Router (IPSec)-> INTERNET-> Router (IPsec) where to put the TUNNEL IP POOL?

Hello

I'm still learning the VPN (IPsec), I was able to create a tunnel between my PC and my router, but now I want to connect two routers:

F0/1=192.168.0.1 ROUTER A-> INTERNET-> ROUTER B F0/1=192.168.10.1

Both routers receive an IP address from my ISP, I can't do a ping to a site at the other site, I mean, I am able to PING ROUTER A from ROUTER B with the ISP addresses and otherwise.

Two ROUTERS have the same configuration, except for the IP addresses and the ACL, they are opposite.

I think I know what I did wrong, but I don't know how to solve: the TUNNEL need also an IP from a POOL where should I put up, the ROUTER A or ROUTER B?

ROUTER

version 12.4

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

router host name

!

boot-start-marker

boot-end-marker

!

No aaa new-model

IP cef

!

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

ISAKMP crypto key cisco address 81.83.201.BB

!

!

Crypto ipsec transform-set esp-3des RIGHT

!

router_A_to_router_B 1000 ipsec-isakmp crypto map

set of peer 81.83.201.BB

transformation-RIGHT game

match address 101

!

interface FastEthernet0/0

DHCP IP address

automatic speed

full-duplex

router_A_to_router_B card crypto

!

interface FastEthernet0/1

the IP 192.168.0.1 255.255.255.0

automatic speed

full-duplex

!

!

no ip address of the http server

no ip http secure server

!

access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255

!

!

control plan

!

Line con 0

Speed 115200

line to 0

line vty 0 4

!

!

end

ROUTER B

version 12.4

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

router host name

!

boot-start-marker

boot-end-marker

!

No aaa new-model

IP cef

!

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

ISAKMP crypto key cisco address 81.83.201.AA

!

!

Crypto ipsec transform-set esp-3des RIGHT

!

router_B_to_router_A 1000 ipsec-isakmp crypto map

set of peer 81.83.201.AA

transformation-RIGHT game

match address 101

!

interface FastEthernet0/0

DHCP IP address

automatic speed

full-duplex

router_B_to_router_A card crypto

!

interface FastEthernet0/1

IP 192.168.10.1 255.255.255.0

automatic speed

full-duplex

!

!

no ip address of the http server

no ip http secure server

!

access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255

!

!

control plan

!

Line con 0

Speed 115200

line to 0

line vty 0 4

!

!

end

!

!

!

!

!

!

Best regards

Didier

Didier, there are a number of things missing in your config file to make it work, what I can say fa0/1 is inside and the fa0/0 are outdoors. There is no NAT translation to activate the computers inside the network, allowing access to the Internet. You will also need to exclude the EIGRP NAT roads in order to reach the remote network. Each router must have a default gateway to the Internet, this should be done with the following command:

IP route 0.0.0.0 0.0.0.0 fa0/0 dhcp

This will use the default gateway of the DHCP server that assigns IP address on fa0/0. Once that each router has a path to another and the tunnel connects EIGRP will handle the rest given the information to the router 90, this is the spectacle of one of my spoke routers route:

NTR-2620XM #show ip route
Code: C - connected, S - static, mobile R - RIP, M-, B - BGP
D - EIGRP, OSPF, IA - external EIGRP, O - EX - OSPF inter zone
N1 - type external OSPF NSSA 1, N2 - type external OSPF NSSA 2
E1 - OSPF external type 1, E2 - external OSPF of type 2
i - IS - Su - summary IS, L1 - IS - IS level 1, L2 - IS level - 2
-IS inter area, * - candidate failure, U - static route by user
o - ODR, P - periodic downloaded route static

