A Site at IOS IPSEC VPN and EIGRP

Similar Questions

• IOS IPSEC VPN with NAT - translation problem

  I'm having a problem with IOS IPSEC VPN configuration.

  /*

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto keys TEST123 address 205.xx.1.4

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac CHAIN

  !

  !

  Map 10 CRYPTO map ipsec-isakmp crypto

  the value of 205.xx.1.4 peer

  transformation-CHAIN game

  match address 115

  !

  interface FastEthernet0/0

  Description FOR the EDGE ROUTER

  IP address 208.xx.xx.33 255.255.255.252

  NAT outside IP

  card crypto CRYPTO-map

  !

  interface FastEthernet0/1

  INTERNAL NETWORK description

  IP 10.15.2.4 255.255.255.0

  IP nat inside

  access-list 115 permit 192.xx.xx.128 0.0.0.3 ip 172.xx.1.0 0.0.0.3

  */

  (This configuration is incomplete / NAT configuration needed)

  Here is the solution that I'm looking for:

  When a session is initiated from the "internal network" to the "distance IPSEC - 172.xx.1.0/30 ' network I want the address scheme '10.15.0.0/16' NAT translation deals with '192.xx.xx.128/30' before forwarding via the IPSEC VPN Tunnel.

  For more information, see "SCHEMA ATTACHED".

  Any help is greatly appreciated!

  Thank you

  Clint Simmons

  Network engineer

  You can try the following NAT + route map approach (method 2 in this link)

  http://www.Cisco.com/en/us/Tech/tk648/tk361/technologies_tech_note09186a0080093fca.shtml

  Thank you

  Raja K

• IPsec vpn and Anyconnect is denied by the ACL (unknown)

  I am trying to configure IPsec VPN and I used the wizard of asdm (asdm version 8.4, ASA version 8.4). At the moment he is not in production and is in a test environment. Whenever I try to VPN in I get an error on the asdm syslog saying "TCP access denied by ACL from x.x.x.122 to outside:x.x.x.225/443. So I allowed all VPN traffic to this IP address that is currently the IP address as the external interface. My acl is as follows:

  outside_in list extended access permit tcp any interface outside eq https

  outside_in list extended access permit tcp any host x.x.x.225 eq https

  Access-group outside_in in external interface

  Yet, I still get the same exact error. The strange thing about this error is that it does not give me the specific ACL that denies access. There is no other access lists that could possibly block this traffic.

  No idea what could be the cause this problem because I am confused.

  So far, if you have configured following does not require an acl.

  ciscoasa(config)#webvpn
  ciscoasa(config-webvpn)#enable outside
  ciscoasa(config-webvpn)#svc enable
  You can post configuration here someone can have a look on that.
  Thanks
  Ajay
  
  
  
  

• The IPSec VPN and routing

  Hello

  I was polishing my PSAB on since I am currently in a job where I can't touch a lot of this stuff.  By a laboratory set up a site to IPSec VPN between two routers IOS.

  For example:

  https://www.Cisco.com/en/us/products/ps9422/products_configuration_example09186a0080ba1d0a.shtml

  The routers must specify how to route to the protected network.  Although I guess they could just use a default route to 172.17.1.2 as well.

  for example IP road 10.10.10.0 255.255.255.0 172.17.1.2

  172.17.1.2 won't have the slightest clue as to how to route for 10.10.10.0

  Even in an example with a tunnel between the ASA and the router IOS ASA failed to indicate a direct route to the subnet protected from 10.20.10.0, but it must still have a default route configuration. (https://www.cisco.com/en/US/products/ps5855/products_configuration_example09186a0080a9a7a3.shtml#CLI)

  So it is basically saying, to reach the protected subnet to resolve the next hop on a device that has no idea where this subnet is anyway.  Shouldn't all the peer IP-based routing, and not on a subnet that routers between the two should have no idea they exist?

  The main hypothesis that I have here is that the protected subnets are not accessible unless the VPN tunnel is up.  Most of my experience of the VPN site-to-site is with PIX / ASA, and I've never had to specify a route towards the protected subnet (for example 172.16.228.0).  I guess he just used his default gateway that has an Internet IP belonging to the ISP.  However the ISP has no idea where is 172.16.228.0.

  Edit: I found a thread, do not report with Cisco but IPSec in general, this seems to be the question in case I don't have a lot of sense:

  http://comments.Gmane.org/Gmane.OS.OpenBSD.misc/192986

  He still does not seem logical to me.  If I have a tunnel linking the two class C networks by internet, the only routers having knowledge of these networks are the two counterparts.  Why a course should be (static, dynamic, default etc,) which seems to send traffic to a device that do not know where is the class C networks?  Although I have to take in my example with the 172.17.228.0 my ASA was not actually sends out packets to my ISP gateway with 172.17.228.0 in them.

