Cisco IOS XE

This tutorial contains a configuration example for setting up an IPsec tunnel between Cisco IOS XE and Cloudflare. For this tutorial, the tested Cisco IOS XE software was version 17.03.07.

You should replace peer addresses with the anycast IP addresses assigned to your account. For example:

• Anycast 01: 162.159.###.###
• Anycast 02: 172.64.###.###

The following is a Cisco IOS XE configuration example:

crypto ikev2 proposal CF_MAGIC_WAN_IKEV2_PROPOSAL
 encryption aes-cbc-256
 integrity sha512 sha384 sha256
 group 14
!
crypto ikev2 policy CF_MAGIC_WAN_IKEV2_POLICY
 match fvrf any
 proposal CF_MAGIC_WAN_IKEV2_PROPOSAL
!
crypto ikev2 keyring CF_MAGIC_WAN_KEYRING
 peer GCP_CSR_IPSEC01
  address 162.159.###.###
  pre-shared-key hbGnJzFMqwltb###############BapXCOwsGZz2NMg
 !
 peer GCP_CSR_IPSEC02
  address 172.64.###.###
  pre-shared-key 1VscPp0LPFAcZ###############HOdN-1cUgKVduL4
 !
!
!
crypto ikev2 profile CF_MAGIC_WAN_01
 match identity remote address 162.159.###.### 255.255.255.255
 identity local fqdn ad329f56###############bbe898c0a0.33145236.ipsec.cloudflare.com
 authentication remote pre-share
 authentication local pre-share
 keyring local CF_MAGIC_WAN_KEYRING
 no config-exchange request
!
crypto ikev2 profile CF_MAGIC_WAN_02
 match identity remote address 172.64.###.### 255.255.255.255
 identity local fqdn 83f9c418###############29b3f97049.33145236.ipsec.cloudflare.com
 authentication remote pre-share
 authentication local pre-share
 keyring local CF_MAGIC_WAN_KEYRING
 no config-exchange request
!
!
!
!
crypto ipsec profile CF_MAGIC_WAN_01
 set security-association lifetime kilobytes disable
 set security-association replay disable
 set pfs group14
 set ikev2-profile CF_MAGIC_WAN_01
!
crypto ipsec profile CF_MAGIC_WAN_02
 set security-association lifetime kilobytes disable
 set security-association replay disable
 set pfs group14
 set ikev2-profile CF_MAGIC_WAN_02
!
!
!
!
interface Tunnel101
 ip address 10.252.2.35 255.255.255.254
 ip mtu 1450
 ip tcp adjust-mss 1350
 tunnel source 10.141.0.9
 tunnel mode ipsec ipv4
 tunnel destination 162.159.###.###
 tunnel path-mtu-discovery
 tunnel protection ipsec profile CF_MAGIC_WAN_01
!
interface Tunnel102
 ip address 10.252.2.37 255.255.255.254
 ip mtu 1450
 ip tcp adjust-mss 1350
 tunnel source 10.141.0.9
 tunnel mode ipsec ipv4
 tunnel destination 172.64.###.###
 tunnel path-mtu-discovery
 tunnel protection ipsec profile CF_MAGIC_WAN_02
!
interface GigabitEthernet1
 ip address dhcp
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 10.10.0.35 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid

Diagnostic output: show crypto session detail

cisco-csr1000v#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
R - IKE Auto Reconnect, U - IKE Dynamic Route Update
S - SIP VPN

Interface: Tunnel101
Profile: CF_MAGIC_WAN_01
Uptime: 00:15:16
Session status: UP-ACTIVE
Peer: 162.159.###.### port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 162.159.###.###
      Desc: (none)
  Session ID: 6
  IKEv2 SA: local 10.141.0.9/500 remote 162.159.###.###/500 Active
          Capabilities:(none) connid:1 lifetime:23:44:44
  IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 28110 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2684
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2684

Interface: Tunnel102
Profile: CF_MAGIC_WAN_02
Uptime: 00:14:59
Session status: UP-ACTIVE
Peer: 172.64.###.### port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 172.64.###.###
      Desc: (none)
  Session ID: 7
  IKEv2 SA: local 10.141.0.9/500 remote 172.64.###.###/500 Active
          Capabilities:(none) connid:2 lifetime:23:45:01
  IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 27586 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2701
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2701

Diagnostic output: show crypto session remote <ANYCAST 01> detail

cisco-csr1000v#show crypto session remote 162.159.###.### detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
R - IKE Auto Reconnect, U - IKE Dynamic Route Update
S - SIP VPN

Interface: Tunnel101
Profile: CF_MAGIC_WAN_01
Uptime: 00:15:45
Session status: UP-ACTIVE
Peer: 162.159.###.### port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 162.159.###.###
      Desc: (none)
  Session ID: 6
  IKEv2 SA: local 10.141.0.9/500 remote 162.159.###.###/500 Active
          Capabilities:(none) connid:1 lifetime:23:44:15
  IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 29000 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2655
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2655

Diagnostic output: show crypto session remote <ANYCAST 02> detail

cisco-csr1000v#show crypto session remote 172.64.###.### detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
R - IKE Auto Reconnect, U - IKE Dynamic Route Update
S - SIP VPN

Interface: Tunnel102
Profile: CF_MAGIC_WAN_02
Uptime: 00:17:10
Session status: UP-ACTIVE
Peer: 172.64.###.### port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 172.64.###.###
      Desc: (none)
  Session ID: 7
  IKEv2 SA: local 10.141.0.9/500 remote 172.64.###.###/500 Active
          Capabilities:(none) connid:2 lifetime:23:42:50
  IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 31639 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2569
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/2569

Troubleshooting

If you notice connectivity issues after rebooting your Cisco router, your IPsec Security Associations (SAs) might be out of sync. Cisco recommends that you enable the Invalid Security Parameter Index (SPI) recovery feature to solve this issue. To do so, add the following lines to your configuration file:

conf t
crypto isakmp invalid-spi-recovery
exit

Refer to Cisco’s documentation ↗ for more information.