Step 1.

– ISAKMP
Lefty#conf t
Lefty(config)#crypto isakmp enable
Lefty(config)#crypto isakmp policy 10
Lefty(config-isakmp)#authentication pre-share
Lefty(config-isakmp)#hash sha
Lefty(config-isakmp)#encryption aes 256
Lefty(config-isakmp)#group 5
Lefty(config-isakmp)#lifetime 3600
Lefty(config-isakmp)#exit
Lefty(config)#crypto isakmp key 0 SuperS3cure address 192.168.1.2
Lefty(config)#crypto isakmp keepalive 10 2 periodic
Lefty(config)#^Z
• Step 2. – Transform Set
• Lefty#conf t
Lefty(config)#crypto ipsec transform-set
MYTSETNAME esp-aes 256 esp-sha-hmac
Lefty(cfg-crypto-trans)#mode tunnel
Lefty(cfg-crypto-trans)#^Z
• Step 3. – ACL
• Lefty#conf t
Lefty(config)#access-list 101 permit ip 10.1.1.0
0.0.0.255 10.2.2.0 0.0.0.255
• Step 4. – Crypto Map
• Lefty#conf t
Lefty(config)#crypto map LEFTY_TO_RIGHTY 10 ipsec-
isakmp
% NOTE: This new crypto map will remain disabled
until a peer
and a valid access list have been configured.
Lefty(config-crypto-map)#set peer 192.168.1.2
Lefty(config-crypto-map)#match address 101
Lefty(config-crypto-map)#set transform-set
MYTSETNAME
Lefty(config-crypto-map)#^Z
• Step 5. – Apply
• Lefty#conf t
Lefty(config)#int fastEthernet 1/0
Lefty(config-if)#crypto map LEFTY_TO_RIGHTY
Lefty(config)#ip route 10.2.2.0 255.255.255.0
192.168.1.2
Lefty(config)#^Z
• show crypto engine connections active