Gateway of last resort is to network 0.0.0.0 0.0.0.0

65.0.0.0/32 is divided into subnets, subnets 1
C 65.14.24.190 is directly connected, Dialer0
172.16.0.0/32 is divided into subnets, subnets 1
D EX 172.16.50.31 [170/3074560] via 172.19.8.1, 20:04:58, Tunnel0
172.19.0.0/24 is divided into subnets, subnets 1
C 172.19.8.0 is directly connected, Tunnel0
10.0.0.0/8 is variably divided into subnets, subnets 14, 6 masks
D EX 10.13.13.8/29 [170/2818560] via 172.19.8.1, 20:04:58, Tunnel0
D EX 10.11.7.0/28 [170/2818560] via 172.19.8.1, 20:04:58, Tunnel0
D 10.13.13.0/29 [90/2818560] via 172.19.8.1, 20:04:58, Tunnel0
C 10.19.9.0/27 is directly connected, Vlan200
C 10.19.8.0/24 is directly connected, Vlan100
C 10.19.10.0/28 is directly connected, Vlan900
D EX 10.20.7.0/24 [170/2818560] via 172.19.8.1, 20:04:58, Tunnel0
D [90/3097600] 10.22.7.0/24 through 172.19.8.1, 17:34:52, Tunnel0
D 10.37.4.0/24 [90/3074560] via 172.19.8.1, 20:04:59, Tunnel0
D 10.15.50.0/24 [90/3074560] via 172.19.8.1, 20:04:59, Tunnel0
D EX 10.24.40.0/24 [170/2818560] via 172.19.8.1, 20:04:59, Tunnel0
D 10.12.85.0/24 [90/3074560] via 172.19.8.1, 20:04:59, Tunnel0
C 10.19.9.192/26 is directly connected, Vlan500
D EX 10.244.0.0/22 [170/2818560] via 172.19.8.1, 20:04:59, Tunnel0
74.0.0.0/32 is divided into subnets, subnets 1
C 74.23.201.24 is directly connected, Dialer0
S * 0.0.0.0/0 is directly connected, Dialer0

All designated routes D are dynamic routes drawn other routers on the DMVPN EIGRP. It will propagate the routing table and they point to the appropriate star. If you follow the example that I gave you, you will have a functional DMVPN.

See you soon,.

Sam

Tags: Cisco Security

Similar Questions

  • Where to put the IP lease expires?

    I would like to know on where to put the IP Address of the lease, which is currently 30 minutes

    Does anyone have any suggestions?

    Thanks in advance for your suggestions :>

    Lease obtained... April 1, 2014 12:29
    End of the lease. April 1, 2014 12:59 AM

    Image
    http://I1093.Photobucket.com/albums/...ps367c6819.jpg

    In your router.  Like this:

  • WRT120N - impossible to find where to put the DNS I want to use

    I bought a WRT120N to replace a Netgear, I had.

    I can't find in the management console where to put the DNS servers, I want to use.

    Can someone give me please the exploration to find.

    If you want to configure a static DNS on your router, and then connect to the Setup page of your router and on the tab of configuration below, you will find static DNS1 and DNS2 DNS3. For example, you can configure a static dns on your router.

  • DirectX June 2010 asking where to put the extracted files. Where should I put them?

    DirectX June 2010 asking where to put the extracted files. Where should I put them?

    Create a new folder and extract the files to the new folder.

    Let us know if that helps.

  • Where to put the password, the application running in FB4?

    Im trying to follow this tutorial: debug your application Adobe Flash Builder 4.0

    and get an error:

    Deployment failed: 1
    Error: Authentication failed because of an invalid password.

    OK, but where to put the password if testing my application in FB 4.0.1?

    There is no info about it in the tutorial and no password field in the FB4 debug configuration

    In the second screenshot, below "debug host ip", you should be able to enter your password

  • Where to put the report server ip and port for the Siebel server?

    Hello

    Where to put the report server ip and port for the Siebel server? I have checked the document "Reports Siebel Guide" but does not know where is the configuration section ' ip address of the server and port ' for 'Oracle BI Publisher.

    Note: I have installed BI Publisher, now necessary to define the ip editor and siebel server port.

