switch(config)#ip security
switch(config-ipsec)#ike policy ike-peerRtr
switch(config-ipsec-ike)#version 1

1. Use this command to enter IP security mode.

   switch(config)#ip security

2. Create an IKE Policy used to communicate with the peer to establish IKE Phase 1. There is an option of configuring multiple IKE policies.
   The default IKE Policy values are:

   • Encryption - AES256
   • Integrity - SHA256
   • DH group - Group 14
   • IKE lifetime - 8 hours

   switch(config-ipsec)#ike policy ike-vrouter 
   switch(config-ipsec-ike)#encryption aes256 
   switch(config-ipsec-ike)#integrity sha256 
   switch(config-ipsec-ike)#dh-group 24
   switch(config-ipsec-ike)#version 2 
   switch(config-ipsec-ike)#exit
   switch(config-ipsec)#ike policy ike-default 
   switch(config-ipsec-ike)#version 2 
   switch(config-ipsec-ike)#exit

3. If the router is behind a NAT, configure the local-id with the local public IP address.

   switch(config-ipsec-ike)#local-id <public ip address>

4. Create an IPsec Security Association policy used in the data path for encryption and integrity. The is an option of enabling Perfect Forward Secrecy by configuring a DH group to the SA.
   In this example, AES256 is used for encryption, SHA 256 is used for integrity, and Perfect Forward Secrecy is enabled (the DH group is 14).

   switch(config-ipsec)#sa policy sa-vrouter 
   switch(config-ipsec-sa)#esp encryption aes256 
   switch(config-ipsec-sa)#esp integrity sha256 
   switch(config-ipsec-sa)#pfs dh-group 14 
   switch(config-ipsec-sa)#sa lifetime 2 
   switch(config-ipsec-sa)#exit
   switch(config-ipsec)#sa policy sa-default 
   switch(config-ipsec-sa)#exit

5. Bind or associate the IKE and SA policies together using a IPsec profile. Provide a shared-key, which must be common on both peers. The default profile assigns default values for all parameters that are not explicitly configured in the other profiles.
   In this example, tunnel mode is set to transport. The IKE Policy ike-peerRtr and SA Policy sa-peerRtr are applied to profile peer-Rtr. Dead Peer Detection is enabled and configured to delete the connection when the peer is down for more than 50 seconds. The peer (peer-Rtr) is set to be the responder.

   switch(config-ipsec)#profile default
   switch(config-ipsec-profile)#ike-policy ikedefault
   switch(config-ipsec-profile)#sa-policy sadefault
   switch(config-ipsec-profile)#shared-key arista
   
   switch(config-ipsec)#profile peer-Rtr
   switch(config-ipsec-profile)#ike-policy ike-peerRtr
   switch(config-ipsec-profile)#sa-policy sa-peerRtr
   switch(config-ipsec-profile)#dpd 10 50 clear
   switch(config-ipsec-profile)#connection add
   switch(config-ipsec-profile)#mode transport

6. Configure the WAN interface to be the underlying interface for the tunnel. Specify an L3 address for the tunnel. If the L3 address is not specified, the vEOS Router cannot route packets using the tunnel.

   switch(config)#interface Et1 
   switch(config-if-Et1)#no switchport
   switch(config-if-Et1)#ip address 1.0.0.1/24 
   switch(config-if-Et1)#mtu 1500

7. Apply the IPsec profile to a new tunnel interface. Create the new tunnel interface as part of this step.
   In this example, the new tunnel interface is Tunnel0. The new tunnel interface is configured to use IPsec, and the tunnel mode is set to GRE. Configure the other end of the tunnel also as a GRE-over-IPsec tunnel.

   switch(config)#interface tunnel0
   switch(config-if-Tu0)#ip address 1.0.3.1/24 
   switch(config-if-Tu0)#tunnel mode gre 
   switch(config-if-Tu0)#mtu 1400
   switch(config-if-Tu0)#tunnel source 1.0.0.1
   switch(config-if-Tu0)#tunnel destination 1.0.0.2 
   switch(config-if-Tu0)#tunnel ipsec profile vrouter

8. Create the GRE-over-IPsec tunnel interface in a VRF using the vrf forwarding command. Create the VRF, if needed, then create and configure the GRE tunnel interface. Make sure to specify the tunnel key that is unique across all tunnels.
   Note: If tunnels in different VRFs need to share the IPsec connection, specify the same source, destination, and ipsec profile.

