Cisco VPN IPsec

crypto ikev2 proposal aes-cbc-256-proposal
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy policy1
 proposal aes-cbc-256-proposal
!
crypto ikev2 keyring KR-1
 peer SmatrHub
  address 195.12.122.44
  pre-shared-key A~T"\HO=QVs3m2I$Ryh8
 !
!
!
crypto ikev2 profile profile1
 description IKEv2 profile
 match identity remote address 195.12.122.44 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-1
!
!
!
!
crypto logging ikev2
!
!
crypto ipsec transform-set ESP-AES-SHA esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto map SDM_CMAP_1 10 ipsec-isakmp
 set peer 195.12.122.44
 set security-association lifetime seconds 28800
 set transform-set ESP-AES-SHA
 set pfs group14
 set ikev2-profile profile1
 match address 103
!
!
!
!
!
interface FastEthernet0
 switchport access vlan 2
 no ip address
!
interface FastEthernet1
 switchport access vlan 2
 no ip address
!
interface FastEthernet2
 switchport access vlan 2
 no ip address
!
interface FastEthernet3
 switchport access vlan 2
 no ip address
!
interface FastEthernet4
 ip address 188.0.132.18 255.255.255.128
 ip mtu 1400
 ip nat outside
 ip virtual-reassembly in
 ip tcp adjust-mss 1360
 load-interval 30
 duplex auto
 speed auto
 crypto map SDM_CMAP_1
!
interface Vlan1
 no ip address
!
interface Vlan2
 ip address 192.168.10.10 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
!
ip nat inside source static tcp 192.168.10.11 3389 interface FastEthernet4 3389
ip nat inside source list 100 interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 188.0.132.1
ip route 188.0.132.18 255.255.255.255 195.12.113.7
ip route 195.12.113.7 255.255.255.255 188.0.132.1
!
ip sla auto discovery
ip sla 1
 icmp-echo 195.12.113.7 source-ip 188.0.132.18
 frequency 5
ip sla schedule 1 life forever start-time now
access-list 1300 permit 192.168.10.0 0.0.0.255
access-list 1300 permit 188.0.132.0 0.0.0.127
access-list 100 permit ip 192.168.0.0 0.0.255.255 any
access-list 103 permit ip host 188.0.132.18 host 195.12.113.7



access-list 105 deny   ip host 188.0.132.18 host 195.12.113.7
!
route-map ppp permit 10
 match ip address 106
 set ip next-hop 188.0.132.18
!
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 password test
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
!
end

Router#

[size="1"][color="grey"][I]Добавлено через 16 минут[/I][/color][/size]
Local peer и local lan один адрес.

[size="1"][color="grey"][I]Добавлено через 2 минуты[/I][/color][/size]
Router#sh cr ik sa
 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status
1         188.0.132.18/500      195.12.122.44/500     none/none            READY
      Encr: AES-CBC, keysize: 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/1286 sec

 IPv6 Crypto IKEv2  SA

Router#sh cr ip sa

interface: FastEthernet4
    Crypto map tag: SDM_CMAP_1, local addr 188.0.132.18

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (188.0.132.18/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (195.12.113.7/255.255.255.255/0/0)
   current_peer 195.12.122.44 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 188.0.132.18, remote crypto endpt.: 195.12.122.44
     path mtu 1400, ip mtu 1400, ip mtu idb FastEthernet4
     current outbound spi: 0x81C99A1E(2177473054)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xD829D96(226663830)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2, flow_id: Onboard VPN:2, sibling_flags 80000040, crypto map: SDM_CMAP_1
        sa timing: remaining key lifetime (k/sec): (4608000/27507)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x81C99A1E(2177473054)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 1, flow_id: Onboard VPN:1, sibling_flags 80000040, crypto map: SDM_CMAP_1
        sa timing: remaining key lifetime (k/sec): (4608000/27507)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
Router#

access-list 103 permit ip host 188.0.132.18 host 195.12.113.7

access-list 100 permit ip 192.168.0.0 0.0.255.255 any

access-list 103 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

access-list 100 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.0.0 0.0.255.255 any