
write memory

conf t

! Phase 1 ISAKMP (identique à R1)
crypto isakmp policy 10
  authentication pre-share
  encr aes 256
  hash md5
  group 2
  lifetime 21600
exit

! Clé → peer = IP WAN de R1 (inversé)
crypto isakmp key flute address 10.1.1.1

! Transform-set (identique à R1)
crypto ipsec transform-set TS_VPN ah-sha-hmac esp-aes 256
  mode tunnel
exit

! ACL : source et destination INVERSÉES
ip access-list extended VPN
  10 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
exit

! Crypto map → peer = IP WAN de R1
crypto map MAP_VPN 1 ipsec-isakmp
  set peer 10.1.1.1
  set transform-set TS_VPN
  match address VPN
exit

! Appliquer sur WAN de R3 (Gi0/1 et non Gi0/0 !)
interface GigabitEthernet0/1
  crypto map MAP_VPN
exit

end
write memory

! Ping vers le Serveur Web — déclenche Phase 1 puis Phase 2
ping 192.168.3.1

Reply from 192.168.3.1: bytes=32 time=2ms TTL=125

show crypto isakmp sa detail

! État QM_IDLE = Phase 1 établie :
dst         src         state     conn-id  status
10.2.2.1    10.1.1.1    QM_IDLE   1001     ACTIVE

show crypto ipsec sa

interface: GigabitEthernet0/0
  Crypto map tag: MAP_VPN, local addr: 10.1.1.1
  local  ident: (192.168.1.0/255.255.255.0/0/0)
  remote ident: (192.168.3.0/255.255.255.0/0/0)
  current_peer: 10.2.2.1

  #pkts encaps: 10, #pkts encrypt: 10, #pkts digest: 10
  #pkts decaps: 10, #pkts decrypt: 10, #pkts verify: 10

-- Observer les échanges IKE
isakmp

-- Observer le trafic ESP chiffré
esp

-- Tout le trafic IPSec
isakmp || esp || ah

-- Filtrer sur les deux routeurs VPN
ip.addr == 10.1.1.1 && ip.addr == 10.2.2.1