{"app":"simulateur-reseau","v":1,"opts":{"strictCables":false,"stpFast":true},"devices":[{"id":"D1","type":"router","model":"r-2911","name":"R1","x":150,"y":200,"powered":true,"cli":"!\nhostname R1\n!\nno ip domain-lookup\ninterface GigabitEthernet0/0\n ip address 192.168.1.1 255.255.255.0\n!\ninterface GigabitEthernet0/1\n ip address 203.0.113.1 255.255.255.252\n!\ninterface GigabitEthernet0/2\n no ip address\n shutdown\n!\nip route 0.0.0.0 0.0.0.0 203.0.113.2\n!\nline con 0\n logging synchronous\nline vty 0 4\n!","label":""},{"id":"D2","type":"router","model":"r-2911","name":"ISP","x":400,"y":100,"powered":true,"cli":"!\nhostname ISP\n!\ninterface GigabitEthernet0/0\n ip address 203.0.113.2 255.255.255.252\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.2 255.255.255.252\n!\ninterface GigabitEthernet0/2\n no ip address\n shutdown\n!\nline con 0\n logging synchronous\nline vty 0 4\n!","label":""},{"id":"D3","type":"router","model":"r-2911","name":"R2","x":650,"y":200,"powered":true,"cli":"!\nhostname R2\n!\nno ip domain-lookup\ninterface GigabitEthernet0/0\n ip address 192.168.2.1 255.255.255.0\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.1 255.255.255.252\n!\ninterface GigabitEthernet0/2\n no ip address\n shutdown\n!\nip route 0.0.0.0 0.0.0.0 198.51.100.2\n!\nline con 0\n logging synchronous\nline vty 0 4\n!","label":""},{"id":"D4","type":"pc","model":"pc-win","name":"PC-A","x":150,"y":380,"powered":true,"ifaces":[{"name":"Ethernet0","ip":"192.168.1.10","mask":"255.255.255.0","dhcp":false}],"gw":"192.168.1.1","dns":[],"domain":"","allowIcmpEcho":true,"wifi":{"ssid":"","key":""},"hosts":{},"dhcpd":{"enabled":false,"excluded":[],"pools":[]},"dnsd":{"enabled":false,"records":[],"forwarders":[]},"httpd":{"enabled":false,"https":false,"pages":{"/":{"type":"text/html; charset=utf-8","body":"<html><head><title>PC-A</title></head><body><h1>Bienvenue sur PC-A</h1><p>Serveur web du simulateur.</p></body></html>"}}},"mgmt":{"comms":[],"location":"","contact":"","syslogd":false,"trapd":false},"v6":{"ifs":[{"name":"Ethernet0","autoconf":true,"addrs":[]}],"statics":[]},"label":""},{"id":"D5","type":"pc","model":"pc-win","name":"PC-B","x":650,"y":380,"powered":true,"ifaces":[{"name":"Ethernet0","ip":"192.168.2.10","mask":"255.255.255.0","dhcp":false}],"gw":"192.168.2.1","dns":[],"domain":"","allowIcmpEcho":true,"wifi":{"ssid":"","key":""},"hosts":{},"dhcpd":{"enabled":false,"excluded":[],"pools":[]},"dnsd":{"enabled":false,"records":[],"forwarders":[]},"httpd":{"enabled":false,"https":false,"pages":{"/":{"type":"text/html; charset=utf-8","body":"<html><head><title>PC-B</title></head><body><h1>Bienvenue sur PC-B</h1><p>Serveur web du simulateur.</p></body></html>"}}},"mgmt":{"comms":[],"location":"","contact":"","syslogd":false,"trapd":false},"v6":{"ifs":[{"name":"Ethernet0","autoconf":true,"addrs":[]}],"statics":[]},"label":""}],"links":[{"a":["D1","GigabitEthernet0/1"],"b":["D2","GigabitEthernet0/0"],"type":"cross"},{"a":["D2","GigabitEthernet0/1"],"b":["D3","GigabitEthernet0/1"],"type":"cross"},{"a":["D4","Ethernet0"],"b":["D1","GigabitEthernet0/0"],"type":"cross"},{"a":["D5","Ethernet0"],"b":["D3","GigabitEthernet0/0"],"type":"cross"}],"notes":"","tpfile":{"v":1,"id":"cours-bts2-s10-ipsec","type":"decouverte","diff":3,"cat":"Cours BTS SIO — 2e année","level":"BTS SIO SISR 2e année — Bloc 2 — S10","duration":"1 h","title":"S10 — Tunnel IPsec site à site entre deux