Configure several IPSec VPN between Cisco routers

I would like to create multiple ipsec VPN between 3 routers. Before applying it, I would like to check on the config I wrote to see if it works. It's just on RouterA configuration for virtual private networks to RouterB, and RouterC.

As you can apply in a cyptomap by interface, I say with the roadmap, that it should be able to manage traffic for both routers. Or is there a better way to do it?

RouterA - 1.1.1.1

RouterB - 2.2.2.2

RouterC - 3.3.3.3

RouterA

crypto ISAKMP policy 10

BA 3des

preshared authentication

Group 2

ISAKMP crypto key RouterB address 2.2.2.2

ISAKMP crypto keys RouterC address 3.3.3.3

invalid-spi-recovery crypto ISAKMP

ISAKMP crypto keepalive 5 10 periodicals

ISAKMP crypto nat keepalive 30

life crypto ipsec security association seconds 28800

Crypto ipsec transform-set AES - SHA esp - aes 256 esp-sha-hmac

outsidemap 20 ipsec-isakmp crypto map

defined peer 2.2.2.2

game of transformation-AES-SHA

match address 222

outsidemap 30 ipsec-isakmp crypto map

defined peer 3.3.3.3

game of transformation-AES-SHA

match address 333

interface GigabitEthernet0/0

Description * Internet *.

NAT outside IP

outsidemap card crypto

interface GigabitEthernet0/1

Description * LAN *.

IP 1.1.1.1 255.255.255.0

IP nat inside

IP nat inside source map route RouterA interface GigabitEthernet0/0 overload

access-list 222 allow ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

access-list 223 deny ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

access-list 223 allow ip 1.1.1.0 0.0.0.255 any

access-list 333 allow ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255

access-list 334 deny ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255

access-list 334 allow ip 1.1.1.0 0.0.0.255 any

RouterA route map permit 10

corresponds to the IP 223 334

Hi Chris,

The two will remain active.

The configuration you have is for several ste VPN site is not for the redundant VPN.

The config for the redundant VPN is completely different allows so don't confuse is not with it.

In the redundant VPN configuration both peers are defined in the same card encryption.

Traffic that should be passed through the tunnel still depend on the access list, we call in the card encryption.

This access-lsist is firstly cheked and as a result, the traffic is passed through the correct tunnel

HTH!

Concerning

Regnier

Please note all useful posts

Tags: Cisco Security

Similar Questions

IPSec VPN between Cisco and ScreenOS

Hello

I'm trying to set up a simple IPSec VPN between a Cisco 2911 router and a Juniper Netscreen ScreenOS (not exactly now the model) device. Initially the debbuging seems good (QM_IDLE), but the ISAKMP Security Association is deleted.

The guy managing the Juniper device send me an extract from his diary:

###########################################################################

2012-08-28 10:24:16 info 00536 IKE Phase 2 msg ID System

9b 839579: negotiations failed.

2012-08-28 10:24:16 info system 00536 rejected a package of IKE loopback.11

of : 500 to

217.150.152.45:500 with cookies

87960e39d074ca49 and 9302d26c7ce324a5

because there is no acceptable Phase

2 proposals...

It has defined the following phase 2 proposals:

IKE the value p2-proposal "G2_esp_aes256_sha_1800s" group2 esp aes256-sha-1, 1800 second

###########################################################################

And I use these:

###########################################################################

crypto ISAKMP policy 1

BA aes 256

preshared authentication

Group 2

!

ISAKMP crypto key address 217.150.152.45

Crypto ipsec transform-set esp - aes esp - aes 256 esp-sha-hmac

card crypto ipsec vpn 2 isakmp

Description * VPN Anbindung nach PKI in Magdeburg *.

defined by peer 217.150.152.45

define security-association life seconds 1800

the value of the transform-set esp - aes

match address PKI-TRAFFIC

!

###########################################################################

Here is my Log:

#################################################################################################################

28 August 08:23:46.416: ISAKMP: (0): profile of THE request is (NULL)

28 August 08:23:46.416: ISAKMP: created a struct peer 217.150.152.45, peer port 500

28 August 08:23:46.416: ISAKMP: new position created post = 0x2A2D7150 peer_handle = 0x8000003A

28 August 08:23:46.416: ISAKMP: lock struct 0x2A2D7150, refcount 1 to peer isakmp_initiator

28 August 08:23:46.416: ISAKMP: 500 local port, remote port 500

28 August 08:23:46.416: ISAKMP: set new node 0 to QM_IDLE

28 August 08:23:46.416: ISAKMP: (0): insert his with his 31627E04 = success

28 August 08:23:46.416: ISAKMP: (0): cannot start aggressive mode, try the main mode.

28 August 08:23:46.416: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.416: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID

