CloudLabBox
Try the free demo

CCNA lab 35 of 46

Site-to-site IPsec VPN and how remote access differs

Join two offices across an Internet provider that won't route private addresses: build a GRE tunnel, see that it works but is readable, then protect it with IKEv2 and IPsec and read the security associations and packet counters.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 5,120 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 35 - Site-to-site IPsec VPN and how remote access differs

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
5 vCPU, 5,120 MB
Smallest plan
Lite

The scenario

Ashworth Opticians is opening a branch across town. Both sites have an ordinary Internet service from the same ISP, which routes only the public addresses 198.51.100.0/30 and 198.51.100.4/30. The practice-management system at head office must be reachable from the branch, privately and securely. You'll build a GRE tunnel between the routers and protect it with IPsec.

DeviceInterfaceAddress
HQGi0/0 (Internet) / Gi0/1 (LAN)198.51.100.1/30 / 10.35.1.1/24
BRGi0/0 (Internet) / Gi0/1 (LAN)198.51.100.5/30 / 10.35.2.1/24
ISPGi0/0 / Gi0/1198.51.100.2/30 / 198.51.100.6/30
Tunnel0HQ / BR10.0.99.1/30 / 10.0.99.2/30
PC1 / PC2HQ LAN / branch LAN10.35.1.10 / 10.35.2.10

What you’ll practise

  • Explain why VPNs are needed and the IPsec building blocks (IKE, ESP, AH, tunnel and transport mode)
  • Compare site-to-site and remote-access VPNs
  • Build a GRE tunnel and route private networks over it
  • Protect the tunnel with an IKEv2 profile and an IPsec transform set
  • Verify the IKE and IPsec security associations and their counters

The tasks

  1. Learn what IPsec provides
  2. Prove the problem
  3. Build a GRE tunnel
  4. Define the IKEv2 phase
  5. Protect the tunnel with IPsec
  6. Look at it from the outside

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Site-to-site IPsec VPN and how remote access differs5 nodes, 4 links. Every link is listed as text below the diagram.HQBRISPPC1PC2Gi0/1eth0Gi0/1eth0Gi0/0Gi0/0Gi0/0Gi0/1
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ Gi0/0 to ISP Gi0/0
  • BR Gi0/0 to ISP Gi0/1
  • HQ Gi0/1 to PC1 eth0
  • BR Gi0/1 to PC2 eth0
Nodes in Site-to-site IPsec VPN and how remote access differs, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
BRCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 35 - Site-to-site IPsec VPN and how remote access differs and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.