Here is a general guide to creating and IPsec tunnel between two Cisco routers. This can also be applied to other devices as the concepts the same, but your configuration on those devices might be a little different.

Basic Configuration of Routers

• Assign IP Addresses: Ensure both routers have IP Addresses assigned to their interfaces
• Configure Routing: Setup Routing (static or dynamic) so the routers know how to reach each other.

Configure ISAKMP (IKE) Policy

ISAKMP (Internet Security Association and Key Management Protocol) policies define how the routers will establish the Phase 1 security associations (SA’s)

• Set ISAKMP Policy: Define encryption (AES/3DES), hash (SHA,MD5), authentication (pre-shared keys), group (Deffie-Hellman group), and lifetime values.

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes
R1(config-isakmp)# hash sha
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 2
R1(config-isakmp)# lifetime 3600

Configure ISAKMP Key

• Pre-shared key: define a pre-shared key that will be used by both routers.

R1(config)# crypto isakmp key [key] address [peer IP address]

Configure IPSec Transform Set

The transform set defines the encryption and authentication methods used in Phase 2

• Define transform set: Choose the ESP (Encapsulating Security Payload) encryption and authentication method.

R1(config)# crypto ipsec transform-set MYSET esp-aes esp-sha-hmac 

Configure Crypto ACL

Define “WHAT” traffic will be encrypted.

• Access Control List (ACL): Specify the traffic to be protected.

Router(config)# access-list 100 permit ip [local subnet] [local subnet mask] [remote subnet] [remote subnet mask]

Configure Crypto Map

The crypto map binds the previous elements together and applies them to the interface.

• Create crypto map: Associate the ISAKMP policy, transform set, peer and ACL.

R1(config)# crypto map MYMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer [peer IP address]
R1(config-crypto-map)# set transform-set MYSET
R1(config-crypto-map)# match address 100

Apply Crypto Map to the Interface

• Bind to the Interface: Apply the crypto map to the interface facing the remote site.

R1(config)# interface [interface type/number]
R1(config-if)# crypto map MYMAP

Verification

• Verify configuration: Use these commands like “show crypto isakmp sa”, “show crypto ipsec sa” to check the status of the tunnels

This is a very generic guide on establishing an IPsec tunnel between two Cisco Routers, your requirements might be different. Thanks for reading and leave a comment to hack the WordPress gods.