   switch(config)#vrf definition red
   switch(config-vrf-red)#rd 1:3 
   switch(config-vrf-red)#interface tunnel0 
   switch(config-if-Tu0)#ip address 1.0.3.1/24 
   switch(config-if-Tu0)#vrf forwarding red 
   switch(config-if-Tu0)#tunnel mode gre 
   switch(config-if-Tu0)#mtu 1400
   switch(config-if-Tu0)#tunnel source 1.0.0.1
   switch(config-if-Tu0)#tunnel destination 1.0.0.2
   switch(config-if-Tu0)#tunnel key 100 
   switch(config-if-Tu0)#tunnel ipsec profile vrouter
   
   switch(config)#vrf definition blue 
   switch(config-vrf-blue)#rd 1:4 
   switch(config-vrf-blue)#interface tunnel1 
   switch(config-if-Tu1)#ip address 1.0.4.1/24 
   switch(config-if-Tu1)#vrf forwarding blue 
   switch(config-if-Tu1)#tunnel mode gre 
   switch(config-if-Tu1)#mtu 1400
   switch(config-if-Tu1)#tunnel source 1.0.0.1
   switch(config-if-Tu1)#tunnel destination 1.0.0.2
   switch(config-if-Tu1)#tunnel key 200 
   switch(config-if-Tu1)#tunnel ipsec profile vrouter
   

9. Configure the GRE-over-IPsec tunnel on the peer router.

The configuration of VTI IPsec tunnels on CSR peer router instances is almost identical to the configuration of GRE-over-IPsec tunnels on CSR peer router instances. The only difference in the configurations is tunnel mode.

switch(config)#interface Tunnel0
switch(config-if)#ip address 1.0.3.1 255.255.255.0 
switch(config-if)#tunnel source 10.3.31.30 
switch(config-if)#tunnel destination 10.2.201.149 
switch(config-if)#tunnel mode ipsec ipv4 
switch(config-if)#tunnel protection ipsec profile vrouter-ikev1-ipsec-profile

The CSR configuration to create a GRE over IPsec tunnel is similar the CloudEOS and vEOS Router setup using ikev1 version.

switch(config)#ip security
switch(config-ipsec)#ike policy ike-peerRtr
switch(config-ipsec-ike)#version 1

1. Enter the configuration terminal mode to configure IPsec.

   switch#config terminal

2. Configure a pre-shared key for the vEOS Router and CSR to authenticate each other. Create a keyring to hold the keys.

   switch(config)#crypto keyring vrouter-keyring
   switch(conf-keyring)#pre-shared-key address 1.0.0.2 key arista

3. Create an ISAKMP policy. The policy's function is to communicate with the peer to establish IKE Phase 1. In the example below, a policy with AES256 is created with the following parameters: SHA1, DH group 15, authentication pre-share, and a lifetime of 28800 seconds.

   switch(config)#crypto isakmp policy 1
   switch(config-isakmp)#encr aes 256
   switch(config-isakmp)#hash sha
   switch(config-isakmp)#authentication pre-share
   switch(config-isakmp)#group 15
   switch(config-isakmp)#lifetime 28800

4. Create an ISAKMP profile associated with the vEOS Router to match its outside IP Address and the keyring that was created earlier to identify the pre-shared secret.

   switch(config)#crypto isakmp profile vrouter-ikev1-isakmp-profile
   switch(conf-isa-prof)#keyring vrouter-keyring
   switch(conf-isa-prof)#match identity address 1.0.0.2 255.2-55.255.255
   switch(conf-isa-prof)#local-address GigabitEthernet2

5. Create the IPsec transform-set configuration settings. The transform-set defines the encryption and hash algorithm for the child/IPsec SA. This example creates a transform-set with AES cipher for the ESP encryption and SHA1 for the authentication. The mode for the IPsec is set to transport mode.

   switch(config)#crypto ipsec transform-set vrouter-tset esp-aes 256 esp-sha-hmac
   switch(cfg-crypto-trans)#mode transport

6. Create the IPsec profile which includes the transform-set, SA idle time, lifetime, and replay windows used to create the child SA.

   switch(config)#crypto ipsec profile vrouter-ikev1-ipsec-profile
   switch(ipsec-profile)#set security-association idle-time 3600
   switch(ipsec-profile)#set security-association dummy seconds 3600
   switch(ipsec-profile)#set transform-set vrouter-tset
   switch(ipsec-profile)#set isakmp-profile vroute-ikev1-isakmp-profile

7. Configure the WAN interface as the underlying interface for the tunnel. To be able to route packets, the tunnel is given an L3 IP address.

