#static vti

This is an example of a Static VTI configuration:

See above topology, same as last config ensure that both “sites” have internet connection to the ISP router.

Below is the configuration used, ensure both sides are configured correctly with the same configuration:

From Configuration Terminal

crypto isakmp policy 1 authentication pre-share encryption aes hash sha group 5 lifetime 1800 exit crypto isakmp key cisco add 0.0.0.0 crypto ipsec transform-set t-set esp-aes esp-sha-hmac mode tunnel exit crypto ipsec profile cisco set transform-set t-set exit interface tunnel 0 %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down ip add 192.168.1.2 255.255.255.0 tunnel mode ipsec ipv4 tunnel protection ipsec profile cisco exit %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON interface tunnel 0 ip ospf 10 area 0 exit router ospf 10 network 192.168.0.0 0.0.255.255 area 0 exit interface tunnel0 tunnel source fa0/0 tunnel destination 102.1.1.100 exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up %OSPF-5-ADJCHG: Process 10, Nbr 102.1.1.100 on Tunnel0 from LOADING to FULL, Loading Done

To Confirm configuration

R1#show crypto ipsec sa

interface: Tunnel0    Crypto map tag: Tunnel0-head-0, local addr 101.1.1.100

  protected vrf: (none)   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)   current_peer 102.1.1.100 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 40, #pkts encrypt: 40, #pkts digest: 40    #pkts decaps: 39, #pkts decrypt: 39, #pkts verify: 39    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 0, #recv errors 0

    local crypto endpt.: 101.1.1.100, remote crypto endpt.: 102.1.1.100     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1     current outbound spi: 0x33306896(858810518)     PFS (Y/N): N, DH group: none

    inbound esp sas:      spi: 0x15FCFCCD(368901325)        transform: esp-aes esp-sha-hmac ,        in use settings ={Tunnel, }        conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4297365/3396)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE(ACTIVE)

    inbound ah sas:

    inbound pcp sas:

    outbound esp sas:      spi: 0x33306896(858810518)        transform: esp-aes esp-sha-hmac ,        in use settings ={Tunnel, }        conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4297365/3396)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE(ACTIVE)

    outbound ah sas:

    outbound pcp sas:

R1#show crypto engine connections active Crypto Engine Connections