Example - How to configure Site-to-site VPN with IOS router

• Router 1 (Left):

crypto isakmp policy 10

 encr aes 256

 authentication pre-share

 group 5

crypto isakmp key CISCO address 10.10.20.3

!

!

crypto ipsec transform-set My-Set esp-aes 192 esp-sha-hmac

!

crypto map MyMap 10 ipsec-isakmp

 set peer 10.10.20.3

 set transform-set My-Set

 match address R1_TO_R3

!

interface FastEthernet0/0

 ip address 10.10.10.1 255.255.255.0

 crypto map MyMap

!

interface FastEthernet0/1

 ip address 172.16.1.1 255.255.255.0

!

router ospf 10

 router-id 1.1.1.1

 log-adjacency-changes

 network 0.0.0.0 255.255.255.255 area 0

!

ip access-list extended R1_TO_R3

 permit ip 172.16.1.0 0.0.0.255 172.16.3.0 0.0.0.255

• Router 3 (Right):

crypto isakmp policy 10

 encr aes 256

 authentication pre-share

 group 5

crypto isakmp key CISCO address 10.10.10.1

!

!

crypto ipsec transform-set My-Set esp-aes 192 esp-sha-hmac

!

crypto map MyMap 10 ipsec-isakmp

 set peer 10.10.10.1

 set transform-set My-Set

 match address R3_TO_R1

!

interface FastEthernet0/0

 ip address 172.16.3.3 255.255.255.0

!

interface FastEthernet0/1

 ip address 10.10.20.3 255.255.255.0

 crypto map MyMap

!

router ospf 10

 router-id 3.3.3.3

 log-adjacency-changes

 network 0.0.0.0 255.255.255.255 area 0

!

ip access-list extended R3_TO_R1

 permit ip 172.16.3.0 0.0.0.255 172.16.1.0 0.0.0.255

• Validation:

Router3#show  crypto ipsec sa

interface: FastEthernet0/1

    Crypto map tag: MyMap, local addr 10.10.20.3

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (172.16.3.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)

   current_peer 10.10.10.1 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 3242, #pkts encrypt: 3242, #pkts digest: 3242

    #pkts decaps: 3242, #pkts decrypt: 3242, #pkts verify: 3242

    #pkts compressed: 0, #pkts decompressed: 0

Router3#show  crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst             src             state          conn-id slot status

10.10.10.1      10.10.20.3      QM_IDLE           1002    0 ACTIVE

Archive configuration on a Cisco Switch

In a previously post I have written a script (python) to automatically backup cisco config.
There is another method to backup this configuration. Used the archive command. By this way, it's possible to backup the configuration on a remote FTP server. Below, you will find an example:


ip ftp username user1
ip ftp password password1
!
archive
 path ftp://10.10.10.10/folder/My-switch.cfg
 write-memory
 time-period 1440

The write memory command trigger an automatic backup on the ftp server.
1440 means one backup generate every day.

If you make a mistake and you decide to come back on an old version, it's possible to restore the configuration. The better way is  using this command:


configure replace path ftp://10.10.10.10/folder/My-switch.cfg--9-09-00-23-0

To see the state of the archive you can use the 'show archive' command:


SWITCH#show archive
The maximum archive configurations allowed is 14.
The next archive file will be named ftp://10.10.10.10/folder/My-switch.cfg-%3Ctimestamp%3E-2
 Archive #  Name
   1        ftp://10.10.10.10/folder/My-switch.cfgFeb--9-09-00-23-0
   2        ftp:// 10.10.10.10/folder/My-switch.cfgFeb--9-09-00-37-1 <- Most Recent
   3
   4

Gestion de l'archive sur catalyst

La gestion des archives par l'IOS fournie différents mécanismes de gestion des configs et des logs.
L'exemple ci-dessous permet de sauvegarder la configuration toutes les 24heures sur une carte flash externe:

archive
path disk0:/hostname_
maximum 14
time-period 1440

Validation:

dir disk0:/
5 -rw- 68004 Jun 6 2011 10:11:58 +02:00 hostname_Jun--6-10-11-49.310-CET-0


L'exemple ci-dessous permet de sauvegarder la configuration toutes les 24heures sur un serveur ftp distant:

ip ftp username cisco
ip ftp password cisco
archive
path ftp://10.10.10.10/hostname_
write-memory

L'exemple ci-dessous permet de suivre les différents changements appliqués à la configuration:

archive
log config
logging enable
hidekeys

Validation:

show archive log config all
idx sess user@line Logged command
670 63 admin@vty1 | interface GigabitEthernet1/1/44
671 63 admin@vty1 | no channel-group 430 mode active