This chapter describes how to configure the IPSec to L2VPN service model for the Cisco Network-Based IPSec VPN Release 1.5 .
Configuring the IPSec to L2VPN Service Model
The IPSec to L2VPN model is very similar to the IPSec to MPLS topology, except the service provider has an L2 core instead of an MPLS core. The L2 core can be Frame Relay, ATM, 802.1q, or wireless.
This configuration enables a Layer 2 service provider to extend secured access service beyond its core into the internet. As in the IPSec to MPLS model, the sessions are terminated on the IPSec Aggregator. Using the Multi-VRF CE feature, users are mapped into an L2 infrastructure.
At an L3 level, the IPSec aggregator connects directly to the customer site that has L2 service. The service provider does not need to address the customer routing issue in its core. The IPSec aggregator and the L2 customer site can use either static routes or a dynamic routing protocol to establish end-to-end connectivity.
Before You Begin
The procedures provided here are specific to configuring IPSec to L2VPN and are based on the following assumptions:
1. That the following setup and configuration tasks have already been completed:
Setup of the core MPLS network
Setup of the customer VPN
Configuration of the links between the PE and the CE
Customer-specific information is complete
That you have a good understanding of the architecture and features you are using and that you have selected the means you will use to implement those features (for example, which of several strategies to use for address management or for user authentication and authorization).
IPSec to L2VPN Configuration Checklist
This section deals with configuring the router to function as the IPSec aggregator.
Procedures for competing each task are described in the sections that follow. If you are viewing this document online, you can click highlighted text to view details on the procedure.
Configure the addressed preshared key to be used during IKE) authentication.
Task 5: Configure ISAKMP Policy
Command
Purpose
Step 1
crypto isakmp policy priority
Configure an IKE policy.
Step 2
encryption {des | 3des | aes | aes 192 | aes 256}
Specify the encryption algorithm within an IKE policy.
Step 3
authentication {rsa-sig | rsa-encr | pre-share}
Specify the authentication method within an IKE policy.
Task 6: Configure DPD Keepalives
Command
Purpose
crypto isakmp keepalive secs retries
Allow the gateway to send dead peer detection (DPD) messages to the router.
Task 7: Configure Client Group for Local Authorization
Command
Purpose
Step 1
crypto isakmp client configuration group {group-name | default}
Specify which group's policy profile will be defined.
Step 2
key name
Configure the IKE preshared key for group policy attribute definition.
Step 3
pool (name)
Configure a local pool address.
Task 8: Configure ISAKMP Profile for VPN Sites
Command
Purpose
crypto isakmp profile profile-name
Define an ISAKMP profile for a VPN.
Task 9: Configure Dynamic VRF Association for VPN Sites
Command
Purpose
Step 1
vrf name
Associate the on-demand address pool with a VPN routing and forwarding instance (VRF) name.
Step 2
keyring keyring-name
Associate a keyring with an ISAKMP profile.
Step 3
match identity address address [mask] [fvrf]
Match an acceptable Phase 1 identity from a peer to a particular ISAKMP profile.
Task 10: Configure ISAKMP Profile for VPN Clients
Command
Purpose
crypto isakmp profile profile-name
Define an ISAKMP profile for a VPN.
Note You can configure the Remote sites to match each peer using sequence numbers in the crypto map
definition.You can match the peer on IP address or the hostname. The IP address match list for traffic to
be encrypted is also defined for each peer. In case of VPN clients, the dynamic profile defined earlier is
used to match the clients.
Task 11: Configure Dynamic VRF Association for VPN Clients
Command
Purpose
Step 1
vrf name
Associate the on-demand address pool with a VPN VRF name.
Step 2
match identity group-name
Match an acceptable Phase 1 identity from a peer to a Unity group.
Task 12: Configure XAUTH, Group Authorization, and Mode-Config
Command
Purpose
Step 1
client authentication list list-name
Configure IKE extended authentication (Xauth) on your router. The list-name must match the list-name defined during AAA configuration
Step 2
isakmp authorization list list-name
Configure group authorization IKE querying of AAA for tunnel attributes in aggressive mode.
Step 3
client configuration address [initiate | respond]
Configure IKE Mode Configuration (Mode-Config).
Task 13: Configure the Transform Set for Data Encryption
IPSec to L2VPN Configuration