routeurs Cisco","desc":"Comparaison avec WireGuard : le même besoin (relier deux agences à travers Internet) réalisé avec IPsec (ISAKMP/IKEv1 + ESP) sur deux routeurs Cisco, avec preuve du chiffrement dans l'analyseur.","objectives":["Configurer une politique ISAKMP, une clé pré-partagée, un transform-set et une crypto map","Définir le trafic à protéger par une ACL","Prouver le fonctionnement : association de sécurité (SA), compteurs, trames ESP chiffrées"],"steps":["Deux agences (<code>192.168.1.0/24</code> et <code>192.168.2.0/24</code>) sont reliées par un « Internet » simulé (<code>203.0.113.0/30</code> et <code>198.51.100.0/30</code>). Les adresses privées ne sont pas routées sur Internet : <code>PC-A</code> ne joint pas <code>PC-B</code>.","Sur <b>R1</b>, l'ACL du trafic à protéger : <code>ip access-list extended VPN</code>, <code>permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255</code>.","Phase 1 (ISAKMP) : <code>crypto isakmp policy 10</code> avec <code>encryption aes 256</code>, <code>hash sha</code>, <code>authentication pre-share</code>, <code>group 2</code> ; puis <code>crypto isakmp key CIEL2026 address 198.51.100.1</code>.","Phase 2 (IPsec) : <code>crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac</code>, puis <code>crypto map CMAP 10 ipsec-isakmp</code> avec <code>set peer 198.51.100.1</code>, <code>set transform-set TS</code> et <code>match address VPN</code>. Appliquez-la : <code>interface gi0/1</code> puis <code>crypto map CMAP</code>.","Faites la configuration <b>symétrique sur R2</b> (pair <code>203.0.113.1</code>, ACL dans l'autre sens, même clé et mêmes paramètres : une différence empêche le tunnel de monter).","Générez du trafic (<code>ping 192.168.2.10</code> depuis PC-A) puis vérifiez : <code>show crypto isakmp sa</code> (état QM_IDLE) et <code>show crypto ipsec sa</code> (compteurs encaps/decaps).","Analyseur sur le lien R1 – ISP : filtre <code>esp</code>. Le contenu est illisible : comparez avec WireGuard. Cliquez sur « Vérifier mon travail »."],"checks":[{"t":"ping","label":"PC-A joint PC-B à travers le tunnel","from":"PC-A","to":"192.168.2.10","wait":3000},{"t":"cli","label":"R1 : ISAKMP SA établie (QM_IDLE)","dev":"R1","cmd":"show crypto isakmp sa","match":"QM_IDLE"},{"t":"cli","label":"R1 : paquets chiffrés (encaps)","dev":"R1","cmd":"show crypto ipsec sa","match":"#pkts encaps: [1-9]"},{"t":"cli","label":"R2 : paquets déchiffrés (decaps)","dev":"R2","cmd":"show crypto ipsec sa","match":"#pkts decaps: [1-9]"},{"t":"cli","label":"R1 : crypto map appliquée sur gi0/1","dev":"R1","cmd":"show running-config","match":"interface GigabitEthernet0/1[\\s\\S]*?crypto map CMAP"},{"t":"cli","label":"R1 : chiffrement AES 256 et clé pré-partagée","dev":"R1","cmd":"show crypto isakmp policy","match":"aes[\\s\\S]*Pre-Shared"}],"solution":{"app":"simulateur-reseau","v":1,"opts":{"strictCables":false,"stpFast":true},"devices":[{"id":"D1","type":"router","model":"r-2911","name":"R1","x":150,"y":200,"powered":true,"cli":"!\nhostname R1\n!\nno ip domain-lookup\ncrypto isakmp policy 10\n encryption aes 256\n authentication pre-share\n group 2\n!\ncrypto isakmp key CIEL2026 address 198.51.100.1\n!\ncrypto ipsec transform-set TS esp-aes 256 esp-sha-hmac\n!\ncrypto map CMAP 10 ipsec-isakmp\n set peer 198.51.100.1\n set transform-set TS\n match address VPN\n!\ninterface GigabitEthernet0/0\n ip address 192.168.1.1 255.255.255.0\n!