This is an example of a Static VTI configuration:
See above topology, same as last config ensure that both “sites” have internet connection to the ISP router.
Below is the configuration used, ensure both sides are configured correctly with the same configuration:
From Configuration Terminal
crypto isakmp policy 1 authentication pre-share encryption aes hash sha group 5 lifetime 1800 exit crypto isakmp key cisco add 0.0.0.0 crypto ipsec transform-set t-set esp-aes esp-sha-hmac mode tunnel exit crypto ipsec profile cisco set transform-set t-set exit interface tunnel 0 %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down ip add 192.168.1.2 255.255.255.0 tunnel mode ipsec ipv4 tunnel protection ipsec profile cisco exit %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON interface tunnel 0 ip ospf 10 area 0 exit router ospf 10 network 192.168.0.0 0.0.255.255 area 0 exit interface tunnel0 tunnel source fa0/0 tunnel destination 102.1.1.100 exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up %OSPF-5-ADJCHG: Process 10, Nbr 102.1.1.100 on Tunnel0 from LOADING to FULL, Loading Done
To Confirm configuration
R1#show crypto ipsec sa
interface: Tunnel0 Crypto map tag: Tunnel0-head-0, local addr 101.1.1.100
protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) current_peer 102.1.1.100 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 40, #pkts encrypt: 40, #pkts digest: 40 #pkts decaps: 39, #pkts decrypt: 39, #pkts verify: 39 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: 101.1.1.100, remote crypto endpt.: 102.1.1.100 path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1 current outbound spi: 0x33306896(858810518) PFS (Y/N): N, DH group: none
inbound esp sas: spi: 0x15FCFCCD(368901325) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4297365/3396) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas: spi: 0x33306896(858810518) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4297365/3396) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
R1#show crypto engine connections active Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address 1 IPsec AES+SHA 0 40 40 101.1.1.100 2 IPsec AES+SHA 41 0 0 101.1.1.100 1002 IKE SHA+AES 0 0 0 101.1.1.100