    Please help, thanks.

    Hello

    Communication between Siebel and BEEP coming through webservices. You must set the Siebel Outboundwebservice 'PublicReportService' address to address BI Publisher.

    Similarly, the address of the webservice Siebel Inbound 'BIPSiebelSecurityWS' will be used by BEEP setting under the security model of Siebel - Siebel end Webservice poin of connecting to Siebel EAI, data inorder of success authenticate the Siebel user to perform the tasks of report being initiate Siebel UI.

    Please go through the integration document attached to the thread "Re: ADVISE WEBCAST: BI Publisher 11g Configuration with Siebel", it is any integration Siebel with BEEP 11g steps. " But if you go through each step, there are details about why we do it. Through this way you can better understand the integration.

    I hope this helps.

    Thank you
    Maria

  • Where to put the cache of catalogue/cr in my configuration

    Where to put the cache of catalogue/cr for best results

    Parameters:

    Execution of lr 5 on Hi-spec laptop, catalog of 20 k cr2 files

    2 TB 7200 RPM disk internal w/photos

    m.2 128 GB SSD - average reader system

    good (also internal), 500 GB - m.2 - SSD drive, new EVO secondary

    All have 20% + free

    Thanks for any advice.

    Normally, a cache system works best when it is on another drive of source files. This means that you would normally like the LR catalog + cache on a separate disk from the original images.

    I put the pictures on the 2 TB drive.

    The 500 GB SSD seems to be a reasonable place for the catalogue and the cache, but I don't know enough about SSDS to talk about the frequent updates of file that will happen with the catalogue.

  • Hello, I got a serial number for adobe package I installed 3/4 years ago, but I don't know where I put the serial number and now I need it! Is anyway to find the series through the application code? Thank you!

    Hello, I got a serial number for adobe package I installed 3/4 years ago, but I don't know where I put the serial number and now I need it! Is anyway to find the series through the application code? Thank you!

    If it's a Windows machine, and then try running Belarc Advisor

    http://www.Belarc.com/free_download.html

    For a Mac, you can try:

    https://Mac-product-key-Finder.com/

    Find the serial number of your Adobe product quickly

  • Where to put the delay to show/hide code?

    Hi all.

    How can we?

    I have an item I want to delay when masking, I found a few

    things about that though, I'm having trouble finding where to put the code?

    Here is the script below without the delay. Where I would put the delay code?

    Everything I have tried does not work. He always "presents" the item but without any delay.

    sym.getComposition () .getStage ().getSymbol("Console_Content").getSymbol("console_text"). $("cons_select_text") () .show;

    Any help would be great!

    Thank you

    Hello

    This code does not work: sym.getComposition () .getStage ().getSymbol("Console_Content").getSymbol("console_text"). $("cons_select_text") .delay (1500) .show (1);

    You can use setTimeout or setInterval: Object Window

    delay() function {sym.getComposition () .getStage (.getSymbol("Console_Content")..getSymbol("console_text") $("cons_select_text")) .show ();}

    setTimeout (delay, 1500);

  • RosettaNet: Where to put the time to perform?

    Repost as a new thread:
    Hello

    I'll put 'Perform time = 1440' in my Collaboration of 3-4 but still my 3A 4 request to have expired after 2 hours. In this case, the accused happens instantly.

    I think that the field "Time" does not effect at all.

    I want that

    1. the application must expire after 2 hours, if it's in the ack State wait much longer and
    2. an application must expire after 1 day, if the corresponding response (Confirmation of the isozyme 3-4) does not appear in the time of 1 day (1440 minutes).

    Can you please suggest the configuration required for this change?

    Anuj has answered this question in an old thread,
    Where to put the time to perform?
    but it seems to be for 10g b2b.

    My question is how to define this value in 11g b2b?