   switch(config)#interface GigabitEthernet2
   switch(config-if)#ip address 1.0.0.2 255.255.255.0
   switch(config-if)#mtu 9001
   switch(config-if)#negotiation auto

8. Apply the IPsec profile to a tunnel interface. The example creates a tunnel interface (Tunnel0) and configures the tunnel interface to use IPsec.

   switch(config-if)#exit
   switch(config)#interface Tunnel0
   switch(config-if)#ip address 1.0.3.1 255.255.255.0
   switch(config-if)#tunnel source 1.0.0.2
   switch(config-if)#tunnel destination 1.0.0.1
   switch(config-if)#tunnel protection ipsec profile vrouter-ikev1-ipsec-profile
   switch(config-if)#exit

The CSR configuration to create a GRE over IPsec tunnel is similar to the CloudEOS and vEOS Router setup using ikev2 version.

1. Enter the configuration terminal mode to configure IPsec.

   switch#configure terminal

2. Create a pre-shared key for CSR and the CloudEOS and vEOS Router to authenticate each other. Create a keyring to hold the keys. Specify the peer CloudEOS and vEOS Router under which the keys and matching IP address of peer are configured.

   switch(config)#crypto keyring vrouter-ikev2-keyring
   switch(conf-keyring)#pre-shared-key address 1.0.0.2 key arista

3. Create an IKEv2 proposal to specify the encryption, integrity, and group. In the example, it specifies AES256, SHA1, and DH group 14.

   switch(config)#crypto ikev2 proposal vrouter-ikev2-proposal
   switch(config-ikev2-proposal)#encryption aes-cbc-256
   switch(config-ikev2-proposal)#integrity sha1
   switch(config-ikev2-proposal)#group 14
   switch(config-ikev2-proposal)#exit

4. Create an IKEv2 policy and attach the proposal created in the previous step.

   switch(config)#crypto ikev2 policy vrouter-ikev2-policy 
   switch(config-ikev2-policy)#match fvrf any
   switch(config-ikev2-policy)#proposal vrouter-ikev2-proposal
   switch(config-ikev2-policy)#exit

5. Create an IKEv2 profile and specify the match identity for the remote peer's address, authentication pre-share, and the keyring that was previously created.

   switch(config)#crypto ikev2 profile vrouter-ikev2-profile
   switch(config-ikev2-profile)#match fvrf any
   switch(config-ikev2-profile)#match identity remote address 1.0.0.1 255.255.255.255
   switch(config-ikev2-profile)#authentication remote pre-share key arista
   switch(config-ikev2-profile)#authentication local pre-share key arista
   switch(config-ikev2-policy)#exit 

6. Create the IPsec transform-set configuration settings. This step is similar to the step in IKEv1 configuration. The transform-set defines the encryption and hash algorithm for the child/IPsec SA. The example creates a transform-set with AES cipher for the ESP encryption and SHA1 for the authentication. The mode for the IPsec is set to the transport mode.

   switch(config)#crypto ipsec transform-set vrouter-tset esp-aes 256 esp-sha-hmac
   switch(cfg-crypto-trans)#mode transport

7. Create the IPsec profile similar to IKEv1. This profile includes the transform-set, SA idle time, lifetime, and replay windows that are used to create the child SA and specifies the IKEv2 profile to use.

   switch(config)#crypto ipsec profile vrouter-ikev2-ipsec-profile
   switch(ipsec-profile)#set security-association idle-time 3600
   switch(ipsec-profile)#set security-association dummy seconds 3600
   switch(ipsec-profile)#set transform-set vrouter-tset
   switch(ipsec-profile)#set ikev2-profile vrouter-ikev2-profile
   switch(ipsec-profile)#exit

8. Configure the interface to use as the underlying interface for the tunnel. To be able to route packets, the tunnel is given an L3 IP address.

   switch(config)#interface GigabitEthernet2
   switch(config-if)#ip address 1.0.0.1 255.255.255.0
   switch(config-if)#negotiation auto

9. Apply the IPsec profile to a tunnel interface. The example creates a tunnel interface (Tunnel0) and configures the tunnel interface to use IPsec.

   switch(config-if)#exit
   switch(config)#interface Tunnel0
   switch(config-if)#ip address 1.0.3.1 255.255.255.0
   switch(config-if)#tunnel path-mtu-discovery
   switch(config-if)#tunnel source 1.0.0.1
   switch(config-if)#tunnel destination 1.0.0.2
   switch(config-if)#tunnel protection ipsec profile vrouter-ikev2-ipsec-profile
   switch(config-if)#exit