  The purpose of the trail is * not * to send traffic to your next jump. You are right that the next hop router has no idea what to do with this package. This way is important for the local operation. The router must find the interface of output for the package. 'S done it with the road to the next-hop-router. If you remember that the road to your peer IPSec, your router must do a recursive search routing. After the outging interface is found, traffic is sent to this interface, the card encryption on this interface jumps and protects your traffic that is routed to your IPSec peer.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• communications between IPSec VPN and AnyConnect SSLVPN

  Hi all

  I have 2 ASAs and interconnected with ipsec VPN.

  one of the ASA has SSLVPN users to access intranet resources.

  but do not know how to get inside the network on an another ASA

  my network architecture is less to:

  192.168.1.0/24---ASA1---Internet---ASA2---172.24.0.0/16

  SSLVPN use 192.168.55.0/24 ip on the external interface

  L2L IPSec VPN is established between ASA1 and ASA2

  192.168.1.x could access 172.24.0.0/16 via NATing to of ASA2 inside the ip interface

  But now I want 192.168.55.0/24 access 172.24.0.0/16, some set up but does not work...

  Are there any suggestions?

  Thank you very much

  Hi the split tunnel, you add with the ASA2 network should allow vpn clients send the traffic through the tunnel when they want to reach the remote subnet.

  Can add you this too

  nonat_outside ip access list allow

  NAT (outside) 0-list of access nonat_outside

  Also in the config you have not added the crypto to ASA1 acl entry. who is 192.168.55.0 to 172.24.0.0

  See if that helps

• IP common in client IPSec VPN and VPN site to site

  Hello

  We have a scenario where the Cisco ASA 5505 will be one of the ends of a site to site VPN. The same ASA 5505 also allows the Client VPN connection. The issue is around the pooling of intellectual property.

  If I assign a pool of IP addresses (192.168.1.20 - 192.168.1.30) for connections VPN Client - do I need to be sure that these same IP are not used across the site to site VPN?

  There may be a PC / servers running 192.168.1.0/24 on the other side of the site to site VPN. This would lead to an address conflict?

  "

  I have attached a diagram of the scenario. I would like to know if the 'orange' PC would cause an IP conflict if they get the same IP that PC "blue color" - even if one of them is the VPN client and the other is VPN site-to-site

  Thank you.

  Altogether. The pool of the VPN Client must be single subnet which is not anywhere within your network.

• The IOS IPSec VPN configuration Cisco router

  Hi experts,

  I have not configured the VPN for a long time on the routers so I want your recommendation on best practices.

  I need to run OSPF over it, so it must be GRE over IPSec

  I googled and I see the old type of config that I used to do with the use of the crypto map. Then I see config with profile Ipsec that is applied to the interface of tunnel (tunnel protection). I also see on the manual on isakmp profile...

  Is there an example of configuration that you can provide? This is site to site VPN with PAT most basic on the interface for the remote desktop for surfing the Internet. My routers are fairly recent. One is 2821 with new 12.4 T code and another 2921 router.

  Thank you

  Hello!

  I didn't have a corresponding exactly to your needs, but I did a. I set it up by hand while there might be errors in config.

• DPD on site-2-client IPSEC VPN

  Hello

  I configured IPSEC client-2-site time and site 2 site tunnels on my ASR routers.

  Although I keepalive is enabled on the router, site-customer-2 tunnels are not disconnected in the event of failure of router connectivity client.

  At the same time site 2 site tunnels are being disconnected from the PDB.

  The DPD is configured as follows

  "crypto isakmp keepalive 60 10 periodicals.

  Is someone can help me with this problem?

  Thanks in advance

  Concerning

  Lukasz

  There Lukasz,

  We had recently two common culprits:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCto16377

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCty52047

  This COULD explain what you see. Check them out, if you use something more recent - we might as well have a case open TAC so that we can draw debugs and see.

  M.

• client ipSec VPN and NAT on the router Cisco = FAIL

  I have a Cisco 3825 router that I have set up for a Cisco VPN ipSec client.  The same router is NAT.

  ipSec logs, but can not reach the internal network unless NAT is disabled on the inside interface.  But I need both at the same time.

  Suggestions?

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group myclient

  key password!

