Challenge: RIP - GET-VPN - ANSWERS

This is a back-to-basics lesson rolled up with a VPN topic. This will test your understanding of Cisco's default behavior when configuring RIPv1 and RIPv2. This is the solution to my previous blogpost: https://showipintbri.blogspot.com/2018/04/challenge-rip-get-vpn.html

An excellent Cisco resource that I found very useful in preparing for this lab was:

https://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html

The Topology:

The Requirements:

1. All routers interfaces must be configured using the ip schema from the topology diagram.

2. You must run RIP protocol between all routers and no other routing protocol

• Advertise all your connected networks
• R2 must run RIP version 2
• All other routers must run RIP version 1, and should see R2's loopback with its real mask

3. You must have routes representing all the subnets(classful or better) from the topology in all your routing tables.

4. configure GET VPN between all routers WAN interfaces

• R1 must be the key-server

5. pings sourced from the loopbacks of the group members to other group members must be encrypted

• All other traffic should not be encrypted.

6. You should have full reachability to all loopbacks in the topology 

My Solution:

The Configs:

R1: int fa0/0 ip add 10.0.0.1 255.255.255.0 no shut int lo 1 ip add 1.1.1.1 255.255.255.255 no shut router rip network 10.0.0.1 network 1.1.1.1 no auto-summary exit R2: int fa0/0 ip add 10.0.0.2 255.255.255.0 ip rip receive 1 2 no shut int lo 2 ip add 2.2.2.2 255.255.255.255 no shut router rip network 10.0.0.2 network 2.2.2.2 version 2 no auto-summary R3: int fa0/0 ip add 10.0.0.3 255.255.255.0 no shut int lo 2 ip add 2.2.2.2 255.255.255.255 no shut router rip network 10.0.0.3 network 3.3.3.3 no auto-summary R4: int fa0/0 ip add 10.0.0.4 255.255.255.0 no shut int lo 2 ip add 4.4.4.4 255.255.255.255 no shut router rip network 10.0.0.4 network 4.4.4.4 no auto-summary

GET-VPN Configs:

Key Server: crypto key generate rsa modulus 1024 label GETVPN_KEY ip access-list extended 100  permit icmp any any crypto isakmp policy 10  encr 3des  hash md5  authentication pre-share  group 2 crypto isakmp key CISCO address 0.0.0.0 crypto ipsec transform-set GETVPN_TRANS esp-3des esp-md5-hmac crypto ipsec profile GETVPN_PROFILE  set transform-set GETVPN_TRANS crypto gdoi group GETVPN_GROUP  identity number 123  server local   rekey authentication mypubkey rsa GETVPN_KEY   rekey transport unicast   sa ipsec 1    profile GETVPN_PROFILE    match address ipv4 100    replay counter window-size 64   address ipv4 10.0.0.1 Group Members: crypto isakmp policy 10  encr 3des  hash md5  authentication pre-share  group 2 crypto isakmp key CISCO address 10.0.0.1 crypto ipsec transform-set GETVPN_TRANS esp-3des esp-md5-hmac crypto ipsec profile GETVPN_PROFILE  set transform-set GETVPN_TRANS crypto gdoi group GETVPN_GROUP  identity number 123  server address ipv4 10.0.0.1 crypto map GETVPN_MAP 10 gdoi  set group GETVPN_GROUP int fa0/0 crypto map GETVPN_MAP exit

Verification:

foreach address { 1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4 } { ping $address repeat 1 source 1.1.1.1 }

! Change the 'source x.x.x.x' to the appropriate source IP