    1. the application must expire after 2 hours, if it's in the ack State wait much longer and

    Under your remote TP channel channel attributes, set the interval to retry as 120 and Retry Count Zero. Your request will remain in State MSG_WAIT_ACK for 120 minutes and then it will error (if the acknowledgement is not received at that time)

    2. an application must expire after 1 day, if the corresponding response (Confirmation of the isozyme 3-4) does not appear in the time of 1 day (1440 minutes).

    Time to perform is not supported in B2B 11 g from now on. Log an SR with plug in charge if you need this feature to 11g. As a solution, you can manage the SLA to backend.

    Kind regards
    Anuj

  • Where to put the java code - best practices

    Hello. I work with the Jdeveloper 11.2.2. I'm trying to understand the best practices for where to put the code. After reviewing the http://docs.oracle.com/cd/E26098_01/web.1112/e16182.pdf, it seemed that request module was the preferred location (although many examples in the pdf file reside in the main methods). After some time of coding, if, I noticed that there was a certain libraries imported and wondered if this would impact performance.

    I looked at the articles published on the forum, in particular Re: programmatically access the method of service (customer interface) . This link mentions for access to the code a bean of support - and the bulk of the recommendations seem to be using the data control to drag to the Joint Strike Fighter, or use the links to access code.

    My interest lies in where to put the java code in the first place; In the view object, entity object, and... other Am, backing bean object?

    I can describe several guess better know where to put the code and the advantages and disadvantages:

    1. in the application module
    Benefits: Central location for code makes development and support easier as there are not multiple access points. Kinda like a data control centralizes the services, the module of the application can act as a conduit for the different parts of the code you have in your model objects.
    Cons: Everything in one place means that the module of the application becomes bloated. I don't know how the memory works in java - if the app module has tons of different libraries are all called when even a method of re - run a simple query is called? Memory of pigs?

    2. write the code in the objects it affects. If you write code that accesses a view object, write it to a display object. Then make it visible for the customer.
    benefits: the code is accessible through ducts less (for example, I expect that if you call the module from the application of a JSF backing bean, then the module of the application calls the view object, you have three different pieces of code-)
    CONT: the code gets spread, more difficult to locate etc.

    I would greatly appreciate your thought on the issue.


    Kind regards
    Stuart

    Published by: Stuart Fleming on May 20, 2012 05:25

    Published by: Stuart Fleming on May 20, 2012 05:27

    First point here is when you say 'where to put the code of java' and you're referring to ADF BC, the point is that you put 'code of java business logic' in the ADF business components. Of course it is very good to have the Java code in the ViewController layer that covers the user interface layer. Just don't put the business logic in the user interface layer and don't put no logical user interface in the model layer. In your 2 examples you seem to consider the ADF BC layer only, so I'll assume that you're not only serious logic java code.

    Meanwhile, I'm not keen on best practices in the term that people are following best practices without thinking, usually best practices come with conditions and forget to apply. Fortunately you do not here that you have thought through the pros and cons of each (nice work).

    Anyway, back on topic and turn off my soap box, regarding where to put your code, my thoughts:

    (1) If you have only 1 or 2 methods set in the AppModuleImpl

    (2) If you have hundreds of methods, or there is that a chance #1 above will turn into #2, divide the code between the AppModuleImpl, the ViewImpl and the ViewRowImpls. Why? Because your AM will become overloaded with hundreds of methods making it unreadable. Put the code where it should logically go instead. Methods that operate on a specific line of VO Approfondissez partner ViewRowImpl, methods that work across lines in a VO enter the ViewImpl and methods that work throughout your in the associated AppModuleImpl.

    To be honest that you never the option you choose, one thing I recommend as a best practice is to be consistent and document standard so not know your other programmers.

    BTW, it is not a question about loading a lot of libraries/imports in a class, it has no performance cost. However if your methods require a lot of class variables, then yes there will be a memory of the costs.

    On a side note, if you are interested in more ideas on how to create ADF applications properly think about joining the EMG "ADF", a forum which deals with ADF architecture, best practices (cough), deployment architectures free online and more.