  DNS 1.1.1.1

  Domain name

  pool myVPN

  ACL 111

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  market arriere-route

  !

  !
  list of card crypto clientmap client VPN - AAA authentication
  card crypto clientmap AAA - VPN isakmp authorization list
  client configuration address map clientmap crypto answer
  10 ipsec-isakmp crypto map clientmap Dynamics dynmap
  !

  interface Loopback0
  IP 10.88.0.1 255.255.255.0
  !
  interface GigabitEthernet0/0
  / / DESC it's external interface

  IP 192.168.168.5 255.255.255.0
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  media type rj45
  clientmap card crypto
  !
  interface GigabitEthernet0/1

  / / DESC it comes from inside interface
  10.0.1.10 IP address 255.255.255.0
  IP nat inside<=================ipSec client="" connects,="" but="" cannot="" reach="" interior="" network="" unless="" this="" is="">
  IP virtual-reassembly
  the route cache same-interface IP
  automatic duplex
  automatic speed
  media type rj45

  !

  IP local pool myVPN 10.88.0.2 10.88.0.10

  p route 0.0.0.0 0.0.0.0 192.168.168.1
  IP route 10.0.0.0 255.255.0.0 10.0.1.4
  !

  IP nat inside source list 1 interface GigabitEthernet0/0 overload
  !
  access-list 1 permit 10.0.0.0 0.0.255.255
  access-list 111 allow ip 10.0.0.0 0.0.255.255 10.88.0.0 0.0.0.255
  access-list 111 allow ip 10.88.0.0 0.0.0.255 10.0.0.0 0.0.255.255

  Hello

  I think that you need to configure the ACL default PAT so there first statemts 'decline' for traffic that is NOT supposed to be coordinated between the local network and VPN pool

  For example, to do this kind of configuration, ACL and NAT

  Note access-list 100 NAT0 customer VPN
  

  access-list 100 deny ip 10.0.1.0 0.0.0.255 10.88.0.0 0.0.0.255
  

  Note access-list 100 default PAT for Internet traffic
  

  access-list 100 permit ip 10.0.1.0 0.0.0.255 ay

  overload of IP nat inside source list 100 interface GigabitEthernet0/0

  
  EDIT: seem to actually you could have more than 10 networks behind the router

  Then you could modify the ACL on this

  Note access-list 100 NAT0 customer VPN
  

  access-list 100 deny ip 10.0.1.0 0.0.255.255 10.88.0.0 0.0.0.255
  

  Note access-list 100 default PAT for Internet traffic
  

  access-list 100 permit ip 10.0.1.0 0.0.255.255 ay

  Don't forget to mark the answers correct/replys and/or useful answers to rate

  -Jouni

• IOS router VPN Client (easy VPN) IPsec with Anyconnect

  Hello

  I would like to set up my router IOS IPsec VPN Client and connect with any connect.
  Is it possible to configure an IPSec and SSL VPN Client on IOS router? I use for example a 1841.

  It would be perfect to give the user the choice of SSL or IPSec protocol. And the user needs that the Anyconnect Client.

  I think it's possible with a Cisco ASA. But I can also do this with an IOS router?

  Please let me know how if this is possible.

  Also is it true that the IOS routers are not affected to hear bug bleed? SSL VPN and SSL VPN with Anyconnect page is also save?

  http://Tools.Cisco.com/Security/Center/content/CiscoSecurityAdvisory/CIS...

  But I am in any way interested in using IPSec and SSL VPN on a router IOS...

  It's true - CCP does not yet offer the options to configure a VPN IPsec with IKEv2.

  The configuration guide (here) offers detailed advice and includes examples of configuration.

• IPSec VPN with compression

  Hi all

  I find this compression of supporting IPPCP 2600XM for IPSec VPN. It seems that it is supported only with a VPN module, is it?

  What would you say if I don't have module VPN, but the IPSec VPN configuration and compression for a connection low speed?

  BTW, the IPSec VPN and "compress stac" can co-exist?

  Also, what kind of compression support in 28xx with IPSec VPN?

  Thank you very much.

  MAK

  MAK,

  It depends on the installed vpn module. The previous support compression, but the compression is performed in software, not on the card, which offers only encryption. For this to work, you must run IOS 12.2 (13) T or later.

  If your previous IOS running, you cannot use compression alongside encryption PURPOSE cards at all.

  The latest maps AIM-VPN /? P II IPPC support in hardware.

  More information is here:

  http://www.Cisco.com/en/us/products/HW/routers/ps259/products_data_sheet09186a0080088750.html

  This link displays information related to the release of functionality of software compression of 12.2 (13) T

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps1839/products_feature_guide09186a0080110c00.html#1027177

  Thus, the options you have depend on the IOS and the card BUT you have.