28 August 08:23:46.416: ISAKMP: (0): built the seller-07 ID NAT - t

28 August 08:23:46.416: ISAKMP: (0): built of NAT - T of the seller-03 ID

28 August 08:23:46.416: ISAKMP: (0): built the seller-02 ID NAT - t

28 August 08:23:46.416: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

28 August 08:23:46.416: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

28 August 08:23:46.416: ISAKMP: (0): Beginner Main Mode Exchange

28 August 08:23:46.416: ISAKMP: (0): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_NO_STATE

28 August 08:23:46.416: ISAKMP: (0): sending a packet IPv4 IKE.

28 August 08:23:46.448: ISAKMP (0): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_NO_STATE

28 August 08:23:46.448: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.448: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

28 August 08:23:46.448: ISAKMP: (0): treatment ITS payload. Message ID = 0

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 239

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID is DPD

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): IKE frag vendor processing id payload

28 August 08:23:46.448: ISAKMP: (0): IKE Fragmentation support not enabled

28 August 08:23:46.448: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.448: ISAKMP: (0): pre-shared key local found

28 August 08:23:46.448: ISAKMP: analysis of the profiles for xauth...

28 August 08:23:46.448: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1

28 August 08:23:46.448: ISAKMP: AES - CBC encryption

28 August 08:23:46.448: ISAKMP: SHA hash

28 August 08:23:46.448: ISAKMP: group by default 2

28 August 08:23:46.448: ISAKMP: pre-shared key auth

28 August 08:23:46.448: ISAKMP: keylength 256

28 August 08:23:46.448: ISAKMP: type of life in seconds

28 August 08:23:46.448: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80

28 August 08:23:46.448: ISAKMP: (0): atts are acceptable. Next payload is 0

28 August 08:23:46.448: ISAKMP: (0): Acceptable atts: real life: 0

28 August 08:23:46.448: ISAKMP: (0): Acceptable atts:life: 0

28 August 08:23:46.448: ISAKMP: (0): fill atts in his vpi_length:4

28 August 08:23:46.448: ISAKMP: (0): fill atts in his life_in_seconds:86400

28 August 08:23:46.448: ISAKMP: (0): return real life: 86400

28 August 08:23:46.448: ISAKMP: (0): timer life Started: 86400.

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 239

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID is DPD

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): IKE frag vendor processing id payload

28 August 08:23:46.448: ISAKMP: (0): IKE Fragmentation support not enabled

28 August 08:23:46.448: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.448: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

28 August 08:23:46.448: ISAKMP: (0): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_SA_SETUP

28 August 08:23:46.448: ISAKMP: (0): sending a packet IPv4 IKE.

28 August 08:23:46.452: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.452: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

28 August 08:23:46.484: ISAKMP (0): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_SA_SETUP

28 August 08:23:46.484: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.484: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

28 August 08:23:46.484: ISAKMP: (0): processing KE payload. Message ID = 0

28 August 08:23:46.508: ISAKMP: (0): processing NONCE payload. Message ID = 0

28 August 08:23:46.508: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.508: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.508: ISAKMP: (1049): former State = new State IKE_I_MM4 = IKE_I_MM4

28 August 08:23:46.508: ISAKMP: (1049): send initial contact

28 August 08:23:46.508: ISAKMP: (1049): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

28 August 08:23:46.508: ISAKMP (1049): payload ID

next payload: 8

type: 1

address: 92.67.80.237

Protocol: 17

Port: 500

Length: 12

28 August 08:23:46.508: ISAKMP: (1049): the total payload length: 12

28 August 08:23:46.508: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_KEY_EXCH

28 August 08:23:46.508: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.508: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.508: ISAKMP: (1049): former State = new State IKE_I_MM4 = IKE_I_MM5

28 August 08:23:46.540: ISAKMP (1049): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_KEY_EXCH

28 August 08:23:46.540: ISAKMP: (1049): payload ID for treatment. Message ID = 0

28 August 08:23:46.540: ISAKMP (1049): payload ID

next payload: 8

type: 1

address: 217.150.152.45

Protocol: 17

Port: 500

Length: 12

28 August 08:23:46.540: ISAKMP: (0): peer games * no * profiles

28 August 08:23:46.540: ISAKMP: (1049): HASH payload processing. Message ID = 0

28 August 08:23:46.540: ISAKMP: (1049): SA authentication status:

authenticated

28 August 08:23:46.540: ISAKMP: (1049): SA has been authenticated with 217.150.152.45

28 August 08:23:46.540: ISAKMP: try inserting a peer /217.150.152.45/500/ and inserted 2A2D7150 successfully.

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM5 = IKE_I_MM6

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM6 = IKE_I_MM6

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

28 August 08:23:46.540: ISAKMP: (1049): start Quick Mode Exchange, M - ID of 1582159006

28 August 08:23:46.552: ISAKMP: (1049): initiator QM gets spi

28 August 08:23:46.552: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) QM_IDLE

28 August 08:23:46.552: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.552: ISAKMP: (1049): entrance, node-1582159006 = IKE_MESG_INTERNAL, IKE_INIT_QM

