🏛️ ArchiZeroTrust› CCIE› VPN› IPsec› IKEv2› VTI

Topologie

R1
G0/0: 10.0.0.1/30
Tunnel0: 172.16.0.1/30
LAN: 192.168.1.0/24
Initiateur
Internet / WAN · 10.0.0.0/30
═══ Tunnel IPsec ESP ═══
R2
G0/0: 10.0.0.2/30
Tunnel0: 172.16.0.2/30
LAN: 192.168.2.0/24
Répondeur
Mode: VTI route-based
Auth: Pre-Shared Key
IKE: AES-256 + SHA-256 + DH14
IPsec: ESP AES-256 + SHA-256
Msgs IKEv2: 4 messages (2 échanges)

Échanges IKEv2 — Clique sur un message pour voir les détails

Phase 1 — IKE_SA_INIT Phase 2 — IKE_AUTH
✅ Tunnel UP
IKE SA établi
Child SA / IPsec SA établi
Interface Tunnel0 UP/UP

Config R1  Initiateur

! ── 1. IKEv2 Proposal ─────────────────────
crypto ikev2 proposal PROP-IKEv2
 encryption aes-cbc-256
 integrity sha256
 group 14

! ── 2. IKEv2 Policy ────────────────────────
crypto ikev2 policy POL-IKEv2
 proposal PROP-IKEv2

! ── 3. Keyring (PSK) ───────────────────────
crypto ikev2 keyring KR-IKEv2
 peer R2
  address 10.0.0.2
  pre-shared-key MySecret123

! ── 4. IKEv2 Profile ───────────────────────
crypto ikev2 profile PROF-IKEv2
 match identity remote address 10.0.0.2 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-IKEv2

! ── 5. IPsec Transform-Set (Child SA) ──────
crypto ipsec transform-set TS-ESP esp-aes 256 esp-sha256-hmac
 mode tunnel

! ── 6. IPsec Profile ───────────────────────
crypto ipsec profile IPSEC-PROF
 set transform-set TS-ESP
 set ikev2-profile PROF-IKEv2

! ── 7. Interface VTI ───────────────────────
interface Tunnel0
 ip address 172.16.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 10.0.0.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-PROF

! ── 8. Route statique ──────────────────────
ip route 192.168.2.0 255.255.255.0 Tunnel0

Config R2  Répondeur

! ── 1. IKEv2 Proposal ─────────────────────
crypto ikev2 proposal PROP-IKEv2
 encryption aes-cbc-256
 integrity sha256
 group 14

! ── 2. IKEv2 Policy ────────────────────────
crypto ikev2 policy POL-IKEv2
 proposal PROP-IKEv2

! ── 3. Keyring (PSK) ───────────────────────
crypto ikev2 keyring KR-IKEv2
 peer R1
  address 10.0.0.1
  pre-shared-key MySecret123

! ── 4. IKEv2 Profile ───────────────────────
crypto ikev2 profile PROF-IKEv2
 match identity remote address 10.0.0.1 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-IKEv2

! ── 5. IPsec Transform-Set (Child SA) ──────
crypto ipsec transform-set TS-ESP esp-aes 256 esp-sha256-hmac
 mode tunnel

! ── 6. IPsec Profile ───────────────────────
crypto ipsec profile IPSEC-PROF
 set transform-set TS-ESP
 set ikev2-profile PROF-IKEv2

! ── 7. Interface VTI ───────────────────────
interface Tunnel0
 ip address 172.16.0.2 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 10.0.0.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-PROF

! ── 8. Route statique ──────────────────────
ip route 192.168.1.0 255.255.255.0 Tunnel0

Légende :

IKE_SA_INIT → proposal / policy
IKE_AUTH → keyring / ikev2 profile
Child SA → transform-set / ipsec profile
VTI → interface Tunnel + route