U.C.S.M. Ing.

de Sistemas Tpicos Avanzados en Redes

Pgina: 1

UNIVERSIDAD CATLICA DE SANTA MARA

PROGRAMA PROFESIONAL DE INGENIERA DE SISTEMAS

SESIN 15:
Configuracin VPN
I
OBJETIVOS
Configuracin EIGRP en los routers
Crear un VPN site to site IPSEC

II
ACTIVIDADES
Configuracin VPNs Site-to-Site IPsec con CLI IOS
Topology Diagram

Ing. Karina Rosas Paredes

Ing. Jose Esquicha Tejada
Ing. Leticia Laura Ochoa

Prctica 15

1.- Configurar interfaces

2.- Configurar protocolo de enrutamiento EIGRP 100
3.-Configurar polticas ike
R1(config)# crypto isakmp enable
R1(config)# crypto isakmp policy 10
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha
R1(config-isakmp)# group 5
R1(config-isakmp)# lifetime 3600
R3(config)# crypto isakmp enable
R3(config)# crypto isakmp policy 10
R3(config-isakmp)# authentication pre-share
R3(config-isakmp)# encryption aes 256
R3(config-isakmp)# hash sha
R3(config-isakmp)# group 5
R3(config-isakmp)# lifetime 3600
R1(config)# crypto isakmp key cisco address 192.168.23.3
R3(config)# crypto isakmp key cisco address 192.168.12.1
R1# show crypto isakmp policy

4.- Configurar polticas ipsec

R1(config)# crypto ipsec transform-set 50 esp-aes 256 esp-sha-hmac
R1(cfg-crypto-trans)# exit
R3(config)# crypto ipsec transform-set 50 esp-aes 256 esp-sha-hmac
R3(cfg-crypto-trans)# exit
R1(config)# crypto ipsec security-association lifetime seconds 1800
R3(config)# crypto ipsec security-association lifetime seconds 1800

5.-Definir trfico interesante

R1(config)# access-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.3.0 0.0.0.255
R3(config)# access-list 101 permit ip 172.16.3.0 0.0.0.255 172.16.1.0 0.0.0.255

Ing. Karina Rosas Paredes

Ing. Jose Esquicha Tejada
Ing. Leticia Laura Ochoa

Prctica 15

6.- crear crypto map

R1(config)# crypto map MYMAP 10 ipsec-isakmp
R1(config-crypto-map)# match address 101
R1(config-crypto-map)# set peer 192.168.23.3
R1(config-crypto-map)# set pfs group5
R1(config-crypto-map)# set transform-set 50
R1(config-crypto-map)# set security-association lifetime seconds 900
R3(config)# crypto map MYMAP 10 ipsec-isakmp
R3(config-crypto-map)# match address 101
R3(config-crypto-map)# set peer 192.168.12.1
R3(config-crypto-map)# set pfs group5
R3(config-crypto-map)# set transform-set 50
R3(config-crypto-map)# set security-association lifetime seconds 900
R1(config)# interface fastethernet0/0
R1(config-if)# crypto map MYMAP
R3(config)# interface serial0/0/1
R3(config-if)# crypto map MYMAP
R1# show crypto ipsec transform-set
R1# show crypto map
R1# show crypto isakmp sa
R1# show crypto ipsec sa
Pruebe un Ping extendido desde el R1 con interfaz origen la loopback0, hacia el la loopback 0 del R3.

Ing. Karina Rosas Paredes

Ing. Jose Esquicha Tejada
Ing. Leticia Laura Ochoa

Prctica 15

7.- Utilice la herramienta WireShark para verificar la seguridad en la conexin

Qu sucede?
_________________________________________________________________________________
_________________________________________________________________________________
________________________________________________________________________________

Ing. Karina Rosas Paredes

Ing. Jose Esquicha Tejada
Ing. Leticia Laura Ochoa

Prctica 15