| 6.6 |  | Configure Site-to-Site IPSec VPN using Digital Certificates |
| 6.6.2 |  | Task 1 - Prepare for IKE and IPSec |

| Successful implementation of an IPSec network requires advance planning before beginning configuration of individual routers. In task 1, define the IPSec security policy based on the overall company security policy. Some planning steps follow.

Step 1 and Step 2 are covered in detail in this module. The other steps shown in Figure and listed below are presented for review purposes, and are covered earlier in the module.

Step 1 Plan for CA support
Determine the CA server details. This includes variables like the type of CA server to be used, the IP address, and the CA administrator contact information.

Step 2 Determine IKE phase one policy
Determine the IKE policies between IPSec peers based on the number and location of the peers.

Step 3 Determine IPSec, IKE phase two policy
Identify IPSec peer details such as IP addresses and IPSec modes. Then configure crypto maps to gather all IPSec policy details together.

Step 4 Check the current configuration
Use the

show run, show crypto isakmp [policy], and show crypto map commands, and the many other show commands that are covered later in this module.

Step 5 Ensure the network works without encryption
Ensure that testing basic connectivity has been achieved between IPSec peers using the desired IP services before configuring IPSec. The

ping command can be used to check basic connectivity.

Step 6 Ensure that access lists are compatible with IPSec
Ensure that perimeter routers and the IPSec peer router interfaces permit IPSec traffic. Enter the

show access-lists command can be used.

| Media Activity Demonstration Activity: Configuring CA Support In this activity, students will learn to plan for CA support.