28 August 08:23:46.552: ISAKMP: (1049): former State = new State IKE_QM_READY = IKE_QM_I_QM1

28 August 08:23:46.552: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

28 August 08:23:46.552: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

28 August 08:23:46.584: ISAKMP (1049): received 217.150.152.45 packet dport 500 sport Global 500 (I) QM_IDLE

28 August 08:23:46.584: ISAKMP: node set-452721455 to QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): HASH payload processing. Message ID =-452721455

28 August 08:23:46.584: ISAKMP: (1049): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 1

SPI 0, message ID =-452721455, his 0x31627E04 =

28 August 08:23:46.584: ISAKMP: (1049): peer does not paranoid KeepAlive.

28 August 08:23:46.584: ISAKMP: (1049): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (post 217.150.152.45)

28 August 08:23:46.584: ISAKMP: (1049): node-452721455 error suppression FALSE reason 'informational (en) State 1.

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

28 August 08:23:46.584: ISAKMP: node set 494253780 to QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.584: ISAKMP: (1049): purge the node 494253780

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

28 August 08:23:46.584: ISAKMP: (1049): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (post 217.150.152.45)

Intertoys_Zentrale_Waddinxveen_01 #.

28 August 08:23:46.584: ISAKMP: Unlocking counterpart struct 0x2A2D7150 for isadb_mark_sa_deleted(), count 0

28 August 08:23:46.584: ISAKMP: delete peer node by peer_reap for 217.150.152.45: 2A2D7150

28 August 08:23:46.584: ISAKMP: (1049): node-1582159006 error suppression FALSE reason 'IKE deleted.

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_DEST_SA = IKE_DEST_SA

#################################################################################################################

Is there something special that needs to be addressed when creating a VPN for Juniper devices?

Greetings

Thomas

The peer IPSec a PFS enabled, do the same in your crypto-map:

card crypto ipsec vpn 2 isakmp

PFS group2 Set

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

IPsec VPN between two routers - mode ESP Transport and Tunnel mode

Hi experts,

I have this question about the Transport mode and Tunnel mode for awhile.

Based on my understanding of 'Transport' mode is not possible because you always original "internal" private in the IP headers or IP addresses. They are always different as public IP on interfaces enabled with Crypto Card addresses. When encapsulated in the VPN tunnel, the internal IP addresses must be included or the remote VPN router won't know where to forward the packet.

To test, I built a simple GNS3 with three routers laboratory. R1 and R3 are configured as VPN routers and the R2 must simulate Internet.

My configs are also very basic. The R2 is routing between 1.1.1.0/24 and 2.2.2.0/24. It is defined as the gateway of R1 and R3.

R1:

crypto ISAKMP policy 100
BA aes
preshared authentication
Group 2
ISAKMP crypto key 123456 address 2.2.2.2
!
Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
!
10 map ipsec-isakmp crypto map
defined peer 2.2.2.2
transformation-ESP_null game
match address VPN

!

list of IP - VPN access scope
ip permit 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255
!

R3:

crypto ISAKMP policy 100
BA aes
preshared authentication
Group 2
ISAKMP crypto key 123456 address 1.1.1.2
!
!
Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
!
10 map ipsec-isakmp crypto map
defined peer 1.1.1.2
transformation-ESP_null game
match address VPN

!

list of IP - VPN access scope
Licensing ip 10.0.0.0 0.0.0.255 192.168.1.0 0.0.0.255

I configured transform-"null" value, while it will not encrypt the traffic.

Then I tried the two 'transport' mode and mode "tunnel". I ping a host in the internal network of the R1 to another host in the internal network of the R3. I also tried 'telnet'. I also captured packets and carefully compared in both modes.

Packets encapsulated in exactly the same way!

It's just SPI + sequence No. + + padding

I will attach my screenshots here for you guys to analyze it. I would be grateful for any explanation. I confused maybe just when it comes to the NAT...

I guess my next step is to check if the two modes to make the difference when the GRE is used.

Thank you

Difan

Hi Difan,

As you point out the mode of transport is not always applicable (i.e. applicable if IP source and destination is equal to corresnpoding proxy IDs).

A typical scenario in this mode of transport is used:

-Encryption between two hosts

-GRE tunnels

-L2TP over IPsec

Even if you set "transport mode" this does not mean that it will be used. IOS routers and I blieve also ASA will perform backup even if the mode of transport is configured but does not apply in tunnel mode.

I can take a look at your traces to sniff, but all first can you please check if you transport mode on your ipsec security associations? "See the crypto ipsec his" exit you will show the tunnel or transport mode.

