Securing DMVPN Tunnels - IPsec Tunnel Protection
9 important questions on Securing DMVPN Tunnels - IPsec Tunnel Protection
Which 4 things need to be created for IPsec tunnel protection with the use of a static PSK?
- IKEv2 keyring
- IKEv2 profile
- IPsec transform set
- IPsec profile
What is a IKEv2 keyring?
- It is a repository of pre-shared keys
- In a IKEv2 keyring it is possible to define which keys apply to which hosts.
- Identification of the password is based on the IP address of the remote router.
How is an IKEv2 keyring created?
- Create the keyring
crypto ikev2 keyring keyring-name - Create the peer
peer peer-name - Identify the peer IP address
address network subnet-mask - Define the pre-shared key
pre-shared-key secure-key
- Higher grades + faster learning
- Never study anything twice
- 100% sure, 100% understanding
What is an IKEv2 Profile?
- A collection of nonnegotiable security parameters used during IKE security association.
- Later associated with the IPsec profile.
- Local and remote authentication methods must be defined within the profile, as well as a match statement.
What are the steps to create an IKEv2 profile?
- Define the IKEv2 profile
crypto ikev2 profile ike-profile-name - Define the peer IP address
match identity remote address ip-address - Optionally set the local router's identity
identity local address ip-address - If Front Door VRF (FVRF) is used, associate the FVRF with the Profile
match fvrf {rf-name | Any} - define the authentication methods for received connection requests
authentication local {pre-share | Rsa-sig} - define the authentication methods for sent connection requests
authentication remote {pre-share | Rsa-sig} - for pre-shared auth, associate the IKEv2 keyring with the IKEv2 profile
keyring local keyring-name
What is the IPsec Transform Set?
- Identifies Security Protocols for encrypting traffic
- Specifies protocol ESP or AH to authenticate the data
How is the IPsec Transform Set created?
- Create the transform set en identify the protocols
crypto ipsec transform-set transform-set-name [esp-encryption-name] [esp-authentication-name] [ah-authentication-name] - Configure the ESP mode
mode {transport | Tunnel}
What command is used to encrypt a tunnel interface by applying the ipsec profile.
What commands are used to verify IPsec protection on a DMVPN tunnel?
- Show dmvpn detail
- show crypto ipsec sa
The question on the page originate from the summary of the following study material:
- A unique study and practice tool
- Never study anything twice again
- Get the grades you hope for
- 100% sure, 100% understanding
![Trustpilot Logo](/images/design_2020/lp/clp-trustpilot-en.png)