Site To Site VPNs Using IPSEC - Different Variations

IPSEC LAN TO LAN VPN USING CRYPTOMAP (With host to host routing configured)
***************************************************************************


R1
===


!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 5
 lifetime 3600
 hash sha
!
crypto isakmp key cisco address 23.23.23.3
!
crypto ipsec transform-set PHASE2 esp-3des esp-sha-hmac
!
access-list 100 permit ip 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
crypto map CRYPTOMAP 10 ipsec-isakmp
 set peer 23.23.23.3
 set transform-set PHASE2
 match address 100
!
!
interface FastEthernet0/0
 crypto map CRYPTOMAP
!




=========================


R3
===


!
crypto isakmp policy 10
 enc aes
 hash sha
 gr 5
 life 3600
 authen pre
 exit
!
crypto isakmp key cisco address 12.12.12.1
!
crypto ipsec transform-set PHASE2 esp-3des esp-sha-hmac
!
access-l 100 per ip 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
crypto map CRYPTOMAP 10 ipsec-isakmp
 set peer 12.12.12.1
 set transform PHASE2
 match add 100
!
int f0/0
 crypto map CRYPTOMAP
!
==========================
###########################################################


IPSEC OVER GRE ( With No host to host routing )
****************************************


R1
===


!
router ospf 1
 no network 14.14.14.1 0.0.0.0 area 0
!
interface Tunnel0
 ip address 13.13.13.1 255.255.255.0
 tunnel source FastEthernet0/0
 tunnel destination 23.23.23.3
!
router eigrp 1
 no au
 net 14.14.14.1 0.0.0.0
 net 13.13.13.1 0.0.0.0
!
no access-list 100 permit ip 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
access-list 100 permit gre 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
no access-list 100 permit gre 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
access-list 100 permit gre ho 12.12.12.1 ho 23.23.23.3 
!


R3
===


!
router ospf 1
 no network 35.35.35.3 0.0.0.0 area 0
!
interface Tunnel0
 ip address 13.13.13.3 255.255.255.0
 tunnel source FastEthernet0/0
 tunnel destination 12.12.12.1
!
router eigrp 1
 no au
 net 35.35.35.3 0.0.0.0
 net 13.13.13.3 0.0.0.0
!
no access-list 100 permit ip 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
access-list 100 permit gre 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.25
!
no access-list 100 permit gre 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
access-list 100 permit gre ho 23.23.23.3 ho 12.12.12.1
!
=========================================================================
#############################################################################


IPSEC LAN TO LAN Using IPSEC Profile (No host to host routing)
*****************************************************


R1
==
!
crypto ipsec profile IPSEC-PROFILE
 set transform-set PHASE2
!
int f0/0
 no crypto map CRYPTOMAP
!
int tu0
 tunnel protection ipsec profile IPSEC-PROFILE
!




R3
==


!
crypto ipsec profile IPSEC-PROFILE
 set transform-set PHASE2
!
int f0/0
 no crypto map CRYPTOMAP
!
int tu0
 tunnel protection ipsec profile IPSEC-PROFILE
!


=========================================================================
#########################################################################


IPSEC LAN TO LAN Using Static VTI (No host to host routing)
**************************************************




R1
==


!
int tu0
 tunnel mode ipsec ipv4
!
no access-list 100 permit gre host 12.12.12.1 host 23.23.23.3
!






R3
==


!
int tu0
 tunnel mode ipsec ipv4
!
no access-list 100 permit gre host 23.23.23.3 host 12.12.12.1
!
=========================================================================


HTH...
Deepak Arora
Evil CCIE

Best CCNA Training In Market For Free - Till 31st December 2011

Yet again INE surprises their customer with Free Access to best CCNA Training in Industry till 31st December, 2011. Since the product is executed and compiled by Brian McGahan so you guys just don't worry at all about quality of material you gonna get. IMHO there will be no match. Here are the URLs :

http://www.ine.com/all-access-pass/training/playlist/ccna-routing-switching-exam-course/introduction-10021222.html

http://www.ine.com/flashcards/

More Details : http://blog.ine.com/2011/11/17/ccna-rs-exam-course-and-ccna-rs-video-flashcards-free-streaming-video-access/

HTH...

Deepak Arora

Evil CCIE

Redistribution Mock Lab - The Crazy Stuff

Last year while I was preparing for my R&S Lab, I felt I was not well prepared for complex redistribution scenarios. I took a look at Vol-1 workbooks outline from IP Expert and Internetwork Expert but none of them seems to cover Redistribution as part of Technology labs. So I thought to create some ugly redistribution lab my self.

So let me quickly share the physical & logical topology here with you guys along with initials.

Requirement is simple - to perform mutual redistribution at all redistribution points without creating a routing loop. 

