El objetivo del presente documento es mostrar la configuración de un túnel VPN Site-to-Site haciendo uso de interfaces estáticas VTI (S-VTI Static Virtual Tunnel Interface).
Una de las ventajas de hacer uso de S-VTI es que se pueden habilitar protocolos de enrutamiento dinámicos sin hacer uso del protocolo GRE, lo que reduce el tamaño del paquete (24 bytes menos), reduciendo así el ancho de banda para enviar datos cifrados.
Tenemos una red en Caracas (10.1.1.0/24) que queremos comunicar con otra red en Buenos Aires (10.2.2.0/24) como se muestra en la siguiente figura:
A continuación se describen los diferentes pasos que debemos dar para proceder a configurar el túnel LAN-to-LAN S-VTI:
En R1
- Configurar la Fase I
crypto isakmp policy 10
encr 3des
hash sha
authentication pre-share
group 2
!
crypto isakmp key cisco123 address 190.1.1.2
- Configurar la Fase II
crypto ipsec transform-set MYTSET esp-3des esp-md5-hmac
- Configurar un IPSec Profile y asociar la Transform-set a este Profile
crypto ipsec profile MYPROF
set transform-set MYTSET
- Configurar la interface túnel
interface Tunnel1
ip address 192.168.1.1 255.255.255.252
tunnel source 200.1.1.1
tunnel mode ipsec ipv4
tunnel destination 190.1.1.2
tunnel protection ipsec profile MYPROF
end
- Configurar el protocolo de enrutamiento
router eigrp 1
no auto-summary
network 10.0.0.0
network 192.168.1.0 0.0.0.3
-----------------------------------------------------------------------------------------
En R2
- Configurar la Fase I
crypto isakmp policy 10
encr 3des
hash sha
authentication pre-share
group 2
!
crypto isakmp key cisco123 address 200.1.1.1
- Configurar la Fase II
crypto ipsec transform-set MYTSET esp-3des esp-md5-hmac
- Configurar un IPSec Profile y asociar la Transform-set a este Profile
crypto ipsec profile MYPROF
set transform-set MYTSET
- Configurar la interface túnel
interface Tunnel1
ip address 192.168.1.2 255.255.255.252
tunnel source 190.1.1.2
tunnel mode ipsec ipv4
tunnel destination 200.1.1.1
tunnel protection ipsec profile MYPROF
end
- Configurar el protocolo de enrutamiento
router eigrp 1
no auto-summary
network 10.0.0.0
network 192.168.1.0 0.0.0.3
------------------------------------------------------------------------------------
VERIFICAMOS
R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
200.1.1.1 190.1.1.2 QM_IDLE 1002 ACTIVE
IPv6 Crypto ISAKMP SA
---------------------------------------------------------------------------------------
R1#sh inter tun 1
Tunnel1 is up, line protocol is up
Hardware is Tunnel
Internet address is 192.168.1.1/30
MTU 17886 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel linestate evaluation up
Tunnel source 200.1.1.1, destination 190.1.1.2
Tunnel protocol/transport IPSEC/IP
Tunnel TTL 255
Tunnel transport MTU 1446 bytes
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Tunnel protection via IPSec (profile "MYPROF")
Last input 00:18:21, output 00:18:01, output hang never
Last clearing of "show interface" counters 00:24:58
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
291 packets input, 18774 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
307 packets output, 20170 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
-----------------------------------------------------------------------------------------
