The first five commands are used to configure IPSec Phase 1 (ISAKMP Policy). Here is the details of each command used above:
+ crypto isakmp policy 10 This command creates ISAKMP policy number 10. You can create multiple policies, for example 7, 8, 9 with different configuration. Routers participating in Phase 1 negotiation tries to match a ISAKMP policy matching against the list of policies one by one. If any policy is matched, the IPSec negotiation moves to Phase 2.
+ hash md5 MD5 algorithm will be used.
+ authentication pre-share Authentication method is pre-shared key.
+ group 2 Diffie-Hellman group to be used is group 2.
+ encryption 3des 3DES encryption algorithm will be used for Phase 1.
To complete phase 1 we need one additional command which is missing in the exhibit:
+ crypto isakmp key cisco address <peer-address> The Phase 1 password is cisco and remote peer IP address is 10.1.1.1 The next two command lines are used to configure IPSec Phase 2 (Transform Set):
+ crypto ipsec transform-set <transform-set-name> Creates transform-set called <transform-set- name>
+ esp-des ESP IPSec protocol with the 56-bit Data Encryption Standard (DES) encryption algorithm will be used
+ esp-md5-hmac ESP with the MD5 (HMAC variant) authentication algorithm will be used.
+ mode transport: only encrypts the payload and ESP trailer or
+ mode tunnel: encrypts the IP header of the ENTIRE packet
We should configure the key with "address 0.0.0.0 0.0.0.0" (means remote peer is any -> any destination can try to negotiate with this router). While the hub's public IP address is known we must keep in mind that R2 and R3 can build dynamic VPN tunnel between them. Taking into consideration that their public IP address is dynamic it is imperative to use 0.0.0.0 0.0.0.0 for the remote peer.