    Kind regards

    CM.

  • Where to put the script?

    I'm a bit confused on where to put the script so we are quite sure, he will be executed.

    It is my observation that my script should be in the same framework for action takes place. I can't have it just in the 1st frame (like people) and hope that it work. For example, a script runs at the start of my menu frame 1. If I move the start menu in frame 5, the script stops working until I have move the script box 5 in the same layer of the menu.

    The script does not work after that you have a keyframe. It is not postponed, correct?

    What are the General rules on set scripts to?

    Thanks for your suggestions,

    ActionScript executes as soon as the playhead passes the frame that contains the script.  If you have actionscript on frame 1 that references objects which do not exist until the frame 5, the script is still running, but because your code refers to undefined objects, those intended objects will not be affected by the script.

    running ActionScript remains in force for as long as your swf file remains open or until another script removes, replaces or it nulls.

  • Site VPN to IPsec with PAT through the tunnel configuration example

    Hello

    as I read a lot about vpn connections site-2-site
    and pass by PAT through it I still haven't found an example configuration for it on e ASA 55xx.

    now, I got suite facility with two locations A and B.

    192.168.0.0/24 Site has - ipsec - Site B 192.168.200.0/24
    172.16.16.0/24 Site has

    ---------------------------------------------------------------------------

    Host--> participated in IP 192.168.0.4: 192.168.0.3-> to 192.168.200.20
    Host 192.168.0.127--> participated in IP: 192.168.0.3-> to 192.168.200.20
    Host 192.168.0.129--> participated in IP: 192.168.0.3-> to 192.168.200.20
    Host 192.168.0.253--> participated in IP: 192.168.0.3-> to 192.168.200.20

    Host 172.16.16.127--> participated in IP: 192.168.0.3-> to 192.168.200.20
    Host 172.16.16.253--> participated in IP: 192.168.0.3-> to 192.168.200.20

    ---------------------------------------------------------------------------

    Now that I have guests autour within networks 172.16.16.0 like 192.168.0.0,
    witch need to access a server terminal server on the SITE b.

    As I have no influence on where and when guests pop up in my Site.
    I would like to hide them behind a single ip address to SITE B.

    If in the event that a new hosts need access, or old hosts can be deleted,
    its as simple as the ACL or conviniently inlet remove the object from the network.

    so I guess that the acl looks like this:

    ---------------------------------------------------------------------------

    access VPN-PARTICIPATED-HOSTS list allow ip 192.168.0.4 host 192.168.200.20
    VPN-PARTICIPATED-HOSTS access list permit ip host 192.168.0.127 192.168.200.20
    VPN-PARTICIPATED-HOSTS access list permit ip host 192.168.0.129 192.168.200.20
    access VPN-PARTICIPATED-HOSTS list allow ip 192.168.0.253 host 192.168.200.20
    VPN-PARTICIPATED-HOSTS access list permit ip host 172.16.16.127 192.168.200.20
    VPN-PARTICIPATED-HOSTS access list permit ip host 172.16.16.253 192.168.200.20

    ---------------------------------------------------------------------------

    But, now, my big question is, how do I said the asa to use: 192.168.0.3 as the
    address for the translation of PAT?

    something like this he will say, it must be treated according to the policy:

    NAT (1-access VPN INVOLVED-HOST internal list)

    Now how do I do that?
    The rest of the config, I guess that will be quite normal as follows:

    card crypto outside_map 1 match address outside_1_cryptomap
    card crypto outside_map 1 set of AA peers. ABM CC. DD
    card crypto outside_map 1 set of transformation-ESP-AES-256-SHA
    outside_map card crypto 1 lifetime of security set association, 3600 seconds

    permit access list extended ip 192.168.0.3 outside_1_cryptomap host 192.168.200.20