HTH,

Marcin

IPSec VPN between Cisco ASA and Fortigate1000

Hello

I find a useful document on how to create a tunnel VPN IPSec with ASA 5510 firewall Fortigate 1000...

the configuration of the coast FG is done without any problem, BUT the document (. doc FG) said I must configure the ASA with a GRE interface and assign an internal IP address in order to communicate with the FG...

The question is: How do I configure the interface on the SAA ACCORD?

Thanks in advance, Experts...

Kind regards...

ASA firewall does not support the interface/GRE GRE tunnel.

If you need to have GRE configured, you will need to complete the GRE tunnel on router IOS.

If you want to configure just pure tunnel VPN IPSec (lan-to-lan), here is an example of configuration on the side of the ASA:

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080950890.shtml

Hope that helps.

Public static IPsec tunnel between two routers cisco [VRF aware]

Hi all

I am trying to configure static IPsec tunnel between two routers. Router R1 has [no VRF] only global routing table.

Router R2 has two routing tables:

* vrf INET - used for internet connectivity

* global routing table - used for VPN connections

Here are the basic configs:

R1

crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
ISAKMP crypto key 7V7u841k2D3Q7v98d6Y4z0zF address 203.0.0.3
invalid-spi-recovery crypto ISAKMP
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
transport mode
!
Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
game of transformation-TRSET_AES-256_SHA
!
interface Loopback0
10.0.1.1 IP address 255.255.255.255
IP ospf 1 zone 0
!
interface Tunnel0
IP 192.168.255.34 255.255.255.252
IP ospf 1 zone 0
source of tunnel FastEthernet0/0
tunnel destination 203.0.0.3
ipv4 ipsec tunnel mode
Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
!
interface FastEthernet0/0
IP 102.0.0.1 255.255.255.0

!

IP route 203.0.0.3 255.255.255.255 FastEthernet0/0 102.0.0.2

#######################################################

R2

IP vrf INET
RD 1:1
!
Keyring cryptographic test vrf INET
address of pre-shared-key 102.0.0.1 key 7V7u841k2D3Q7v98d6Y4z0zF
!
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
invalid-spi-recovery crypto ISAKMP
crypto isakmp profile test
door-key test
function identity address 102.0.0.1 255.255.255.255
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
transport mode
!
Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
game of transformation-TRSET_AES-256_SHA
Test Set isakmp-profile
!
interface Loopback0
IP 10.0.2.2 255.255.255.255
IP ospf 1 zone 0
!
interface Tunnel0
IP 192.168.255.33 255.255.255.252
IP ospf 1 zone 0
source of tunnel FastEthernet0/0
tunnel destination 102.0.0.1
ipv4 ipsec tunnel mode
tunnel vrf INET
Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
!
interface FastEthernet0/0
IP vrf forwarding INET
IP 203.0.0.3 255.255.255.0

!

IP route 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

#######################################################

There is a router between R1 and R2, it is used only for connectivity:

interface FastEthernet0/0
IP 102.0.0.2 255.255.255.0
!
interface FastEthernet0/1
IP 203.0.0.2 255.255.255.0

The problem that the tunnel is not coming, I can't pass through phase I.

The IPsec VPN are not my strength. So if someone could show me what mistake I make, I'd appreciate it really.

I joined ouptup #debug R2 crypto isakmp

Source and destination Tunnel0 is belong to VRF INET, the static route need to be updated.

IP route vrf INET 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

crypto isakmp profile test

VRF INET

door-key test
function identity address 102.0.0.1 255.255.255.255

Problem with IPsec VPN between ASA and router Cisco - ping is not response

Hello

I don't know because the IPsec VPN does not work. This is my setup (IPsec VPN between ASA and R2):

my network topology data:

LAN 1 connect ASA - 1 (inside the LAN)

PC - 10.0.1.3 255.255.255.0 10.0.1.1

ASA - GigabitEthernet 1: 10.0.1.1 255.255.255.0

-----------------------------------------------------------------

ASA - 1 Connect (LAN outide) R1

ASA - GigabitEthernet 0: 172.30.1.2 255.255.255.252

R1 - FastEthernet 0/0: 172.30.1.1 255.255.255.252

---------------------------------------------------------------------

R1 R2 to connect

R1 - FastEthernet 0/1: 172.30.2.1 255.255.255.252

R2 - FastEthernet 0/1: 172.30.2.2 255.255.255.252

R2 for lan connection 2

--------------------------------------------------------------------

R2 to connect LAN2

R2 - FastEthernet 0/0: 10.0.2.1 255.255.255.0

PC - 10.0.2.3 255.255.255.0 10.0.2.1

ASA configuration:

1 GigabitEthernet interface
nameif inside
security-level 100
IP 10.0.1.1 255.255.255.0
no downtime
interface GigabitEthernet 0
nameif outside
security-level 0
IP 172.30.1.2 255.255.255.252
no downtime
Route outside 0.0.0.0 0.0.0.0 172.30.1.1

------------------------------------------------------------

access-list scope LAN1 to LAN2 ip 10.0.1.0 allow 255.255.255.0 10.0.2.0 255.255.255.0
object obj LAN
subnet 10.0.1.0 255.255.255.0
object obj remote network
10.0.2.0 subnet 255.255.255.0
NAT (inside, outside) 1 static source obj-local obj-local destination obj-remote control remote obj non-proxy-arp static

-----------------------------------------------------------
IKEv1 crypto policy 10
preshared authentication
aes encryption
sha hash
Group 2
life 3600
Crypto ikev1 allow outside
crypto isakmp identity address

------------------------------------------------------------
tunnel-group 172.30.2.2 type ipsec-l2l
tunnel-group 172.30.2.2 ipsec-attributes
IKEv1 pre-shared-key cisco123
Crypto ipsec transform-set esp-aes-192 ASA1TS, esp-sha-hmac ikev1

-------------------------------------------------------------
card crypto ASA1VPN 10 is the LAN1 to LAN2 address
card crypto ASA1VPN 10 set peer 172.30.2.2
card crypto ASA1VPN 10 set transform-set ASA1TS ikev1
card crypto ASA1VPN set 10 security-association life seconds 3600
ASA1VPN interface card crypto outside

R2 configuration:

interface fastEthernet 0/0
IP 10.0.2.1 255.255.255.0
no downtime
interface fastEthernet 0/1
IP 172.30.2.2 255.255.255.252
no downtime

-----------------------------------------------------

router RIP
version 2
Network 10.0.2.0
network 172.30.2.0

------------------------------------------------------
access-list 102 permit ahp 172.30.1.2 host 172.30.2.2
access-list 102 permit esp 172.30.1.2 host 172.30.2.2
access-list 102 permit udp host 172.30.1.2 host 172.30.2.2 eq isakmp
interface fastEthernet 0/1
IP access-group 102 to

------------------------------------------------------
crypto ISAKMP policy 110
preshared authentication
aes encryption
sha hash
Group 2
life 42300

------------------------------------------------------
ISAKMP crypto key cisco123 address 172.30.1.2

-----------------------------------------------------
Crypto ipsec transform-set esp - aes 128 R2TS

------------------------------------------------------

access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

------------------------------------------------------

R2VPN 10 ipsec-isakmp crypto map
match address 101
defined by peer 172.30.1.2
PFS Group1 Set
R2TS transformation game
86400 seconds, life of security association set
interface fastEthernet 0/1
card crypto R2VPN

I don't know what the problem

Thank you

If the RIP is not absolutely necessary for you, try adding the default route to R2:

IP route 0.0.0.0 0.0.0.0 172.16.2.1

If you want to use RIP much, add permissions ACL 102:

access-list 102 permit udp any any eq 520

IPSec tunnel between 2 routers

Hello

I am trying to configure an IPSec VPN tunnel between 2 routers Cisco, connected to the internet via the ATM interface, my router is a 1841 with the network 10.200.36.0 address the remote router is a Cisco network 192.168.9.0 address with 877.

I have tryied to follow some tutorials, unsuccessfully, because I can't always ping all IP addresses on the remote network and also the VPN tunnel is not up!

Can help you please give me a configuration model, or maybe let me know how to configure step by step on mine and remote router?

Thank you very much!

Concerning

Riccardo

Here is an example. x.x.x.x and y.y.y.y are the public IPs of routers:

ROUTER1 hostname

!

crypto ISAKMP policy 10

BA aes 256

AUTH pre

Group 5

!

ISAKMP crypto key cisco1234 address y.y.y.y

!

Crypto ipsec transform-set ESP-AES256-SHA1 esp - aes 256 esp-sha-hmac

!

Profile of crypto ipsec TunnelProfile

the transform ESP-AES256-SHA1 value

!

interface Tunnel0

IP 10.255.255.0 255.255.255.254

tunnel Dialer source 0

tunnel destination y.y.y.y

ipv4 ipsec tunnel mode

Tunnel TunnelProfile ipsec protection profile

!

interface Dialer0

IP x.x.x.x

!

IP route 192.168.9.0 255.255.255.0 Tunnel0

hostname ROUTER2

!

crypto ISAKMP policy 10

BA aes 256

AUTH pre

Group 5

!

ISAKMP crypto cisco1234 key address x.x.x.x

!

Crypto ipsec ESP-AES256-SHA1 transform-set esp - aes 256 esp-sha-hmac

!

