darnellkeith/cisco-ipsec-s2s
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pushing device configs

Browse Source
This commit is contained in:
Darnell Keith 2025-07-04 14:58:09 -04:00
parent 30fb10ca14
commit 053754ec4e
15 changed files with 729 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
capture-esp.png → Images/capture-esp.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 56 KiB

After

Width:  |  Height:  |  Size: 56 KiB

0
capture-site-a-to-b-reachability.png → Images/capture-site-a-to-b-reachability.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 95 KiB

After

Width:  |  Height:  |  Size: 95 KiB

0
site-a-cryptomap.png → Images/site-a-cryptomap.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 59 KiB

After

Width:  |  Height:  |  Size: 59 KiB

0
site-a-host-icmp.png → Images/site-a-host-icmp.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 64 KiB

After

Width:  |  Height:  |  Size: 64 KiB

0
site-a-isakmp-1.png → Images/site-a-isakmp-1.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 49 KiB

After

Width:  |  Height:  |  Size: 49 KiB

0
site-a-to-b-reachability.png → Images/site-a-to-b-reachability.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 23 KiB

After

Width:  |  Height:  |  Size: 23 KiB

0
site-a-transformset.png → Images/site-a-transformset.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 66 KiB

After

Width:  |  Height:  |  Size: 66 KiB

0
site-a-tunnel-acl.png → Images/site-a-tunnel-acl.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 14 KiB

After

Width:  |  Height:  |  Size: 14 KiB

0
topology.png → Images/topology.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 66 KiB

After

Width:  |  Height:  |  Size: 66 KiB

128
isp1 Normal file
View File

@ -0,0 +1,128 @@
version 15.7
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISP1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
ip address 11.0.32.10 255.255.255.0
duplex auto
!
interface Ethernet0/1
ip address 203.0.113.2 255.255.255.252
duplex auto
!
interface Ethernet0/2
no ip address
duplex auto
!
interface Ethernet0/3
no ip address
duplex auto
!
router ospf 1
network 11.0.32.0 0.0.0.255 area 0
network 203.0.113.0 0.0.0.3 area 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
ipv6 ioam timestamp
!
!
!
control-plane
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
transport input none
!
!
end

131
isp2 Normal file
View File

@ -0,0 +1,131 @@
version 15.7
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISP2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
ip address 203.0.114.2 255.255.255.252
duplex auto
!
interface Ethernet0/1
ip address 11.0.32.11 255.255.255.0
duplex auto
!
interface Ethernet0/2
no ip address
duplex auto
!
interface Ethernet0/3
no ip address
duplex auto
!
router ospf 1
network 11.0.32.0 0.0.0.255 area 0
network 203.0.114.0 0.0.0.3 area 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 192.168.10.0 255.255.255.0 11.0.32.10
!
ipv6 ioam timestamp
!
!
!
control-plane
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
transport input none
!
!
end

146
site-a Normal file
View File

@ -0,0 +1,146 @@
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname SITE-A
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no ip icmp rate-limit unreachable
!
!
!
!
!
ip dhcp excluded-address 192.168.10.1 192.168.10.9
!
ip dhcp pool PCI-Compliant
network 192.168.10.0 255.255.255.0
default-router 192.168.10.254
!
!
!
no ip domain lookup
no ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
!
!
!
!
crypto isakmp policy 1
encr aes
hash sha256
authentication pre-share
group 2
crypto isakmp key NAXSLABS address 203.0.114.1
!
!
crypto ipsec transform-set NAXSLABSTS esp-aes esp-sha256-hmac
mode tunnel
!
!
!
crypto map NAXSLABSCM 10 ipsec-isakmp
set peer 203.0.114.1
set transform-set NAXSLABSTS
match address NAXSLABSVPN-ACL
!
!
!
!
!
interface Ethernet0/0
no ip address
!
interface Ethernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Ethernet0/1
ip address 203.0.113.1 255.255.255.252
ip nat outside
ip virtual-reassembly in
crypto map NAXSLABSCM
!
interface Ethernet0/2
no ip address
!
interface Ethernet0/3
no ip address
!
router ospf 1
network 192.168.10.0 0.0.0.255 area 0
network 203.0.113.0 0.0.0.3 area 0
default-information originate
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip nat inside source list NAXSLABSNAT interface Ethernet0/1 overload
ip route 192.168.20.0 255.255.255.0 203.0.113.2
!
ip access-list extended NAXSLABSNAT
deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
permit ip 192.168.10.0 0.0.0.255 any
ip access-list extended NAXSLABSVPN-ACL
permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
!
no cdp log mismatch duplex
!
!
!
control-plane
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
transport input all
!
!
end

91
site-a-sw1 Normal file
View File

@ -0,0 +1,91 @@
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
!
!
no ipv6 cef
!
!
!
!
no ip icmp rate-limit unreachable
!
no ip domain-lookup
!
!
ip cef
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Ethernet0/1
switchport access vlan 10
switchport mode access
!
interface Ethernet0/2
!
interface Ethernet0/3
!
ip forward-protocol nd
!
ip tcp synwait-time 5
no ip http server
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
!
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
!
end

142
site-b Normal file
View File

@ -0,0 +1,142 @@
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no ip icmp rate-limit unreachable
!
!
!
!
!
ip dhcp excluded-address 192.168.20.1 192.168.20.19
!
ip dhcp pool PCI-Compliant
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
!
!
!
no ip domain lookup
no ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
!
!
!
!
crypto isakmp policy 1
encr aes
hash sha256
authentication pre-share
group 2
crypto isakmp key NAXSLABS address 203.0.113.1
!
!
crypto ipsec transform-set NAXSLABSTS esp-aes esp-sha256-hmac
mode tunnel
!
!
!
crypto map NAXSLABSCM 10 ipsec-isakmp
set peer 203.0.113.1
set transform-set NAXSLABSTS
match address NAXSLABSVPN-ACL
!
!
!
!
!
interface Ethernet0/0
no ip address
!
interface Ethernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Ethernet0/1
ip address 203.0.114.1 255.255.255.252
ip nat outside
ip virtual-reassembly in
crypto map NAXSLABSCM
!
interface Ethernet0/2
no ip address
!
interface Ethernet0/3
no ip address
!
router ospf 1
network 192.168.20.0 0.0.0.255 area 0
network 203.0.114.0 0.0.0.3 area 0
default-information originate
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
ip access-list extended NAXSLABSNAT
deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.20.0 0.0.0.255 any
ip access-list extended NAXSLABSVPN-ACL
permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
!
no cdp log mismatch duplex
!
!
!
control-plane
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
transport input all
!
!
end

91
site-b-sw1 Normal file
View File

@ -0,0 +1,91 @@
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
!
!
no ipv6 cef
!
!
!
!
no ip icmp rate-limit unreachable
!
no ip domain-lookup
!
!
ip cef
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Ethernet0/1
switchport access vlan 20
switchport mode access
!
interface Ethernet0/2
!
interface Ethernet0/3
!
ip forward-protocol nd
!
ip tcp synwait-time 5
no ip http server
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
!
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
!
end