 

R1#sh ver | i IOS
Cisco IOS Software, 3600 Software (C3640-JS-M), Version 12.4(17), RELEASE SOFTWARE (fc1)





<<< R1 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R1
!
int lo0
ip add 1.1.1.1 255.255.255.0
ip ospf network point-to-p
exit
!
int f1/0
ip add 15.15.15.1 255.255.255.0
no sh
exit
!
int s0/0
ip add 10.10.10.1 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.2 102 b
frame map ip 10.10.10.3 103 b
frame map ip 10.10.10.4 104 b
frame map ip 10.10.10.1 102
ip ospf network point-to-m
no sh
exit
!
router ospf 1
router-id 111.111.111.111
net 1.1.1.1 0.0.0.0 a 0
net 15.15.15.1 0.0.0.0 a 0
net 10.10.10.1 0.0.0.0 a 0
end
!
!
wr mem
---------------------------

<<< R2 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R2
!
int lo0
ip add 2.2.2.2 255.255.255.0
ip ospf network point-to-p
exit
!
int s0/0
ip add 10.10.10.2 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.1 201 b
frame map ip 10.10.10.2 201
ip ospf network point-to-m
no sh
exit
!
router ospf 1
router-id 222.222.222.222
net 2.2.2.2 0.0.0.0 a 0
net 10.10.10.2 0.0.0.0 a 0
exit
!
int lo1
ip add 12.12.12.12 255.255.255.0
exit
!
int s0/1
ip add 24.24.24.2 255.255.255.0
no sh
exit
!
router eigrp 100
no au
net 12.12.12.12 0.0.0.0
net 24.24.24.2 0.0.0.0
end
!
!
wr mem
------------------------------

<<< R3 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R3
!
int lo0
ip add 3.3.3.3 255.255.255.0
ip ospf network point-to-p
exit
!
int s0/0
ip add 10.10.10.3 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.1 301 b
frame map ip 10.10.10.3 301
ip ospf network point-to-m
no sh
exit
!
int s0/1
ip add 34.34.34.3 255.255.255.0
no sh
exit
!
int lo1
ip add 13.13.13.13 255.255.255.0
exit
!
router ospf 1
router-id 333.333.333.333
net 3.3.3.3 0.0.0.0 a 0
net 10.10.10.3 0.0.0.0 a 0
exit
!
router eigrp 100
no au
net 13.13.13.13 0.0.0.0
net 34.34.34.3 0.0.0.0
exit
!
int lo2
ip add 133.133.133.133 255.255.255.0
exit
!
int f1/0
ip add 63.63.63.3 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 133.133.0.0
net 63.0.0.0
end
!
!
wr mem
------------------------------

--

<<< R4 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R4
!
int lo0
ip add 4.4.4.4 255.255.255.0
ip ospf network point-to-p
exit
!
int s0/0
ip add 10.10.10.4 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.1 401 b
frame map ip 10.10.10.4 401
ip ospf network point-to-m
no sh
exit
!
router ospf 1
router-id 444.444.444.444
net 4.4.4.4 0.0.0.0 a 0
net 10.10.10.4 0.0.0.0 a 0
exit
!
int lo1
ip add 14.14.14.14 255.255.255.0
exit
!
int s0/1
ip add 24.24.24.4 255.255.255.0
no sh
exit
!
int s0/2
ip add 34.34.34.4 255.255.255.0
no sh
exit
!
router eigrp 100
no au
net 14.14.14.14 0.0.0.0
net 24.24.24.4 0.0.0.0
net 34.34.34.4 0.0.0.0
exit
!
int f1/0
ip add 100.100.100.4 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 100.0.0.0
end
!
!
wr mem
------------------------------
-

<<< R5 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R5
!
int lo0
ip add 5.5.5.5 255.255.255.0
ip ospf net point-to-p
exit
!
int f0/0
ip add 15.15.15.5 255.255.255.0
no sh
exit
!
router ospf 1
router-id 555.555.555.555
net 5.5.5.5 0.0.0.0 a 0
net 15.15.15.5 0.0.0.0 a 0
exit
!
int lo1
ip add 115.115.115.115 255.255.255.0
exit
!
int f1/0
ip add 56.56.56.5 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 115.115.0.0
net 56.0.0.0
end
!
!
wr mem
---------------------------

<<< R6 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R6
!
int lo0
ip add 6.6.6.6 255.255.255.0
exit
!
int f1/0
ip add 63.63.63.6 255.255.255.0
no sh
exit
!
int f0/0
ip add 56.56.56.6 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 6.0.0.0
net 63.0.0.0
net 56.0.0.0
end
!
!
wr mem
---------------------------------

<<< R7 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R7
!
int lo0
ip add 7.7.7.7 255.255.255.0
exit
!
int f0/0
ip add 100.100.100.7 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 7.0.0.0
net 100.0.0.0
end
!
!
wr mem

---------------------------------------


<<< R8 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R8
!
int lo0
ip add 8.8.8.8 255.255.255.0
exit
!
int f0/0
ip add 100.100.100.8 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 8.0.0.0
net 100.0.0.0
end
!
!
wr mem

I would like to mention here that I am not looking for optimal routing here after redistribution, R4 has 3 routing protocols running, so make sure all three have mutual redistribution.

