CloudLabBox
Try the free demo

Firewalls and VPNs lab 1 of 16

IKEv2 between IOS routers - crypto map then VTI

Connect a depot to HQ with a policy-based IKEv2 crypto map and a shop with a route-based virtual tunnel interface (VTI), using AES-256-GCM and DH group 20, then add a new HQ subnet and see why route-based VPNs replaced crypto maps.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 01 - IKEv2 between IOS routers - crypto map then VTI

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
5 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Tamar Valley Foods runs its head office (HQ) in Plymouth on a Cisco router. The Exeter depot and a new shop in Truro each have their own internet line and a small router. The ISP carries only the public addresses: it has no idea where 10.x.x.x lives, so today HQ-PC cannot reach either site.

You will join both sites to HQ with IKEv2. The depot gets the classic policy-based design, a crypto map, because that is what most existing networks still run. The shop gets the modern route-based design, a virtual tunnel interface. Then HQ's new voice subnet has to reach both sites, and you will see for yourself which design is easier to live with.

DeviceInterfaceAddressNotes
ISPGi0/0, Gi0/1, Gi0/2203.0.113.1/30, 198.51.100.1/30, 192.0.2.1/30Public addresses only
HQGi0/0203.0.113.2/30Internet, default route to .1
HQGi0/110.1.10.1/24Office LAN (HQ-PC 10.1.10.10)
HQLoopback2010.1.20.1/24New voice subnet
HQTunnel1172.16.13.1/30VTI to SHOP (you create it)
DEPOTGi0/0 / Loopback10198.51.100.2/30 / 10.2.10.1/24Loopback10 stands in for the depot LAN
SHOPGi0/0 / Loopback10192.0.2.2/30 / 10.3.10.1/24Loopback10 stands in for the shop LAN
SHOPTunnel1172.16.13.2/30VTI to HQ (you create it)

Tamar's crypto standard:

SettingValue
IKE SA (phase 1)IKEv2, AES-256-GCM, PRF SHA-384, DH group 20 (ECP-384)
AuthenticationPre-shared keys: depot Tamar-Depot-26, shop Tamar-Shop-26
IPsec SA (phase 2)ESP AES-256-GCM, PFS group 20, tunnel mode, 3,600 s
Depot traffic10.1.10.0/24 to and from 10.2.10.0/24 (crypto map)
Shop trafficAnything routed into Tunnel1 (VTI)

What you’ll practise

  • Build reusable IKEv2 building blocks on IOS: proposal, policy, keyring and profiles
  • Configure a policy-based VPN with a crypto ACL and a crypto map
  • Configure a route-based VPN with an IPsec profile and a static VTI
  • Choose modern algorithms: AES-256-GCM, a PRF, DH group 20 and PFS
  • Compare the traffic selectors of both designs with show crypto session and show crypto ipsec sa
  • Add a subnet to both VPNs and explain the difference in effort

The tasks

  1. Check the underlay
  2. IKEv2 building blocks on HQ
  3. Policy-based VPN to the depot (crypto map)
  4. Route-based VPN to the shop (VTI)
  5. HQ's new voice subnet

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IKEv2 between IOS routers - crypto map then VTI5 nodes, 4 links. Every link is listed as text below the diagram.ISPHQDEPOTSHOPHQ-PCGi0/1Gi0/0Gi0/0Gi0/0Gi0/1Gi0/0Gi0/2Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to DEPOT Gi0/0
  • ISP Gi0/2 to SHOP Gi0/0
  • HQ Gi0/1 to HQ-PC Gi0/0
Nodes in IKEv2 between IOS routers - crypto map then VTI, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
DEPOTCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SHOPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQ-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 01 - IKEv2 between IOS routers - crypto map then VTI and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.