Create an IPsec VPN tunnel using Packet Tracer - CCNA Security

1. Starting configurations for R1, ISP, and R3. Paste to global config mode :
hostname R1
interface g0/1
ip address 192.168.1.1 255.255.255.0
no shut
interface g0/0
ip address 209.165.100.1 255.255.255.0
no shut
exit
ip route 0.0.0.0 0.0.0.0 209.165.100.2

hostname ISP
interface g0/1
ip address 209.165.200.2 255.255.255.0
no shut
interface g0/0
ip address 209.165.100.2 255.255.255.0
no shut
exit

hostname R3
interface g0/1
ip address 192.168.3.1 255.255.255.0
no shut
interface g0/0
ip address 209.165.200.1 255.255.255.0
no shut
exit
ip route 0.0.0.0 0.0.0.0 209.165.200.2

2. Make sure routers have the security license enabled:
license boot module c1900 technology-package securityk9

3. Configure IPsec on the routers at each end of the tunnel (R1 and R3)
!R1
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key secretkey address 209.165.200.1
!
crypto ipsec transform-set R1-R3 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp
set peer 209.165.200.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set R1-R3
match address 100
!
interface GigabitEthernet0/0
crypto map IPSEC-MAP
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255

!R3
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key secretkey address 209.165.100.1
!
crypto ipsec transform-set R3-R1 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp
set peer 209.165.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set R3-R1
match address 100
!
interface GigabitEthernet0/0
crypto map IPSEC-MAP
!
access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255

[KLOYT]

no one ever has able to explain ipsec like you on YouTube, Hats off.

[joehurst]

@danscourses - I used your videos 14 years ago whilst doing my degree, I then used them when I was teaching, and the learners loved the simplicity of your approach and now I find myself reminding myself of how to do the odd thing which I have not done in a while - and here I am.

How you have not got more views I do not know - you should.

Amazing support from you.

Thanks

[dlcrdz]

I admire your teaching method, Dan...I appreciate that you don't rush through your tutorials. Packet Tracer has become a kind of video game to me. Please keep up the great work. Thank you!

[MrSATYAZ]

Hello sir, your fan from indonesia here.
Thx to your videos, i passed ccna rs with 912 and now have a full time job in network engineering.

You are a life-saver instructor, make a difficult subject to be easy while keeping it practical.
Please keep making video like this, i just want you to know, your videos are life-changer, for me and for other students around the world!

[randymercado]

This is a must to follow if you are new to networking or need to brush-up your skills. doesn't talk too much, cool, and explains things in proper order.

[jesusinirastafari]

Hey I am CCNA Security and you have explained everything so clearly, thank you very much mate from Costa Rica excellent

[scott]

I love this guy. His explanations are clear, precise and so easy to absorb. His knowledge on networking is right up there with the best!

[leonsaw]

Thank you so much sir. You totally saved one university student from crying in the corner and can't sleep for his networking assignment!!

[dannythomas]

thanks for going slowly and showing, so many people on Utube talk about the whole lot and show 16 seconds of actual config at the end.

[marcooconnor]

Great Video.
Good to remember that certain items in the Crypto Policy MUST match on the other side, but not all. These are
1.Hash 2. Encryption 3. Authentication 4. Diffie-Hellman Group number

[KaranAroraItronix]

Thanks. Your configuration is 100% working and I tested on Packet Tracer 8.3

[zeeshan_shaheen]

Greetings from Kashmir.
This video has helped me a lot in understanding this concept. I've almost watched 10 - 15 about the same but No one has explained the configuration part, like you did.
Thanks a lot

[theodorenixon]

I know the video is two years old but, I must say the information is very well put together. Thanks Dan!

[slamtoo]

I love that the video was watched from almost all over the world.
Thank you Professor for sharing the knowledge.
Very well explained.

[Harun]

Very Good Explain my Friend. I am net engineer working ISP. I have ccna, ccnp but i never seen good explain Ipsec like you)

[tracysuttles]

Dan thank you so much. Im prepping for an interview as a Network Admin at what i would consider my dream company to work for here in Atlanta. Im determined to demonstrate this ability to them will blow them away. Thank you for your patience and clear direction. I set mine in in PT and it works just as you said!! Thanks again!

[scottsparling]

I was just watching a video embedded in the ENSA Cisco text about IPSec in ch 8, and I swear to god it's you; sounds EXACTLY like you

[GTCG]

Great video and straight to the point. Following this guide gives some more insight in how IPSEC VPN tunnels work under the hood and should give you some ability to answer technical questions on the job. Thanks!

[returnMarcco]

Thank you very much. You would kill it doing an asmr channel Dan, your voice is as smooth as butter.

[tewodroslemma]

Thank you Mr. Danscourses I would love to appreciate the amount of work and time that you put into making your teaching on ipsec vpn tunnel using packet tracer. indeed almost all of your teaching in every area of cisco environment, it is very short of incredibly informative and interesting to learn it easily. Many thanks once again for making time in your busy schedule give us awesome teaching. God bless you!