  Beginning IOS and card without compression

  12.2 (13) T and IOS beginning, hardware encryption software compression

  Last map and supporting encryption and hardware compression IOS.

  I'm unsure of the 2800 series, I expected that they support the latest novelty of compression and hardware encryption.

  Andy

• IPSEC VPN DMZ HOST NAT

  Hello world

  First of all thanks for the invaluable information this community offers technicians everywhere... I'm newish to IPSEC VPN and I have a question.

  I have a DMZ PATed host to a public IP address. I've set up an IPSEC tunnel (with an external body on my outside interface) to allow this host reach a host computer in this organization. The VPN is not come. I am told to implement NAT exemption for the DMZ host IPSEC traffic to the host outside. Kindly, how can I do this?

  Kind regards

  Mumo

  OK, no problem :)

  for 8.2 (5), you can try the following config:

  object network DMZ-net 172.16.1.0 255.255.255.0object network Remote-net 10.1.1.0 255.255.255.0access-list asa_dmz_nat0_outbound extended permit ip object DMZ-net object Remote-netnat (DMZ) 0 access-list asa_dmz_nat0_outbound

• IPSEC VPN help!

  Hi all

  I have ASA 5520 and want to enable IPSEC VPN and want to access it via the cisco VPN client.

  I did natting on the router that is connected to the external interface of the ASA. I did a static nat to a private IP address of out I / f of the ASA to the public IP address on the router. I am able to ping this public IP address on the internet and also capable of accessing the ASDM thru firewall using this public IP address.

  I did the configuration using the VPN Wizard but some how not be able to connect through the VPN client. Guide please, if I missed something.

  Configuration of the SAA is attached.

  Concerning

  BSN

  try to do

  conf t

  No crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

  No WAN_map card crypto WAN interface

  card crypto WAN_map WAN interface<- just="" to="" be="" sure="" that="" all="" the="" changes="" were="">

  and see the

  crypto 10 isa debugging

  Debug crypto ipsec 10

• IPSec VPN pix 501 no LAN access

  I'm trying to set up an IPSec VPN in a basic small business scenario. I am able to connect to my pix 501 via IPSec VPN and browse the internet, but I am unable to ping or you connect to all devices in the Remote LAN. Here is my config:

  : Saved

  :

  6.3 (3) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  nameif ethernet0 WAN security0

  nameif ethernet1 LAN security99

  enable encrypted password xxxxxxxxxxxxx

  xxxxxxxxxxxxxxxxx encrypted passwd

  host name snowball

  domain xxxxxxxxxxxx.local

  clock timezone PST - 8

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol pptp 1723

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  No fixup not protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  acl_in list of access permit udp any any eq field

  acl_in list of access permit udp any eq field all

  acl_in list access permit tcp any any eq field

  acl_in tcp allowed access list any domain eq everything

  acl_in list access permit icmp any any echo response

  access-list acl_in allow icmp all once exceed

  acl_in list all permitted access all unreachable icmp

  acl_in list access permit tcp any any eq ssh

  acl_in list access permit tcp any any eq www

  acl_in tcp allowed access list everything all https eq

  acl_in list access permit tcp any host 192.168.5.30 eq 81

  acl_in list access permit tcp any host 192.168.5.30 eq 8081

  acl_in list access permit tcp any host 192.168.5.22 eq 8081

  acl_in list access permit icmp any any echo

  access-list acl_in permit tcp host 76.248.x.x a

  access-list acl_in permit tcp host 76.248.x.x a

  allow udp host 76.248.x.x one Access-list acl_in

  access-list acl_out permit icmp any one

  ip access list acl_out permit a whole

  acl_out list access permit icmp any any echo response

  acl_out list access permit icmp any any source-quench

  allowed any access list acl_out all unreachable icmp

  access-list acl_out permit icmp any once exceed

  acl_out list access permit icmp any any echo

  Allow Access-list no. - nat icmp a whole

  access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

  access-list no. - nat ip 172.16.0.0 allow 255.255.0.0 any

  access-list no. - nat permit icmp any any echo response

  access-list no. - nat permit icmp any any source-quench

  access-list no. - nat icmp permitted all all inaccessible

  access-list no. - nat allow icmp all once exceed

  access-list no. - nat permit icmp any any echo

  pager lines 24

  MTU 1500 WAN

  MTU 1500 LAN

  IP address WAN 65.74.x.x 255.255.255.240

  address 192.168.5.1 LAN IP 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool pptppool 172.16.0.2 - 172.16.0.13