\ninterface GigabitEthernet0/1\n ip address 203.0.113.1 255.255.255.252\n crypto map CMAP\n!\ninterface GigabitEthernet0/2\n no ip address\n shutdown\n!\nip route 0.0.0.0 0.0.0.0 203.0.113.2\n!\nip access-list extended VPN\n permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255\n!\nline con 0\n logging synchronous\nline vty 0 4\n!","label":""},{"id":"D2","type":"router","model":"r-2911","name":"ISP","x":400,"y":100,"powered":true,"cli":"!\nhostname ISP\n!\ninterface GigabitEthernet0/0\n ip address 203.0.113.2 255.255.255.252\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.2 255.255.255.252\n!\ninterface GigabitEthernet0/2\n no ip address\n shutdown\n!\nline con 0\n logging synchronous\nline vty 0 4\n!","label":""},{"id":"D3","type":"router","model":"r-2911","name":"R2","x":650,"y":200,"powered":true,"cli":"!\nhostname R2\n!\nno ip domain-lookup\ncrypto isakmp policy 10\n encryption aes 256\n authentication pre-share\n group 2\n!\ncrypto isakmp key CIEL2026 address 203.0.113.1\n!\ncrypto ipsec transform-set TS esp-aes 256 esp-sha-hmac\n!\ncrypto map CMAP 10 ipsec-isakmp\n set peer 203.0.113.1\n set transform-set TS\n match address VPN\n!\ninterface GigabitEthernet0/0\n ip address 192.168.2.1 255.255.255.0\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.1 255.255.255.252\n crypto map CMAP\n!\ninterface GigabitEthernet0/2\n no ip address\n shutdown\n!\nip route 0.0.0.0 0.0.0.0 198.51.100.2\n!\nip access-list extended VPN\n permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255\n!\nline con 0\n logging synchronous\nline vty 0 4\n!","label":""},{"id":"D4","type":"pc","model":"pc-win","name":"PC-A","x":150,"y":380,"powered":true,"ifaces":[{"name":"Ethernet0","ip":"192.168.1.10","mask":"255.255.255.0","dhcp":false}],"gw":"192.168.1.1","dns":[],"domain":"","allowIcmpEcho":true,"wifi":{"ssid":"","key":""},"hosts":{},"dhcpd":{"enabled":false,"excluded":[],"pools":[]},"dnsd":{"enabled":false,"records":[],"forwarders":[]},"httpd":{"enabled":false,"https":false,"pages":{"/":{"type":"text/html; charset=utf-8","body":"<html><head><title>PC-A</title></head><body><h1>Bienvenue sur PC-A</h1><p>Serveur web du simulateur.</p></body></html>"}}},"mgmt":{"comms":[],"location":"","contact":"","syslogd":false,"trapd":false},"v6":{"ifs":[{"name":"Ethernet0","autoconf":true,"addrs":[]}],"statics":[]},"label":""},{"id":"D5","type":"pc","model":"pc-win","name":"PC-B","x":650,"y":380,"powered":true,"ifaces":[{"name":"Ethernet0","ip":"192.168.2.10","mask":"255.255.255.0","dhcp":false}],"gw":"192.168.2.1","dns":[],"domain":"","allowIcmpEcho":true,"wifi":{"ssid":"","key":""},"hosts":{},"dhcpd":{"enabled":false,"excluded":[],"pools":[]},"dnsd":{"enabled":false,"records":[],"forwarders":[]},"httpd":{"enabled":false,"https":false,"pages":{"/":{"type":"text/html; charset=utf-8","body":"<html><head><title>PC-B</title></head><body><h1>Bienvenue sur PC-B</h1><p>Serveur web du simulateur.</p></body></html>"}}},"mgmt":{"comms":[],"location":"","contact":"","syslogd":false,"trapd":false},"v6":{"ifs":[{"name":"Ethernet0","autoconf":true,"addrs":[]}],"statics":[]},"label":""}],"links":[{"a":["D1","GigabitEthernet0/1"],"b":["D2","GigabitEthernet0/0"],"type":"cross"},{"a":["D2","GigabitEthernet0/1"],"b":["D3","GigabitEthernet0/1"],"type":"cross"},{"a":["D4","Ethernet0"],"b":["D1","GigabitEthernet0/0"],"type":"cross"},{"a":["D5","Ethernet0"],"b":["D3","GigabitEthernet0/0"],"type":"cross"}],"notes":""}}}