![](/images/new-backgrounds/1187383/187383141x1.webp)
VPN
VPN Site-to-Site Sample Configuration
The following VPN topology, shown in Figure
Figure 3-5 VPN Site-to-Site Topology
| Central Site |
| 112.16.72.2 |
| 112.16.244.9 |
| |
|
|
| |
112.16.1.221 | Branch Sites | ||
|
| XSR | |
|
|
| 112.16.76.2 |
XSR | Firewall | 112.16.244.7 |
|
| 112.16.244.10 | XSR |
|
| Gateway IP address |
| |
| for all remote sites |
| 112.16.80.2 |
|
|
| |
|
| 112.16.244.5 |
|
The following script configures the VPN topology shown in Figure
Generate Master Encryption Key
If you have not already generated a master encryption key, you must do so now to configure th6e VPN. A master key need only be generated once.
Caution: The master encryption key is stored in hardware, not Flash, and you cannot read the key - only overwrite the old key by writing a new one. To ensure router security, it is critical not to compromise the key. There are situations where you may want to keep the key, for example, to save the user database
Generate the master key:
XSR(config)#crypto key master generate
New key is 2173 4521 3764 2ff5 163b 4bdf fe92 dbc1 1232 ffe0 f8d9 3649
Configure Access Control Lists
ACL 101 configured below is strongly restrictive in denying all but IKE traffic
XSR Getting Started Guide