All you need to know about redistribution is right here

http://s3.www.ine.com/vSeminars/CCIE%20Route%20Redistribution%20Demystified.htm

http://blog.ine.com/2011/07/08/understanding-route-redistribution-excerpts-from-ccie-rs-atc/

http://blog.ine.com/2011/04/04/understanding-ospf-external-route-path-selection/

http://blog.ine.com/2008/02/09/understanding-redistribution-part-i/

http://blog.ine.com/2008/02/19/understanding-redistribution-part-ii/

http://blog.ine.com/2008/03/17/understanding-redistribution-part-iii/

http://blog.ine.com/2009/02/15/time-based-redistribution-ahhh-the-horror-of-it-all/

http://blog.ine.com/2008/07/19/advanced-route-redistribution-scenario-iewb-rs-v41-vol-ii-lab-2-task-411/

Apart from these :

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009487e.shtml

http://www.cs.cmu.edu/~4D/papers/guidelines-inm07.pdf

http://www.cs.cmu.edu/~4d/papers/rr-icnp07.pdf

http://blog.ine.com/2008/01/15/understanding-how-redistribution-works-in-ipv6/

http://rizzitech.blogspot.com/2011/05/nx-os-redistribution-whats-different.html

https://ipexpert.adobeconnect.com/_a748906506/p25923416/ 

http://cciethebeginning.wordpress.com/2011/10/17/routing-protocol-redistribution-and-path-optimization/


http://cciethebeginning.wordpress.com/2011/12/22/ipv6-routing-protocol-redistribution/

http://blog.ipexpert.com/2012/01/04/ospf-and-bgp-puzzle/

http://blog.ipexpert.com/2012/01/09/follow-up-on-ospf-and-bgp-puzzle/

http://blog.ine.com/2011/04/04/understanding-ospf-external-route-path-selection/


http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800943c5.shtml


http://docwiki.cisco.com/wiki/Internetwork_Design_Guide_--_RIP_and_OSPF_Redistribution#RIP_and_OSPF_Redistribution

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008047915d.shtml

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080093fd9.shtml

http://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a0080531fd2.shtml

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094707.shtml

http://www.cisco.com/en/US/tech/tk872/technologies_configuration_example09186a0080bb1dd4.shtml


http://blog.ipexpert.com/2009/06/01/seting-route-tags-with-bgp-table-map/


http://blog.ipexpert.com/2010/06/21/redistributing-connected-routes/


http://blog.ipexpert.com/2009/10/28/bgp-redistribution/


http://blog.ipexpert.com/2009/09/23/route-redistribution-what-happened-to-my-reachability/


http://packetlife.net/blog/2010/jan/4/routing-table-profiling/

http://packetlife.net/blog/2009/jan/19/bgp-route-auto-tagging/

http://blog.ioshints.info/2011/05/ospf-and-connected-networks-to.html


http://blog.ioshints.info/2009/10/ios-fossils-classfull-ospf.html

http://noshut.blogspot.in/2011/04/routing-protocol-redistribution-using.html


http://ieoc.com/forums/t/22919.aspx


HTH...

Deepak Arora

Evil CCIE 

My Updated Linkedin Profile

https://in.linkedin.com/in/deepak-arora-evil-ccie-%CE%B9l%CE%B9-3a09bb15

OSPF Loopback Advertisements With Proper Mask - The Tricky Part

There is always a talk going on about among CCNP/CCIP/CCIE candidates that why a loopback interface is always treated as Stub Host into OSPF and Advertised as /32 route even the actual mask for the interface was configured differently.

Actually It's based on RFC standard 2328 for OSPF ver2. Here are ref details :

RFC - 2328  http://www.ietf.org/rfc/rfc2328.txt

Protocol - OSPF Ver 2

Section - 9.1

Page - 66

Tag - Interface States > Loopback

Now interestingly Cisco Documentation provides only a one work-around to this by putting command - ip ospf network point-to-point under the loopback interface itself.

But are there any other ways ? ....

What if our Evil CCIE Lab ask to advertise Loopback interfaces with correct mask and we are not allowed use the command mentioned above :-)

Actually there are three ways to do it, lets explore them one by one.

HTH...

Deepak Arora

Evil CCIE