Profile of crypto ipsec TunnelProfile

the transform ESP-AES256-SHA1 value

!

interface Tunnel0

IP 10.255.255.1 255.255.255.254

tunnel Dialer source 0

tunnel destination x.x.x.x

ipv4 ipsec tunnel mode

Tunnel TunnelProfile ipsec protection profile

!

interface Dialer0

IP address y.y.y.y

!

IP route 10.200.36.0 255.255.255.0 Tunnel0

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

ASA 5505 - I can't create an IPSEC VPN between two ASA 5505

Hello

I have two ASA 5505 with basic license and I'm trying to create a VPN IPSEC using the CLI. Here are the steps I did:

1 Configure ASA-1 (host name, vlan 1 and vlan 2).

2. configure a static route

3. create object network (local and remote)

4. create the access list

5. create ikev1 crypto

6. create tunnel-group

7 Configure nat

and I repeat the steps above with the ASA but another change IP.

Are to correct the above steps?

Why can I not create an IPSEC VPN between devices?.

No, you needn't. The ASA configuration is ok. Packet trace proved it. I think it can be a problem on the hosts. Please, check the firewall on the PC and try to put out of service, if it is running.

VPN between 2 routers Cisco 1841 (LAN to LAN)

Hello

I need to connect two offices (two different LAN) using routers cisco 1841 at both ends.

Currently the two cisco router are in working condition and refer the internet LAN clients. (making the NAT).

Can someone please tell us what is the easiest way to set up a VPN between two sites, so that LAN users to an office to access mail servers electronic/request to the office LAN.

I understand that I need IPSec Site to Site VPN (I think).

Anyonce can you please advise.

Kind regards.
```
s.nasheet wrote:
Hi ,
I need to connect two offices ( two different LAN's) together using cisco 1841 routers at both end.
Currently both cisco router are in working order and  acting as a internet gateway to the LAN clients. ( doing NAT).
Can anybody please advise what is the easiest method to configure VPN between two sites so that  LAN users at one office be able to access  the  email/application servers at the other LAN office.
I understand I need IPSec Site to Site VPN  ( i think).
Can anyonce please advise.
Regards.
```
Yes, you need a VPN site-to site. Start with this link which gives a number of examples to set up a VPN S2S between 2 routers Cisco.

http://www.Cisco.com/en/us/Tech/tk583/TK372/tech_configuration_examples_list.html#anchor16

Jon

Configuration of multiple L2L on cisco routers problems

Hi all, I have two cisco routers (Cisco 2911 and 871) I'm trying to establish a VPN L2L with. Each has a VPN configured to our cooperate Office located to the top and work. I'm now trying to establish VPN site to site in these two remote sites. I have my cryptographic cards and NoNats valuable traffic however set up, I don't even see a coming phase upwards.

I attached each config. Most of my experience of site to another is of pix and ASA, so I'm curious to know if there is something else I need to do on my external interface to allow several VPN?

Can you see where I am going wrong?

Thank you

Dan

Hi Dan,.

You can only have one card encryption on an interface (as well as on Pix / Asa). However, this encryption card can have multiple entries.

The Scottsdale router, so now instead of:

card crypto Chandler-address FastEthernet4

Chandler 2-isakmp ipsec crypto map

...

!

map Scottsdale address FastEthernet4 crypto

Scottsdale 1 isakmp ipsec crypto map

...

You must configure:

map Scottsdale address FastEthernet4 crypto

Scottsdale 1 isakmp ipsec crypto map

...

Scottsdale 2-isakmp ipsec crypto map

...

And of course, there must be a similar change on the other router.

HTH

Herbert

ISA500 site by site ipsec VPN with Cisco IGR

Hello

I tried a VPN site by site work with Openswan and Cisco 2821 router configuration an Ipsec tunnel to site by site with Cisco 2821 and ISA550.

But without success.

my config for openswan, just FYI, maybe not importand for this problem

installation of config

protostack = netkey

nat_traversal = yes

virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%4:!$RIGHT_SUBNET

nhelpers = 0

Conn rz1

IKEv2 = no

type = tunnel

left = % all

leftsubnet=192.168.5.0/24

right =.

rightsourceip = 192.168.1.2

rightsubnet=192.168.1.0/24

Keylife 28800 = s

ikelifetime 28800 = s

keyingtries = 3

AUTH = esp

ESP = aes128-sha1

KeyExchange = ike

authby secret =

start = auto

IKE = aes128-sha1; modp1536

dpdaction = redΘmarrer

dpddelay = 30

dpdtimeout = 60

PFS = No.

aggrmode = no

Config Cisco 2821 for dynamic dialin:

crypto ISAKMP policy 1

BA aes

sha hash

preshared authentication

Group 5

lifetime 28800

!

card crypto CMAP_1 1-isakmp dynamic ipsec DYNMAP_1

!

access-list 102 permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255

!

