We’re in good shape so far ! Encryption is next.
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 19
lifetime 3600
crypto isakmp key RouteL3@k address 0.0.0.0
!
!
crypto ipsec transform-set RTLEAK_TS esp-aes esp-sha512-hmac
mode tunnel
!
crypto ipsec profile RTLEAK_PROF
set transform-set RTLEAK_TS
!
!
!
!
!
!
!
interface Tunnel100
ip address 10.1.1.1 255.255.255.252
tunnel source Ethernet0/0
tunnel destination 2.2.2.100
tunnel protection ipsec profile RTLEAK_PROF
!
HQ-RTR1#
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 19
lifetime 3600
crypto isakmp key RouteL3@k address 0.0.0.0
!
!
crypto ipsec transform-set RTLEAK_TS esp-aes esp-sha512-hmac
mode tunnel
!
crypto ipsec profile RTLEAK_PROF
set transform-set RTLEAK_TS
!
!
!
!
!
!
!
interface Tunnel100
ip address 10.1.1.2 255.255.255.252
tunnel source Ethernet0/0
tunnel destination 1.1.1.100
tunnel protection ipsec profile RTLEAK_PROF
!
OFF-RTR#
Great ! Let’s quickly confirm that our encryption actually works.
OFF-RTR#sh crypto ipsec sa
interface: Tunnel100
Crypto map tag: Tunnel100-head-0, local addr 172.16.200.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.200.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (1.1.1.100/255.255.255.255/47/0)
current_peer 1.1.1.100 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.16.200.1, remote crypto endpt.: 1.1.1.100
plaintext mtu 1426, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
HQ-RTR1#ping 10.1.1.2 repeat 2
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 10/10/10 ms
OFF-RTR#sh crypto ipsec sa
interface: Tunnel100
Crypto map tag: Tunnel100-head-0, local addr 172.16.200.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.200.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (1.1.1.100/255.255.255.255/47/0)
current_peer 1.1.1.100 port 4500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 2, #pkts encrypt: 2, #pkts digest: 2
#pkts decaps: 2, #pkts decrypt: 2, #pkts verify: 2
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.16.200.1, remote crypto endpt.: 1.1.1.100
plaintext mtu 1426, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
current outbound spi: 0xE2781AF5(3799522037)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xCE2DA59B(3459098011)
We’re in good shape here so far. Let’s now focus on extending the 192.168.1.0/24 subnet across. This is a 2 step configuration process which are as follow:
- Configure a Pseudowire class and select a source interface (Tunnel100)
- Bind the profile to the LAN interface facing the hosts. This is going to be the interface which we want to bridge the L2 traffic from (Ethernet0/1)
Let’s do that.
pseudowire-class HQ-RO
encapsulation l2tpv3
ip local interface Tunnel100
!
HQ-RTR1#
pseudowire-class HQ-RO
encapsulation l2tpv3
ip local interface Tunnel100
!
OFF-RTR#
Here, we created a Pseudowire class and configured an encapsulation type which is L2TPv3. Since we want to encapsulate L2 traffic through our GRE tunnel, we called on the tunnel interface as the local interface of the L2 session. Let’s now bind the Pseudowire class to the router interface facing our hosts which is Ethernet0/1 on both sides.
HQ-RTR1(config)#do sh run int Ethernet0/1
Building configuration...
Current configuration : 44 bytes
!
interface Ethernet0/1
no ip address
end
HQ-RTR1(config)#interface Ethernet0/1
HQ-RTR1(config-if)# no ip address
HQ-RTR1(config-if)# xconnect 10.1.1.2 1 encapsulation l2tpv3 pw-class HQ-RO
HQ-RTR1(config-if-xconn)#
OFF-RTR(config)#do sh run int eth0/1
Building configuration...
Current configuration : 44 bytes
!
interface Ethernet0/1
no ip address
end
OFF-RTR(config)#interface Ethernet0/1
OFF-RTR(config-if)# no ip address
OFF-RTR(config-if)# xconnect 10.1.1.1 1 encapsulation l2tpv3 pw-class HQ-RO
OFF-RTR(config-if-xconn)#
That’s all there is to it. Note that “1” highlighted in blue references a VC ID value and it has to match on both sides. This value differentiates the L2TPv3 sessions. Also notice how once we configure xconnect, we enter a xconnect mode where we have the capability of tuning the protocol such as adding a backup peer for redundancy or configuring delay metrics for the session.
Let’s now verify and confirm that we have end to end reachability here.
HQ-HOST#sh ip int br | exc una
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 192.168.1.1 YES NVRAM up up
HQ-HOST#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/13 ms
REMOTE-HOST#sh ip int br | exc una
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 192.168.1.2 YES NVRAM up up
REMOTE-HOST#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/6 ms
Fantastic ! Here we can ping remote host on the far side going through the Internet and they’re both part of 192.168.1.0/24. Let’s see additional commands we can use to confirm L2TPv3 is up and running.
HQ-RTR1#sh l2tp
L2TP Tunnel and Session Information Total tunnels 1 sessions 1
LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/
Count VPDN Group
2762039292 2395514761 OFF-RTR est 10.1.1.2 1 l2tp_default_cl
LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
Vcid, Circuit
4154590038 2286929823 2762039292 1, Et0/1 est 00:06:30 0
The “Sh l2tp” provides valuable information such as the interface which the L2 traffic is coming from, our Tunnel ID and Virtual Circuit ID.
HQ-RTR1#sh l2tp session all
L2TP Session Information Total tunnels 1 sessions 1
Session id 4154590038 is up, logical session id 32803, tunnel id 2762039292
Remote session id is 2286929823, remote tunnel id 2395514761
Locally initiated session
Unique ID is 0
Session Layer 2 circuit, type is Ethernet, name is Ethernet0/1
Session vcid is 1
Circuit state is UP
Local circuit state is UP
Remote circuit state is UP
Call serial number is 1391200002
Remote tunnel name is OFF-RTR
Internet address is 10.1.1.2
Local tunnel name is HQ-RTR1
Internet address is 10.1.1.1
IP protocol 115
Session is L2TP signaled
Session state is established, time since change 00:07:32
74 Packets sent, 75 received
8343 Bytes sent, 8447 received
Last clearing of counters never
Counters, ignoring last clear:
74 Packets sent, 75 received
8343 Bytes sent, 8447 received
Receive packets dropped:
out-of-order: 0
other: 0
total: 0
Send packets dropped:
exceeded session MTU: 0
other: 0
total: 0
DF bit off, ToS reflect disabled, ToS value 0, TTL value 255
Sending UDP checksums are disabled
Received UDP checksums are verified
No session cookie information available
FS cached header information:
encap size = 24 bytes
45000014 00000000 ff73a572 0a010101
0a010102 884fc79f
Sequencing is off
Conditional debugging is disabled
SSM switch id is 4126, SSM segment id is 8230
This is even more detailed as we can see the number of packet flows, the L2 type, the IP protocol and whether or not the session is up.
HQ-RTR1#sh xconnect all
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP pri ac Et0/1:4(Ethernet) UP l2tp 10.1.1.2:1 UP
The “sh xconnect all” provides similar information but gives us a quick overview in terms of the session state.
That’s I wanted to show you today.
Hello I'm Pape. My friends call me Pop. I'm CCIE #48357. I enjoy my field and love to share it with others. I love to write so I'm sharing my blog with you.
Leave a Reply