CSR1

#Definition of keyrings
CSR1(config)#crypto ikev2 keyring MyRing
CSR1(config-ikev2-keyring)#peer Site2
CSR1(config-ikev2-keyring-peer)#address 110.95.22.2
CSR1(config-ikev2-keyring-peer)#pre-shared-key local site1
CSR1(config-ikev2-keyring-peer)#pre-shared-key remote site2

crypto ikev2 keyring MyRing
 peer Site2
  address 110.95.22.2
  pre-shared-key local site1
  pre-shared-key remote site2
 !

#IKEv2 proposal
CSR1(config)#crypto ikev2 proposal Site2
CSR1(config-ikev2-proposal)#encryption aes-cbc-256
CSR1(config-ikev2-proposal)#integrity sha256
CSR1(config-ikev2-proposal)#prf sha256
CSR1(config-ikev2-proposal)#group 24

CSR1#sh crypto ikev2 proposal Site2
 IKEv2 proposal: Site2
     Encryption : AES-CBC-256
     Integrity  : SHA256
     PRF        : SHA256
     DH Group   : DH_GROUP_2048_256_MODP/Group 24

#IKEv2 policy
CSR1(config)#crypto ikev2 policy Site2
CSR1(config-ikev2-policy)#proposal Site2

CSR1#sh crypto ikev2 policy Site2
 IKEv2 policy : Site2
      Match fvrf  : global
      Match address local : any
      Proposal    : Site2


#IKEv2 Profile
CSR1(config)#crypto ikev2 profile Site2
CSR1(config-ikev2-profile)#match address local 197.65.213.2
CSR1(config-ikev2-profile)#match identity remote address 110.95.22.2
CSR1(config-ikev2-profile)#authentication local pre-share
CSR1(config-ikev2-profile)#authentication remote pre-share
CSR1(config-ikev2-profile)#keyring local MyRing

CSR1#sh crypto ikev2 profile Site2

IKEv2 profile: Site2
 Ref Count: 1
 Match criteria:
  Fvrf: global
  Local address/interface:
   197.65.213.2
  Identities:
   address 110.95.22.2 255.255.255.255
  Certificate maps: none
 Local identity: none
 Remote identity: none
 Local authentication method: pre-share
 Remote authentication method(s): pre-share
 EAP options: none
 Keyring: MyRing
 Trustpoint(s): none
 Lifetime: 86400 seconds
 DPD: disabled
 NAT-keepalive: disabled
 Ivrf: none
 Virtual-template: none
 mode auto: none
 AAA AnyConnect EAP authentication mlist: none
 AAA EAP authentication mlist: none
 AAA Accounting: none
 AAA group authorization: none
 AAA user authorization: none

#Transofrm set
CSR1(config)#crypto ipsec transform-set TS1 esp-aes 256

CSR1#sh  crypto ipsec transform-set
Transform set default: { esp-aes esp-sha-hmac  }
   will negotiate = { Transport,  },

Transform set TS1: { esp-256-aes  }
   will negotiate = { Tunnel,  },

#Interesting Traffic
CSR1(config)#ip access-list extended IT
CSR1(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

#Crypto Map
CSR1(config)#crypto map Crypto_Map 100 ipsec-isakmp
CSR1(config-crypto-map)#set peer 110.95.22.2
CSR1(config-crypto-map)#set ikev2-profile Site2
CSR1(config-crypto-map)#set transform-set TS1
CSR1(config-crypto-map)#match address IT

CSR1(config)#int GigabitEthernet1
CSR1(config-if)#crypto map Crypto_Map

CSR1#sh crypto map
Crypto Map IPv4 "Crypto_Map" 100 ipsec-isakmp
        Peer = 110.95.22.2
        IKEv2 Profile: Site2
        Extended IP access list IT
            access-list IT permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
        Current peer: 110.95.22.2
        Security association lifetime: 4608000 kilobytes/3600 seconds
        Responder-Only (Y/N): N
        PFS (Y/N): N
        Mixed-mode : Disabled
        Transform sets={
                TS1:  { esp-256-aes  } ,
        }
        Interfaces using crypto map Crypto_Map:
                GigabitEthernet1

        Interfaces using crypto map NiStTeSt1:

#NAT
CSR1(config)#ip access-list extended NAT
CSR1(config-ext-nacl)#10 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
CSR1(config-ext-nacl)#20 permit ip 192.168.1.0 0.0.0.255 any
ip nat inside source list NAT interface GigabitEthernet1 overload