Crypto ipsec transform-set ESP-AES-SHA1 esp - aes esp-sha-hmac

crypto dynamic-map DYNMAP_1 1

game of transformation-ESP-AES-SHA1

match address 102

!

ISAKMP crypto key address 0.0.0.0 0.0.0.0

ISAKMP crypto keepalive 30 periodicals

!

life crypto ipsec security association seconds 28800

!

interface GigabitEthernet0/0.4002

card crypto CMAP_1

!

I tried ISA550 a config with the same constelations, but without suggesting.

Anyone has the same problem?

And had anyone has a tip for me, or has someone expirense with a site-by-site with ISA550 and Cisco 2821 ipsec tunnel?

I can successfully establish a tunnel between openswan linux server and the isa550.

Patrick,

as you can see on newspapers, the software behind ISA is also OpenSWAN

I have a facility with a 892 SRI running which should be the same as your 29erxx.

Use your IOS Config dynmap, penny, you are on the average nomad. If you don't have any RW customer you shoul go on IOS "No.-xauth" after the isakmp encryption key.

Here is my setup, with roardwarrior AND 2, site 2 site.

session of crypto consignment

logging crypto ezvpn

!

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

lifetime 28800

!

crypto ISAKMP policy 2

BA 3des

md5 hash

preshared authentication

Group 2

lifetime 28800

!

crypto ISAKMP policy 3

BA 3des

preshared authentication

Group 2

!

crypto ISAKMP policy 4

BA 3des

md5 hash

preshared authentication

Group 2

!

crypto ISAKMP policy 5

BA 3des

preshared authentication

Group 2

life 7200

ISAKMP crypto address XXXX XXXXX No.-xauth key

XXXX XXXX No.-xauth address isakmp encryption key

!

ISAKMP crypto client configuration group by default

key XXXX

DNS XXXX

default pool

ACL easyvpn_client_routes

PFS

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac FEAT

!

dynamic-map crypto VPN 20

game of transformation-FEAT

market arriere-route

!

!

card crypto client VPN authentication list by default

card crypto VPN isakmp authorization list by default

crypto map VPN client configuration address respond

10 VPN ipsec-isakmp crypto map

Description of VPN - 1

defined peer XXX

game of transformation-FEAT

match the address internal_networks_ipsec

11 VPN ipsec-isakmp crypto map

VPN-2 description

defined peer XXX

game of transformation-FEAT

PFS group2 Set

match the address internal_networks_ipsec2

card crypto 20-isakmp dynamic VPN ipsec VPN

!

!

Michael

Please note all useful posts

IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

Hello

My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

"Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

NAT takes place before the encryption verification!

In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

Thanks for any help

Best regards

Heiko

Hello

Try to change your static NAT with static NAT based policy.

That is to say the static NAT should not be applicable for VPN traffic

permissible static route map 1

corresponds to the IP 104

access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

access-list 104 allow the host ip 10.1.110.10 all

IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

HTH

Kind regards

GE.

PIX IPSec VPN with Cisco 877W

Hi all

I am trying to create a VPN between a PIX and a Cisco 877W tunnel but can't seem to get the tunnel. When I do a 'sho crypto session"on the Cisco 877, I get, he said session state is declining, then changed to NEGOTIATE DOWN, but it is now down again... Please find attached the configs for both ends... Are there commands to confirm that the tunnel is up other than to try to ping the remote end? I would greatly appreciate any help lift this tunnel.

Kind regards

REDA

Hello

Based on the configurations of joined, to do some changes. For example:

1. the isakmp policies do not match on the router and the pix. Make sure the hash group Diffie-Hellman and life correspond on the 877 and pix.

2. the access list for the ipsec traffic must be images of mirror of the other.

3. make sure life of ipsec on the two peers.

I hope it helps.

Kind regards

Arul

Rate if this can help.

Several IPSEC VPN on SR 520

Hello

I am new to Cisco routers and I have problems with the implementation of my VPN connections. I have 4 vpn of the SR 520 to the Linksys BEFVP41 Installer, but only the first will connect and allow traffic to traverse. I think it has to do with my access list entries, but I don't know enough about it to understand. I also think that I might need to use the xxx ip nat inside source list interface FastEthernet4 overload on my other tunnels, but I'm not sure. If someone could give me some advice it would be greatly appreciated. I've included some of my configuration below. Thank you

crypto ISAKMP policy 1

BA 3des

preshared authentication

lifetime 28800

!

crypto ISAKMP policy 2

BA 3des

preshared authentication

life 3600

ISAKMP crypto key 'KEY' address 1.1.1.1

ISAKMP crypto key 'KEY' address 2.2.2.2

ISAKMP crypto key 'KEY' address 3.3.3.3

ISAKMP crypto key 'KEY' address 4.4.4.4

ISAKMP crypto keepalive 3600

!