    ---------------------------------------------------------------------------

    On SITE B

    the config is pretty simple:

    card crypto outside_map 1 match address outside_1_cryptomap
    card crypto outside_map 1 set of peer SITE has IP
    card crypto outside_map 1 set of transformation-ESP-AES-256-SHA
    outside_map card crypto 1 lifetime of security set association, 3600 seconds

    outside_1_cryptomap list extended access allowed host host 192.168.200.20 IP 192.168.0.3

    inside_nat0_outbound list extended access allowed host host 192.168.200.20 IP 192.168.0.3

    ---------------------------------------------------------------------------

    Thank you for you're extra eyes and precious time!

    Colin

    You want to PAT the traffic that goes through the tunnel?

    list of access allowed PAT ip 192.168.0.0 255.255.255.0 192.168.200.0 255.255.255.0

    PAT 172.16.16.0 permit ip access list 255.255.255.0 192.168.200.0 255.255.255.0

    NAT (inside) 1 access list PAT

    Global (outside) 1 192.168.0.3 255.255.255.255

    Then, the VPN ACL applied to the card encryption:

    list of access allowed vpn host ip 192.168.0.3 192.168.200.0 255.255.255.0

    Thus, all traffic from Site A will be PATed when you remotely 192.168.200.0/24

    The interesting thing is that traffic can only be activated from your end.

    The remote end cannot initialize traffic to 192.168.0.3 if there is not a version of dynamic translation on your side.

    Is that what you are looking for?

    Federico.

  • Separate menu Widget, but where to put the pages in the plan?

    Hello. I do a portfolio site and I have a number of galleries throughout my top-level pages. I inserted a menu widget for the buttons. I don't want my comments and Contact buttons to be grouped with the buttons of the Gallery, so I made a separate widget for my pages about and Contact, manual setting, on my master page.

    I can't know where in the tree view of the plan to put the words and Contact pages. When I put them on the pages of top level with the rest of my galleries, they appear in the menu of galleries, which is not where I want that they. I want them to be separated away keys the buttons of the gallery. If I put the words and Contact as children at my other top-level pages, then they will appear in a dropdown menu when you click on one of the galleries in the menu. Does anyone know where exactly in tree plan the Contact and remarks would go? Thank you.

    Place the pages where you want, right click on them to outline view and exclude them from the menu.

    Place a second, menu manual and use the command "hyperlink" to integrate the elements you want.

  • Where to put the virtual machine in a field of muti-user PC?

    Have the virtual machine just like I want but its currently located under the user name of the administrator who was connected when it is created.  Is there a better way to put the file to the Virtual Machine somewhere NOT specific user to all connected users can access from a shortcut on the desktop?  Thank you.

    Hello.

    You can place it everywhere where is most convenient.  I usually use something short like C:\VMs, so I can't look away!

    Good luck!

Maybe you are looking for

  • Yesterday, my pirate apple ID...

    Last night my apple hacked account, when I get emails about the access of my apple account, immediately I liked in my Mac and just saw in my iMessages that someone had sent dozens of messages to China 澳门博彩监察局→推荐! 博彩公司信誉平台:提供美女荷官真人百家乐.龙虎斗.老虎机.足球.彩票.时时

  • How can I view a Windows DVD based on my iMac

    How can I view a Windows DVD based on my iMac

  • Windows 7 remember password does not work

    I have a new laptop Windows 7, Firefox 12.0 computer running. He doesn't remember passwords. The "remember password prompt comes and I try to click on it but nothing happens. The guest just stays there. Verified options/security and passwords for sit

  • How can I change the formats for left and right pages?

    First timer here in the Apple community so forgive my mistakes. Works with Apple Pages 5.6.1 on a MacBook Air, try to format a book for automatic printing. I want to do different for left and right pages headers and footers, and margins so that, for

  • generation of waves of sinc using 5441

    How can I generate a wave of sinc in frequency by using PXI-5441 domain? and for upconversion I use 5610.