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global (WAN) 1 interface

  NAT (LAN) - access list 0 no - nat

  NAT (LAN) 1 0.0.0.0 0.0.0.0 0 0

  static (LAN, WAN) 65.x.x.37 192.168.5.10 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.36 192.168.5.20 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.38 192.168.5.30 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.39 192.168.5.40 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.42 192.168.5.22 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.43 192.168.5.45 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.44 192.168.5.41 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.45 192.168.5.42 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.46 192.168.5.44 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.41 192.168.5.21 netmask 255.255.255.255 0 0

  acl_in access to the WAN interface group

  access to the LAN interface group acl_out

  Route WAN 0.0.0.0 0.0.0.0 65.x.x.34 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  NTP server 72.14.188.195 source WAN

  survey of 76.248.x.x WAN host SNMP Server

  location of Server SNMP Sacramento

  SNMP Server contact [email protected] / * /

  SNMP-Server Community xxxxxxxxxxxxx

  SNMP-Server enable traps

  enable floodguard

  the string 1 WAN fragment

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  map mymap 10-isakmp ipsec crypto dynamic dynmap

  client configuration address map mymap crypto initiate

  client configuration address map mymap crypto answer

  card crypto mymap WAN interface

  ISAKMP enable WAN

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup myvpn address pptppool pool

  vpngroup myvpn Server dns 192.168.5.44

  vpngroup myvpn by default-field xxxxxxxxx.local

  vpngroup split myvpn No. - nat tunnel

  vpngroup idle 1800 myvpn-time

  vpngroup myvpn password *.

  Telnet 192.168.5.0 255.255.255.0 LAN

  Telnet timeout 5

  SSH 192.168.5.0 255.255.255.0 LAN

  SSH timeout 30

  Console timeout 0

  VPDN group pptpusers accept dialin pptp

  VPDN group ppp authentication pap pptpusers

  VPDN group ppp authentication chap pptpusers

  VPDN group ppp mschap authentication pptpusers

  VPDN group ppp encryption mppe 128 pptpusers

  VPDN group pptpusers client configuration address local pptppool

  VPDN group pptpusers customer 192.168.5.44 dns configuration

  VPDN group pptpusers pptp echo 60

  VPDN group customer pptpusers of local authentication

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN enable WAN

  dhcpd address 192.168.5.200 - 192.168.5.220 LAN

  dhcpd 192.168.5.44 dns 8.8.8.8

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd enable LAN

  username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

  username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

  Terminal width 80

  Cryptochecksum:xxxxxxxxxxxxxxxxxx

  : end

  I'm sure it has something to do with NAT or an access list, but I can't understand it at all. I know it's a basic question, but I would really appreaciate help!
  Thank you very much
  Trevor

  "No. - nat' ACL doesn't seem correct, please make sure you want to remove the following text:

  do not allow any No. - nat icmp access list a whole

  No No. - nat ip 172.16.0.0 access list allow 255.255.0.0 any

  No No. - nat access list permit icmp any any echo response

  No No. - nat access list permit icmp any any source-quench

  No No. - nat access list permit all all unreachable icmp

  No No. - nat access list do not allow icmp all once exceed

  No No. - nat access list only allowed icmp no echo

  You must have 1 line as follows:

  access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

  Please 'clear xlate' after the changes described above.

  In addition, if you have a personal firewall enabled on the host you are trying to connect from the Client VPN, please turn it off and try again. Personal firewall of Windows normally blocks the traffic of different subnets.

  Hope that helps.

• Simple IOS VPN IPsec HUB and Spoke failover HUB

  Hi all

  I have a nd architecture VPN Hub spoke with Asit, IKEv1 and IPsec.

  My hub is connected to a single service provider.

  I wish I had a hardware redundancy for my hub.

  Instead of creating a double tunnel in each Department, I would like to use my router 4000ISR failover protocol.

  Is it possible to simply achieve?

  If I use IOS IPsec failover that I need to deploy my changes on the two router or (such as ASA) I can set the active router and allow the watch to receive the chenges?

  Thanks to you all.

  Johnny

  If your ISP connection is one that has a routed block and you can connect two routers same in it, you can then configure HSRP.

  The source of the Tunnel becomes the HSRP address.  Rays may not know that there are two routers.

  Easy failover.

  Alternatively, you can have a single tunnel with hubs double (if you do not use HSRP).  You don't have to borrow the double tunnels.