!

Crypto ipsec transform-set esp-sha-3des esp-3des esp-sha-hmac

transport mode

Crypto ipsec transform-set esp-des-sha esp - esp-sha-hmac

!

BT 1 ipsec-isakmp crypto map

defined peer 1.1.1.1

the value of the transform-set esp-3des-sha

PFS Group1 Set

match address 110

BT 2 ipsec-isakmp crypto map

defined peer 2.2.2.2

the value of the transform-set esp-3des-sha

PFS Group1 Set

match address 120

BT 3 ipsec-isakmp crypto map

defined peer 3.3.3.3

the value of the transform-set esp-3des-sha

PFS Group1 Set

match address 130

4 BT ipsec-isakmp crypto map

defined peer 4.4.4.4

the value of the transform-set esp-3des-sha

PFS Group1 Set

match address 140

!

!

Archives

The config log

hidekeys

!

!

!

interface FastEthernet0

switchport access vlan 75

!

interface FastEthernet1

switchport access vlan 75

!

interface FastEthernet2

switchport access vlan 75

!

interface FastEthernet3

switchport access vlan 75

!

interface FastEthernet4

IP 5.5.5.5 255.255.255.252

NAT outside IP

IP virtual-reassembly

automatic duplex

automatic speed

crypto BT card

!

interface Vlan1

no ip address

Shutdown

!

interface Vlan75

192.168.7.1 IP address 255.255.255.0

IP nat inside

IP virtual-reassembly

!

IP forward-Protocol ND

IP route 0.0.0.0 0.0.0.0 5.5.5.5

!

IP http server

local IP http authentication

IP http secure server

IP http timeout policy slowed down 60 life 86400 request 10000

IP nat inside source static 5060 tcp interface FastEthernet4 5060 192.168.7.2

IP nat inside source static tcp 192.168.7.2 1720 interface FastEthernet4 1720

overload of IP nat inside source list 115 interface FastEthernet4

!

access-list 1 permit 192.168.7.0 0.0.0.255

access-list 110 permit ip 192.168.7.0 0.0.0.255 192.168.18.0 0.0.0.255

access-list 115 deny ip 192.168.7.0 0.0.0.255 192.168.18.0 0.0.0.255

access-list 115 permit ip 192.168.7.0 0.0.0.255 any

access-list 120 allow ip 192.168.7.0 0.0.0.255 192.168.15.0 0.0.0.255

access-list 125 deny ip 192.168.7.0 0.0.0.255 192.168.15.0 0.0.0.255

access-list 125 allow ip 192.168.7.0 0.0.0.255 any

access-list 130 allow ip 192.168.7.0 0.0.0.255 192.168.10.0 0.0.0.255

access-list 135 deny ip 192.168.7.0 0.0.0.255 192.168.10.0 0.0.0.255

access-list 135 allow ip 192.168.7.0 0.0.0.255 any

access-list 140 allow ip 192.168.7.0 0.0.0.255 192.168.17.0 0.0.0.255

access-list 145 deny ip 192.168.7.0 0.0.0.255 192.168.17.0 0.0.0.255

access-list 145 allow ip 192.168.7.0 0.0.0.255 any

SR520 #.

Hi Robert

Try this:

access-list 115 deny ip 192.168.7.0 0.0.0.255 192.168.18.0 0.0.0.255

access-list 115 deny ip 192.168.7.0 0.0.0.255 192.168.15.0 0.0.0.255

access-list 115 deny ip 192.168.7.0 0.0.0.255 192.168.10.0 0.0.0.255

access-list 115 deny ip 192.168.7.0 0.0.0.255 192.168.17.0 0.0.0.255

access-list 115 permit ip 192.168.7.0 0.0.0.255 any

and then remove access 125, 135 and 145 lists since they are not used.

HTH

Herbert

IPSec VPN between ASAs with same subnet for disaster recovery

Hello

I need some clarification from you guys.

To do disaster EasyVPN tunnels for the Cisco ASA 5505 firewall recovery site. Now, there is only one main site and 3 remote sites.

Dr., must use the same subnet that it is on the main site because virtual machines Vmware will be replicated to DR.

For the DR we use Double-Take software.

What is the best solution for this? I think we could use NAT of Destination on ASAs. Other sites (HQ and remote control) will be directed to only address NAT of the

DR and not real which is the same as on the main site.

So guys, will this work? We are using IPSec VPN? In packet - trace on ASA, I see that the package is the first using a NAT, and then encrypted, so it should work, Yes?

I hope someone can confirm this.

I can confirm that this will work certainly,

for prior type natting see 8.3:

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080b37d0b.shtml#diag

for 8.3 and later it is also achievable.

Configure several IPSec VPN between Cisco routers

Similar Questions

Maybe you are looking for